io.github.prodlint由 GitHub 账号 prodlint 发布v0.10.6更新于 Nov 8, 2026
Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.
对本地 JS/TS 项目或已部署网站运行 prodlint 静态生产就绪扫描，返回 0-100 评分和按严重程度排序的问题。
Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。
参照 仓库 中的启动说明。
[npm version] [npm downloads] [License: MIT]
Production readiness for vibe-coded apps.
Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.
Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.
prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production.
Or install it:
prodlint avoids common false positives:
middleware.ts, or proxy.ts on Next.js 16) detected — auth findings downgraded/* */ are ignored@/, ~/, and tsconfig paths aren't flagged as hallucinated importsfix hints with remediation codeEach category starts at 100. Deductions per finding:
Diminishing returns: after 30 points deducted in a category, further deductions are halved; after 50, quartered.
Weighted overall: security 40%, reliability 30%, performance 15%, ai-quality 15%. Floor at 0. Exit code 1 if any critical findings exist.
Add to .github/workflows/prodlint.yml:
Posts a score breakdown as a PR comment, and fails the build when the scan finds critical
issues or the score is below threshold. Each release of the action runs its matching
prodlint version, so pinning the action (@v1, a version tag, or a commit SHA) also pins
the scanner.
Upload prodlint results to GitHub's Security tab:
Adopt prodlint gradually without drowning in pre-existing findings:
Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
Claude Code:
Cursor / Windsurf:
prodlint-mcp is a thin launcher for the server built into prodlint. It's published with
every prodlint release, so it always runs the matching scanner.
Ask your AI: "Run prodlint on this project" and it calls the scan tool directly.
Both tools return a Markdown summary plus structured output (structuredContent matching
each tool's outputSchema), and both are marked read-only (readOnlyHint), which hosted
reviewers such as GitHub Copilot code review require before they call an MCP tool.
Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.
Or check your score interactively at prodlint.com/score.
prodlint is designed specifically for AI-generated code patterns. Every rule checks for production issues that AI coding tools consistently create — not style nits.
Suppress a single line:
Suppress an entire file (place at top):
MIT
来源：README.md，提交 5cef619
Scan a project for production readiness
Check a vibe-coded JS/TS project's production readiness. Returns a 0-100 score and findings across security, reliability, performance, and AI quality, most severe first. Every critical finding is always included; use minSeverity, categories, and maxFindings to narrow or widen the rest.
path必填ignorecategoriesmaxFindingsminSeverityScore a website's AI-agent readiness
Check a deployed website's AI agent-readiness. Returns a 0-100 score across 14 checks including robots.txt AI directives, llms.txt, AgentCard, WebMCP, and more.
url必填已满足适用检查项的 90%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。
npx prodlint prodlint v0.10.6 Scanned 148 files · 2 critical · 5 warnings · 1 info
src/app/api/checkout/route.ts 12:1 INFO No rate limiting — anyone could spam this endpoint and run up your API costs rate-limiting 28:5 WARN Empty catch block silently swallows error shallow-catch
src/actions/submit.ts 5:3 CRIT Server action uses formData without validation next-server-action-validation ↳ Validate with Zod: const data = schema.safeParse(Object.fromEntries(formData))
src/lib/db.ts 1:1 CRIT Package "drizzle-orm" is imported but not in package.json hallucinated-imports
Scores security 72 ████████████████░░░░ (8 issues) reliability 85 █████████████████░░░ (4 issues) performance 95 ███████████████████░ (1 issue) ai-quality 90 ██████████████████░░ (3 issues)
Overall: 82/100 (weighted)
2 critical · 5 warnings · 4 infonpx prodlint # Run directly (no install)npx prodlint ./my-app # Scan specific pathnpx prodlint --json # JSON output for CInpx prodlint --sarif # SARIF 2.1.0 for GitHub Code Scanningnpx prodlint --summary # Quick pass/fail + top 3 blockersnpx prodlint --profile startup # Only critical findingsnpx prodlint --profile strict # All findings including infonpx prodlint --baseline .prodlint-baseline.json # Only new findingsnpx prodlint --ignore "*.test.ts" # Ignore patternsnpx prodlint --min-severity warning # Only warnings and criticalsnpx prodlint --quiet # Suppress badge outputnpm i -D prodlint # Project dependencynpm i -g prodlint # Global installname: Prodlinton: [pull_request]
jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: prodlint/prodlint@v1 with: threshold: 50- name: Run prodlint run: npx prodlint --sarif > prodlint.sarif
- name: Upload SARIF uses: github/codeql-action/upload-sarif@v4 with: sarif_file: prodlint.sarif category: prodlint# Save current state as baselinenpx prodlint --baseline-save .prodlint-baseline.json
# CI only fails on NEW findingsnpx prodlint --baseline .prodlint-baseline.jsonclaude mcp add prodlint -- npx -y prodlint-mcp{ "mcpServers": { "prodlint": { "command": "npx", "args": ["-y", "prodlint-mcp"] } }}npx prodlint --web example.comnpx prodlint --web example.com --json # JSON output prodlint site score example.com · 14 checks
Score: 42 C ████████░░░░░░░░░░░░
✗ AI-Disclosure Header 0/10 No AI-Disclosure header found. ✗ Content-Usage Directives 0/10 No Content-Usage directives found. ✗ TDMRep 0/10 No TDMRep found. ✗ A2A AgentCard 0/5 No agent-card.json found. ✗ ai.txt 0/5 No ai.txt found at site root. ! llms.txt 2/5 llms.txt found but missing key sections. ✓ robots.txt 10/10 robots.txt found with 15 rules. ✓ Sitemap 10/10 Valid sitemap with 42 URLs. ✓ Structured Data 10/10 Found JSON-LD structured data. ✓ OpenGraph 10/10 Complete OpenGraph tags found. ✓ Page Speed 5/5 Loaded in 0.8s. ✓ AI Bot Directives 5/5 AI-specific bot rules found. ✓ WebMCP Tools 0/5 No WebMCP tools detected.
7 passed · 5 failed · 1 warnings
Full results: https://prodlint.com/score?url=example.com// prodlint-disable-next-line secretsconst key = "sk_test_example_for_docs"// prodlint-disable secretsimport { scan } from 'prodlint'
const result = await scan({ path: './my-project' })console.log(result.overallScore) // 0-100console.log(result.findings) // Finding[][](https://prodlint.com)