prodlint

prodlint

Production readiness for vibe-coded apps.

Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.

npx prodlint

  prodlint v0.10.6

Scanned 148 files · 2 critical · 5 warnings · 1 info

src/app/api/checkout/route.ts 12:1 INFO No rate limiting — anyone could spam this endpoint and run up your API costs rate-limiting 28:5 WARN Empty catch block silently swallows error shallow-catch

src/actions/submit.ts 5:3 CRIT Server action uses formData without validation next-server-action-validation ↳ Validate with Zod: const data = schema.safeParse(Object.fromEntries(formData))

src/lib/db.ts 1:1 CRIT Package "drizzle-orm" is imported but not in package.json hallucinated-imports

Scores security 72 ████████████████░░░░ (8 issues) reliability 85 █████████████████░░░ (4 issues) performance 95 ███████████████████░ (1 issue) ai-quality 90 ██████████████████░░ (3 issues)

Overall: 82/100 (weighted)

2 critical · 5 warnings · 4 info

Why?

Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.

prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production.

Install

npx prodlint                              # Run directly (no install)

npx prodlint ./my-app # Scan specific path npx prodlint --json # JSON output for CI npx prodlint --sarif # SARIF 2.1.0 for GitHub Code Scanning npx prodlint --summary # Quick pass/fail + top 3 blockers npx prodlint --profile startup # Only critical findings npx prodlint --profile strict # All findings including info npx prodlint --baseline .prodlint-baseline.json # Only new findings npx prodlint --ignore "*.test.ts" # Ignore patterns npx prodlint --min-severity warning # Only warnings and criticals npx prodlint --quiet # Suppress badge output

Or install it:

npm i -D prodlint     # Project dependency

npm i -g prodlint # Global install

52 Rules across 4 Categories

Security (27 rules)

Reliability (11 rules)

Performance (6 rules)

AI Quality (8 rules)

Smart Detection

prodlint avoids common false positives:

• AST parsing — Babel-based analysis for 14 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL, route handlers) with regex fallback
• Monorepo support — npm/yarn/pnpm workspace dependencies resolved automatically
• Framework awareness — Prisma, Drizzle, Supabase, Knex, and Sequelize whitelists prevent false SQL injection flags
• Middleware detection — Clerk, NextAuth, Supabase middleware (middleware.ts, or proxy.ts on Next.js 16) detected — auth findings downgraded
• Block comment awareness — patterns inside /* */ are ignored
• Path alias support — @/, ~/, and tsconfig paths aren't flagged as hallucinated imports
• Route exemptions — auth, webhook, health, and cron routes are exempt from auth/rate-limit checks
• Test/script file awareness — lower severity for non-production files
• Fix suggestions — findings include actionable fix hints with remediation code

Scoring

Each category starts at 100. Deductions per finding:

Diminishing returns: after 30 points deducted in a category, further deductions are halved; after 50, quartered.

Weighted overall: security 40%, reliability 30%, performance 15%, ai-quality 15%. Floor at 0. Exit code 1 if any critical findings exist.

GitHub Action

Add to .github/workflows/prodlint.yml:

name: Prodlint

on: [pull_request]

jobs: scan: runs-on: ubuntu-latest steps:

• uses: actions/checkout@v4
• uses: prodlint/prodlint@v1 with: threshold: 50

Posts a score breakdown as a PR comment, and fails the build when the scan finds critical issues or the score is below threshold. Each release of the action runs its matching prodlint version, so pinning the action (@v1, a version tag, or a commit SHA) also pins the scanner.

SARIF + GitHub Code Scanning

Upload prodlint results to GitHub's Security tab:

- name: Run prodlint

run: npx prodlint --sarif > prodlint.sarif

• name: Upload SARIF uses: github/codeql-action/upload-sarif@v4 with: sarif_file: prodlint.sarif category: prodlint

Baseline for Existing Projects

Adopt prodlint gradually without drowning in pre-existing findings:

# Save current state as baseline

npx prodlint --baseline-save .prodlint-baseline.json

CI only fails on NEW findings

npx prodlint --baseline .prodlint-baseline.json

MCP Server

Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:

Claude Code:

claude mcp add prodlint -- npx -y prodlint-mcp

Cursor / Windsurf:

{

"mcpServers": { "prodlint": { "command": "npx", "args": ["-y", "prodlint-mcp"] } } }

prodlint-mcp is a thin launcher for the server built into prodlint. It's published with every prodlint release, so it always runs the matching scanner.

Ask your AI: *"Run prodlint on this project"* and it calls the scan tool directly.

Both tools return a Markdown summary plus structured output (structuredContent matching each tool's outputSchema), and both are marked read-only (readOnlyHint), which hosted reviewers such as GitHub Copilot code review require before they call an MCP tool.

Site Score

Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.

npx prodlint --web example.com

npx prodlint --web example.com --json # JSON output

prodlint site score example.com · 14 checks

Score: 42 C ████████░░░░░░░░░░░░

✗ AI-Disclosure Header 0/10 No AI-Disclosure header found. ✗ Content-Us