io.github.prodlint由 GitHub 帳號 prodlint 發布v0.10.6更新於 Nov 1, 2026
Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.
對本機 JS/TS 專案或已部署網站執行 prodlint 靜態上線就緒掃描，回傳 0-100 評分與依嚴重度排序的問題。
Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。
參照 儲存庫 中的啟動說明。
[npm version] [npm downloads] [License: MIT]
Production readiness for vibe-coded apps.
Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.
Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.
prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production.
Or install it:
prodlint avoids common false positives:
middleware.ts, or proxy.ts on Next.js 16) detected — auth findings downgraded/* */ are ignored@/, ~/, and tsconfig paths aren't flagged as hallucinated importsfix hints with remediation codeEach category starts at 100. Deductions per finding:
Diminishing returns: after 30 points deducted in a category, further deductions are halved; after 50, quartered.
Weighted overall: security 40%, reliability 30%, performance 15%, ai-quality 15%. Floor at 0. Exit code 1 if any critical findings exist.
Add to .github/workflows/prodlint.yml:
Posts a score breakdown as a PR comment, and fails the build when the scan finds critical
issues or the score is below threshold. Each release of the action runs its matching
prodlint version, so pinning the action (@v1, a version tag, or a commit SHA) also pins
the scanner.
Upload prodlint results to GitHub's Security tab:
Adopt prodlint gradually without drowning in pre-existing findings:
Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
Claude Code:
Cursor / Windsurf:
prodlint-mcp is a thin launcher for the server built into prodlint. It's published with
every prodlint release, so it always runs the matching scanner.
Ask your AI: "Run prodlint on this project" and it calls the scan tool directly.
Both tools return a Markdown summary plus structured output (structuredContent matching
each tool's outputSchema), and both are marked read-only (readOnlyHint), which hosted
reviewers such as GitHub Copilot code review require before they call an MCP tool.
Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.
Or check your score interactively at prodlint.com/score.
prodlint is designed specifically for AI-generated code patterns. Every rule checks for production issues that AI coding tools consistently create — not style nits.
Suppress a single line:
Suppress an entire file (place at top):
MIT
來源：README.md，提交 5cef619
Scan a project for production readiness
Check a vibe-coded JS/TS project's production readiness. Returns a 0-100 score and findings across security, reliability, performance, and AI quality, most severe first. Every critical finding is always included; use minSeverity, categories, and maxFindings to narrow or widen the rest.
path必填ignorecategoriesmaxFindingsminSeverityScore a website's AI-agent readiness
Check a deployed website's AI agent-readiness. Returns a 0-100 score across 14 checks including robots.txt AI directives, llms.txt, AgentCard, WebMCP, and more.
url必填已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。
npx prodlint prodlint v0.10.6 Scanned 148 files · 2 critical · 5 warnings · 1 info
src/app/api/checkout/route.ts 12:1 INFO No rate limiting — anyone could spam this endpoint and run up your API costs rate-limiting 28:5 WARN Empty catch block silently swallows error shallow-catch
src/actions/submit.ts 5:3 CRIT Server action uses formData without validation next-server-action-validation ↳ Validate with Zod: const data = schema.safeParse(Object.fromEntries(formData))
src/lib/db.ts 1:1 CRIT Package "drizzle-orm" is imported but not in package.json hallucinated-imports
Scores security 72 ████████████████░░░░ (8 issues) reliability 85 █████████████████░░░ (4 issues) performance 95 ███████████████████░ (1 issue) ai-quality 90 ██████████████████░░ (3 issues)
Overall: 82/100 (weighted)
2 critical · 5 warnings · 4 infonpx prodlint # Run directly (no install)npx prodlint ./my-app # Scan specific pathnpx prodlint --json # JSON output for CInpx prodlint --sarif # SARIF 2.1.0 for GitHub Code Scanningnpx prodlint --summary # Quick pass/fail + top 3 blockersnpx prodlint --profile startup # Only critical findingsnpx prodlint --profile strict # All findings including infonpx prodlint --baseline .prodlint-baseline.json # Only new findingsnpx prodlint --ignore "*.test.ts" # Ignore patternsnpx prodlint --min-severity warning # Only warnings and criticalsnpx prodlint --quiet # Suppress badge outputnpm i -D prodlint # Project dependencynpm i -g prodlint # Global installname: Prodlinton: [pull_request]
jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: prodlint/prodlint@v1 with: threshold: 50- name: Run prodlint run: npx prodlint --sarif > prodlint.sarif
- name: Upload SARIF uses: github/codeql-action/upload-sarif@v4 with: sarif_file: prodlint.sarif category: prodlint# Save current state as baselinenpx prodlint --baseline-save .prodlint-baseline.json
# CI only fails on NEW findingsnpx prodlint --baseline .prodlint-baseline.jsonclaude mcp add prodlint -- npx -y prodlint-mcp{ "mcpServers": { "prodlint": { "command": "npx", "args": ["-y", "prodlint-mcp"] } }}npx prodlint --web example.comnpx prodlint --web example.com --json # JSON output prodlint site score example.com · 14 checks
Score: 42 C ████████░░░░░░░░░░░░
✗ AI-Disclosure Header 0/10 No AI-Disclosure header found. ✗ Content-Usage Directives 0/10 No Content-Usage directives found. ✗ TDMRep 0/10 No TDMRep found. ✗ A2A AgentCard 0/5 No agent-card.json found. ✗ ai.txt 0/5 No ai.txt found at site root. ! llms.txt 2/5 llms.txt found but missing key sections. ✓ robots.txt 10/10 robots.txt found with 15 rules. ✓ Sitemap 10/10 Valid sitemap with 42 URLs. ✓ Structured Data 10/10 Found JSON-LD structured data. ✓ OpenGraph 10/10 Complete OpenGraph tags found. ✓ Page Speed 5/5 Loaded in 0.8s. ✓ AI Bot Directives 5/5 AI-specific bot rules found. ✓ WebMCP Tools 0/5 No WebMCP tools detected.
7 passed · 5 failed · 1 warnings
Full results: https://prodlint.com/score?url=example.com// prodlint-disable-next-line secretsconst key = "sk_test_example_for_docs"// prodlint-disable secretsimport { scan } from 'prodlint'
const result = await scan({ path: './my-project' })console.log(result.overallScore) // 0-100console.log(result.findings) // Finding[][](https://prodlint.com)