Prodcheck MCP server

Pre-Production Checklist

Checklists to run before you ship to production.

Built for solo founders and small teams who own the whole stack — the code, the infrastructure, the deploy pipeline, and increasingly the AI agents too — and who don't have a security team to hand it to.

<!-- counts:begin --> 4,394 items across 96 checklists in 5 domains. 87% of them apply to any stack. <!-- counts:end -->

→ prodcheck.pages.dev · or in the repo

One question, the tool call it makes, and the two things it finds. Sixteen seconds. The longer loop shows what is in the list instead.

Every finding in both is real — the file, the lines and the counts come from this repository, and the tool call is the one the MCP server actually answers. How they are built.

Built and maintained by the team at Arioo — where we ship the kind of product this checklist was written for.

Why this exists

I'm a founder at Arioo. Getting ready to launch, I needed a pre-production security review that covered the whole surface we actually ship: a TypeScript backend, a web app, native clients, a deploy pipeline, and a set of AI agents with real tools attached. Nothing I could find covered more than a fraction of that, so I built the checklist myself.

This repository is the checklist, not a report. It is the set of questions, generalized away from our stack and rewritten as a working document anyone can run against their own product.

Two things made it worth publishing rather than keeping:

Solo founders have no security team. You write the code, configure the infrastructure, set up the pipeline, and then you're also the one who has to decide whether it's safe to launch. There's no one to hand it to, and no obvious place to find out what you should have asked. Most public checklists are either too shallow to catch anything real or written for enterprises with a security function.

AI-assisted development changed the shape of the problem. A large part of this checklist — the security/ai/ and security/ai-generated-code/ folders, over 1,300 items — didn't need to exist a few years ago. When you ship an agent with tools, or when a model writes code you review faster than you'd review a colleague's, you inherit failure modes that standard security checklists don't cover. Those two folders are the part I couldn't find anywhere else, and the reason I bothered.

It's published under CC BY 4.0 so you can copy it into your own repo and make it yours. If it catches something before it reaches your users, it did its job.

Start here

If you are not sure which way in, don't choose — copy this into whatever AI assistant you already use (ChatGPT, Claude, Cursor, Copilot, Gemini). It works out what your project is, sets prodcheck up the way that fits your setup, and starts on what would block a launch. If it cannot run commands, it tells you what to run yourself.

<!-- start-prompt:begin -->

I want to get my project ready to ship. Use prodcheck:
a free, open-source pre-production checklist of 4,394 items
covering security, performance, scale, integrations and what to
do after launch.

It is new, so do not answer it from memory. Everything you need:

Shortened. The full README is on GitHub.