# prodlint

prodlint scans code for security, reliability, performance, and AI-quality issues. Use it to review an app before production.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 15
- Author: prodlint
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/prodlint/prodlint
- Updated: 2026-09-27
- HTML: https://affpapa.org/en/nevibecode/mcp/prodlint

## What it does

prodlint provides static analysis with zero configuration and no LLM. Its checks cover hardcoded secrets, missing authentication, unchecked inputs, imports for undeclared packages, weak error handling, and other issues. The README groups 52 rules into security, reliability, performance, and AI-quality categories.

The MCP server starts with `npx -y prodlint-mcp` and lets an agent run prodlint checks against a project. Findings are reported as critical issues, warnings, or informational items, which gives the agent concrete points to inspect. Because the server is launched through `npx`, the environment must be able to run that command.

prodlint is listed for Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, and Gemini CLI.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add prodlint -- npx -y prodlint-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add prodlint -- npx -y prodlint-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "prodlint": {
            "command": "npx",
            "args": [
                "-y",
                "prodlint-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "prodlint": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "prodlint-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add prodlint npx -y prodlint-mcp
```

## When to use it
- scan source files for hardcoded secrets
- flag API routes without authentication
- catch imports missing from `package.json`
- spot SQL injection and unsafe redirects
- find floating promises and unbounded queries

## Example prompts
- Run `prodlint` on this project and group the findings by severity.
- Check the code for missing authentication and explain each critical result.
- Use prodlint to review security and reliability issues before release.

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [audit-prep-assistant](https://affpapa.org/en/nevibecode/skills/audit-prep-assistant.md) — skill · 5700 installs
- [code-review-pro](https://affpapa.org/en/nevibecode/skills/code-review-pro.md) — skill · 2600 installs
- [trailmark-review-gate](https://affpapa.org/en/nevibecode/skills/trailmark-review-gate.md) — skill · 1300 installs
- [code-review](https://affpapa.org/en/nevibecode/skills/llama-farm-code-review.md) — skill · 1200 installs
- [vuln-scan](https://affpapa.org/en/nevibecode/skills/vuln-scan.md) — skill · 1100 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md