ipdata MCP by usefulapi
作者：m190
Look up location, network, company and threat data for IP addresses and ASNs in ipdata.
在云端运行今天更新
安装
Prodcheck
概览
作者提供的说明（英文原文）
4,685 pre-production checks: security, performance, scale, integrations, post-launch, people.
PopNx MCP 的三大支柱
这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。
- 用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
- 我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
- 使用情况i尚未统计★ –
它能帮你做什么
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
- 连接方式: 在你的电脑上运行
- 传输方式: stdio
- 分类: 网络安全
安装
选择你使用的 AI 应用，然后复制设置。
安装之前
- 基础检查：1 项中通过 1 项
- 在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
- 注册中心没有列出需要填写的密钥。
你需要
- npm已安装 Node.js（用于 npx 命令）
你用的是哪个应用？
在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。
打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"prodcheck": {
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}在终端中运行这条命令
claude mcp add prodcheck -- npx -y prodcheck或者自己复制设置
粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json
{
"mcpServers": {
"prodcheck": {
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
或者自己复制设置
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"prodcheck": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"prodcheck"
]
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。
你的选择通过 Cookie 保存在这台设备上，无需账户。
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。
它能做什么
它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。
基础检查i
我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日
- ✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 FarzamHabibi 验证，该账户拥有此仓库
- … 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
- … 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
- – 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
- – 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
- … 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表
与“网络安全”中的其他服务器比较i
- 星标数多于此分类中其他 993 个服务器的 0%
- 发布到注册中心的时间比此分类中其他 993 个服务器的 68% 更新
- 基础检查结果等于或优于此分类中其他 993 个服务器的 100%
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。
常见问题
Prodcheck 安全吗？
它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。
它需要哪些密钥或代码？
注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。
它在我的电脑上运行还是在云端？
它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。
它还在维护吗？
GitHub 仓库最后更新于–，最新版本（1.22.0）于19天前进入注册中心。
哪些应用可以使用它？
支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。
有什么可以替代它？
同一分类中有：ipdata MCP by usefulapi, MaxMind minFraud MCP by usefulapi, Lambda Labs MCP by usefulapi
替代选择
同一分类中其他作者的服务器，按星标数排序。
如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
MCP server for MaxMind minFraud — score transactions for fraud risk from your AI assistant.
在云端运行今天更新
安装
Lambda Labs MCP by usefulapi
作者：m190
Read GPU instances, types, images, filesystems and firewall rules; launch and terminate instances.
在云端运行今天更新
安装
作者的 README
打开 README
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
Pre-Production Checklist
Checklists to run before you ship to production.
Built for solo founders and small teams who own the whole stack — the code, the infrastructure, the deploy pipeline, and increasingly the AI agents too — and who don't have a security team to hand it to.
4,685 items across 101 checklists in 6 domains. 88% of them apply to any stack.
→ prodcheck.pages.dev · or in the repo
One question, the tool call it makes, and the two things it finds. Sixteen seconds. The longer loop shows what is in the list instead.
Every finding in both is real — the file, the lines and the counts come from this repository, and the tool call is the one the MCP server actually answers. How they are built.
Built and maintained by the team at [Arioo](https://arioo.com) — where we ship the kind of product this checklist was written for.
Why this exists
I'm a founder at Arioo. Getting ready to launch, I needed a pre-production security review that covered the whole surface we actually ship: a TypeScript backend, a web app, native clients, a deploy pipeline, and a set of AI agents with real tools attached. Nothing I could find covered more than a fraction of that, so I built the checklist myself.
This repository is the checklist, not a report. It is the set of questions, generalized away from our stack and rewritten as a working document anyone can run against their own product.
Two things made it worth publishing rather than keeping:
Solo founders have no security team. You write the code, configure the infrastructure, set up the pipeline, and then you're also the one who has to decide whether it's safe to launch. There's no one to hand it to, and no obvious place to find out what you should have asked. Most public checklists are either too shallow to catch anything real or written for enterprises with a security function.
AI-assisted development changed the shape of the problem. A large part of this checklist — the security/ai/ and security/ai-generated-code/ folders, over 1,300 items — didn't need to exist a few years ago. When you ship an agent with tools, or when a model writes code you review faster than you'd review a colleague's, you inherit failure modes that standard security checklists don't cover. Those two folders are the part I couldn't find anywhere else, and the reason I bothered.
It's published under CC BY 4.0 so you can copy it into your own repo and make it yours. If it catches something before it reaches your users, it did its job.
Start here
If you are not sure which way in, don't choose — copy this into whatever AI assistant you already use (ChatGPT, Claude, Cursor, Copilot, Gemini). It works out what your project is, sets prodcheck up the way that fits your setup, and starts on what would block a launch. If it cannot run commands, it tells you what to run yourself.
I want to get my project ready to ship. Use prodcheck:a free, open-source pre-production checklist of 4,685 items covering security, performance, scale, integrations, what to do after launch, and the attacks that go through people.
It is new, so do not answer it from memory. Everything you need:
- Site: https://prodcheck.pages.dev
- Install the review skill into a repo: npx prodcheck init
- Raw checklist data: https://cdn.jsdelivr.net/npm/prodcheck@latest/data/checklist.json
- As an MCP server: claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp
Do this in order.
- Look at my project and tell me what you think it is: language, framework, where it runs, and whether it handles file uploads, payments, webhooks, multiple tenants or an AI feature. Say how confident you are. Ask me about anything you cannot tell.
- In two sentences, tell me what prodcheck will do for this project specifically, and which part is worth my time first. Do not describe the whole thing.
- Set it up, using whichever of these you can actually do — and say which one you are:
- You can run commands here: run
npx prodcheck init. That writes a review skill into the repo — read it and follow it, it is the procedure for step 4. Then runnpx prodcheck --gate --stack -o BLOCKERS.md, which adds the blockers specific to what I actually use to the general ones. - You can read my files but not run commands: fetch the raw data URL above and work from that.
- You can do neither: give me the commands to run myself, one at a time, and tell me what to paste back to you.
- Start on the release blockers. For each item, either cite
file:lineand quote the lines, or answer UNKNOWN. UNKNOWN is a normal answer — it means a human has to go and look. Never mark anything verified on my behalf; that is my call, not yours.
Work through it with me a section at a time. Do not dump the whole checklist at me.
<!-- start-prompt:end -->Read it on the site instead → · six more prompts →
Or work through it yourself
You are not meant to read this top to bottom. In order of signal-per-minute:
| 1 | Findings that should block release | If any are true, stop and fix them first |
| 2 | The "must not exist" search | A grep list. Fastest real signal in the repo |
| 3 | Authentication & authorization | Where almost every exploitable bug actually lives |
| 4 | Prompt injection | Only if you ship an LLM feature — but then, urgently |
| 5 | Your service as a weapon | The one nobody looks for until the suspension email arrives |
| 6 | Core Web Vitals | If users say it's slow, start here rather than with a score |
| 7 | Before you launch | Six items. One of them is noindex still being on |
| 8 | Can you act at all | Whether you could respond today, if you had to |
Then work section by section. Switching between edge config and database policies costs more than it saves.
Structure
checklists/├── security/ 2981 not getting breached, abused or taken down │ ├── core/ 1,619 application, data, infrastructure, delivery │ ├── ai/ 810 LLM features, agents, tools, RAG, MCP │ └── ai-generated-code/ 552 the bugs AI coding assistants actually write ├── performance/ 313 Lighthouse, and what users actually feel ├── scale/ 288 surviving 10× the load ├── integrations/ 194 search, analytics, monitoring ├── post-launch/ 241 when it goes wrong anyway ├── people/ 87 the attacks that go around the code └── stacks/ 581 26 products, spanning every domain
Counts above are what each folder holds. A *domain* total is larger, because the stack supplements contribute to whichever domain each of their sections extends:
security 3,514 performance 338 scale 303 integrations 202 post-launch 241 people 87Domains are the top level because that is the question you arrive with: *is this about security, or speed, or scale?*
security/core/ — applies to you regardless of language
Written originally against a TypeScript stack, but the *controls* are not TypeScript-specific and the files no longer pretend otherwise. "Verify CORS does not use wildcard origins with credentials" is as true in Django as in Express. Everything that genuinely named a product was moved out to stacks/.
If you write Python, Go, Ruby, PHP, Java, Rust or Elixir: this folder is your checklist, all 1,619 items of it.
| Items | Items | |||
|---|---|---|---|---|
| Architecture & threat model | 25 | Mobile apps | 107 | |
| Authentication & authorization | 130 | Desktop apps | 41 | |
| Sessions, tokens & cookies | 23 | Runtime & containers | 109 | |
| Backend application & API | 238 | DNS, CDN, edge & WAF | 90 | |
| Web frontend | 134 | CI/CD & supply chain | 176 | |
| Database & row-level security | 72 | Monitoring & incident response | 32 | |
| Object storage & files | 69 | Pre-release gates | 151 | |
| Secrets & cryptography | 51 | |||
| Common web attacks | 63 | |||
| Business logic & race conditions | 51 | Abuse & availability | 57 |
security/ai/ — the part you won't find in a standard checklist
If your product calls a model, gives it tools, retrieves documents into its context, or runs an agent, this folder is the reason this repo exists. It is stack-agnostic and provider-agnostic.
| Items | Items | |||
|---|---|---|---|---|
| Architecture & identity | 70 | Multi-agent & MCP | 87 | |
| Prompt injection & goal hijacking | 95 | Integrations | 76 | |
| Tool calling & excessive agency | 71 | Cost, reliability & audit | 65 | |
| Data access & privacy | 83 | Testing & red-team pack | 97 | |
| Output handling | 67 | Release gate | 47 | |
| RAG & agent memory | 52 |
Prompt injection is not a filtering problem. It is an authorization problem wearing a
text costume — untrusted text reaching a privileged execution path.
security/ai-generated-code/ — bugs AI assistants write
Also known as *vibe coding*. 548 items org
只显示了开头部分；其余内容请在仓库中阅读