ipdata MCP by usefulapi
by m190
Look up location, network, company and threat data for IP addresses and ASNs in ipdata.
Runs in the cloudUpdated today
Install
Prodcheck
Overview
Description from the maker (original English)
4,685 pre-production checks: security, performance, scale, integrations, post-launch, people.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Cybersecurity
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"prodcheck": {
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}Run this in your terminal
claude mcp add prodcheck -- npx -y prodcheckOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"prodcheck": {
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"prodcheck": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account FarzamHabibi, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Cybersecurityi
- More stars than 0% of the other 993 servers in this category
- Published to the registry more recently than 68% of the other 993 servers in this category
- Basic checks equal to or better than 100% of the other 993 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Prodcheck safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.22.0) reached the registry 19 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: ipdata MCP by usefulapi, MaxMind minFraud MCP by usefulapi, Lambda Labs MCP by usefulapi
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
MCP server for MaxMind minFraud — score transactions for fraud risk from your AI assistant.
Runs in the cloudUpdated today
Install
Lambda Labs MCP by usefulapi
by m190
Read GPU instances, types, images, filesystems and firewall rules; launch and terminate instances.
Runs in the cloudUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
Pre-Production Checklist
Checklists to run before you ship to production.
Built for solo founders and small teams who own the whole stack — the code, the infrastructure, the deploy pipeline, and increasingly the AI agents too — and who don't have a security team to hand it to.
4,685 items across 101 checklists in 6 domains. 88% of them apply to any stack.
→ prodcheck.pages.dev · or in the repo
One question, the tool call it makes, and the two things it finds. Sixteen seconds. The longer loop shows what is in the list instead.
Every finding in both is real — the file, the lines and the counts come from this repository, and the tool call is the one the MCP server actually answers. How they are built.
Built and maintained by the team at [Arioo](https://arioo.com) — where we ship the kind of product this checklist was written for.
Why this exists
I'm a founder at Arioo. Getting ready to launch, I needed a pre-production security review that covered the whole surface we actually ship: a TypeScript backend, a web app, native clients, a deploy pipeline, and a set of AI agents with real tools attached. Nothing I could find covered more than a fraction of that, so I built the checklist myself.
This repository is the checklist, not a report. It is the set of questions, generalized away from our stack and rewritten as a working document anyone can run against their own product.
Two things made it worth publishing rather than keeping:
Solo founders have no security team. You write the code, configure the infrastructure, set up the pipeline, and then you're also the one who has to decide whether it's safe to launch. There's no one to hand it to, and no obvious place to find out what you should have asked. Most public checklists are either too shallow to catch anything real or written for enterprises with a security function.
AI-assisted development changed the shape of the problem. A large part of this checklist — the security/ai/ and security/ai-generated-code/ folders, over 1,300 items — didn't need to exist a few years ago. When you ship an agent with tools, or when a model writes code you review faster than you'd review a colleague's, you inherit failure modes that standard security checklists don't cover. Those two folders are the part I couldn't find anywhere else, and the reason I bothered.
It's published under CC BY 4.0 so you can copy it into your own repo and make it yours. If it catches something before it reaches your users, it did its job.
Start here
If you are not sure which way in, don't choose — copy this into whatever AI assistant you already use (ChatGPT, Claude, Cursor, Copilot, Gemini). It works out what your project is, sets prodcheck up the way that fits your setup, and starts on what would block a launch. If it cannot run commands, it tells you what to run yourself.
I want to get my project ready to ship. Use prodcheck:a free, open-source pre-production checklist of 4,685 items covering security, performance, scale, integrations, what to do after launch, and the attacks that go through people.
It is new, so do not answer it from memory. Everything you need:
- Site: https://prodcheck.pages.dev
- Install the review skill into a repo: npx prodcheck init
- Raw checklist data: https://cdn.jsdelivr.net/npm/prodcheck@latest/data/checklist.json
- As an MCP server: claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp
Do this in order.
- Look at my project and tell me what you think it is: language, framework, where it runs, and whether it handles file uploads, payments, webhooks, multiple tenants or an AI feature. Say how confident you are. Ask me about anything you cannot tell.
- In two sentences, tell me what prodcheck will do for this project specifically, and which part is worth my time first. Do not describe the whole thing.
- Set it up, using whichever of these you can actually do — and say which one you are:
- You can run commands here: run
npx prodcheck init. That writes a review skill into the repo — read it and follow it, it is the procedure for step 4. Then runnpx prodcheck --gate --stack -o BLOCKERS.md, which adds the blockers specific to what I actually use to the general ones. - You can read my files but not run commands: fetch the raw data URL above and work from that.
- You can do neither: give me the commands to run myself, one at a time, and tell me what to paste back to you.
- Start on the release blockers. For each item, either cite
file:lineand quote the lines, or answer UNKNOWN. UNKNOWN is a normal answer — it means a human has to go and look. Never mark anything verified on my behalf; that is my call, not yours.
Work through it with me a section at a time. Do not dump the whole checklist at me.
<!-- start-prompt:end -->Read it on the site instead → · six more prompts →
Or work through it yourself
You are not meant to read this top to bottom. In order of signal-per-minute:
| 1 | Findings that should block release | If any are true, stop and fix them first |
| 2 | The "must not exist" search | A grep list. Fastest real signal in the repo |
| 3 | Authentication & authorization | Where almost every exploitable bug actually lives |
| 4 | Prompt injection | Only if you ship an LLM feature — but then, urgently |
| 5 | Your service as a weapon | The one nobody looks for until the suspension email arrives |
| 6 | Core Web Vitals | If users say it's slow, start here rather than with a score |
| 7 | Before you launch | Six items. One of them is noindex still being on |
| 8 | Can you act at all | Whether you could respond today, if you had to |
Then work section by section. Switching between edge config and database policies costs more than it saves.
Structure
checklists/├── security/ 2981 not getting breached, abused or taken down │ ├── core/ 1,619 application, data, infrastructure, delivery │ ├── ai/ 810 LLM features, agents, tools, RAG, MCP │ └── ai-generated-code/ 552 the bugs AI coding assistants actually write ├── performance/ 313 Lighthouse, and what users actually feel ├── scale/ 288 surviving 10× the load ├── integrations/ 194 search, analytics, monitoring ├── post-launch/ 241 when it goes wrong anyway ├── people/ 87 the attacks that go around the code └── stacks/ 581 26 products, spanning every domain
Counts above are what each folder holds. A *domain* total is larger, because the stack supplements contribute to whichever domain each of their sections extends:
security 3,514 performance 338 scale 303 integrations 202 post-launch 241 people 87Domains are the top level because that is the question you arrive with: *is this about security, or speed, or scale?*
security/core/ — applies to you regardless of language
Written originally against a TypeScript stack, but the *controls* are not TypeScript-specific and the files no longer pretend otherwise. "Verify CORS does not use wildcard origins with credentials" is as true in Django as in Express. Everything that genuinely named a product was moved out to stacks/.
If you write Python, Go, Ruby, PHP, Java, Rust or Elixir: this folder is your checklist, all 1,619 items of it.
| Items | Items | |||
|---|---|---|---|---|
| Architecture & threat model | 25 | Mobile apps | 107 | |
| Authentication & authorization | 130 | Desktop apps | 41 | |
| Sessions, tokens & cookies | 23 | Runtime & containers | 109 | |
| Backend application & API | 238 | DNS, CDN, edge & WAF | 90 | |
| Web frontend | 134 | CI/CD & supply chain | 176 | |
| Database & row-level security | 72 | Monitoring & incident response | 32 | |
| Object storage & files | 69 | Pre-release gates | 151 | |
| Secrets & cryptography | 51 | |||
| Common web attacks | 63 | |||
| Business logic & race conditions | 51 | Abuse & availability | 57 |
security/ai/ — the part you won't find in a standard checklist
If your product calls a model, gives it tools, retrieves documents into its context, or runs an agent, this folder is the reason this repo exists. It is stack-agnostic and provider-agnostic.
| Items | Items | |||
|---|---|---|---|---|
| Architecture & identity | 70 | Multi-agent & MCP | 87 | |
| Prompt injection & goal hijacking | 95 | Integrations | 76 | |
| Tool calling & excessive agency | 71 | Cost, reliability & audit | 65 | |
| Data access & privacy | 83 | Testing & red-team pack | 97 | |
| Output handling | 67 | Release gate | 47 | |
| RAG & agent memory | 52 |
Prompt injection is not a filtering problem. It is an authorization problem wearing a
text costume — untrusted text reaching a privileged execution path.
security/ai-generated-code/ — bugs AI assistants write
Also known as *vibe coding*. 548 items org
Only the beginning is shown; read the rest in the repo