prodlint

Catch the bugs AI leaves behind.

prodlint scans AI-generated JavaScript and TypeScript projects for production readiness issues — hallucinated imports, missing auth, exposed secrets, N+1 queries, and more. No LLM required, just pattern matching against known failure modes.

npx prodlint

  prodlint v0.3.1
  Scanned 148 files in 92ms

  src/app/api/checkout/route.ts
    12:1  CRIT  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting
    28:5  WARN  Empty catch block silently swallows error  shallow-catch

  src/lib/db.ts
    1:1   CRIT  Package "drizzle-orm" is imported but not in package.json  hallucinated-imports

  Scores
  security        72 ████████████████░░░░  (8 issues)
  reliability     85 █████████████████░░░  (4 issues)
  performance     95 ███████████████████░  (1 issue)
  ai-quality      90 ██████████████████░░  (3 issues)

  Overall: 85/100

  8 critical · 5 warnings · 3 info

Why?

AI code generators (Cursor, Copilot, v0, Bolt, Claude) write code that works in demos but breaks in production. Hardcoded secrets, hallucinated packages, missing auth, XSS vectors — these pass type-checks and look correct but aren't.

prodlint catches what TypeScript and ESLint miss: production readiness gaps.

Install

npx prodlint                      # Run directly (no install)
npx prodlint ./my-app             # Scan specific path
npx prodlint --json               # JSON output for CI
npx prodlint --ignore "*.test.ts" # Ignore patterns

Or install it:

npm i -D prodlint     # Project dependency
npm i -g prodlint     # Global install

27 Rules across 4 Categories

Security (10 rules)

Reliability (6 rules)

Performance (4 rules)

AI Quality (7 rules)

Smart Detection

prodlint avoids common false positives:

• Block comment awareness — patterns inside /* */ are ignored
• Middleware detection — if your project uses Clerk/NextAuth/Supabase middleware, auth findings are downgraded
• Path alias support — @/, ~/, and tsconfig paths aren't flagged as hallucinated imports
• Route exemptions — auth, webhook, health, and cron routes are exempt from auth/rate-limit checks
• Test/script file awareness — lower severity for non-production files

Scoring

Each category starts at 100. Deductions per finding:

Overall score = average of the 4 category scores (floor 0). Exit code 1 if any critical findings exist.

GitHub Action

Add to .github/workflows/prodlint.yml:

name: Prodlint
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: prodlint/prodlint@v1
        with:
          threshold: 50

Posts a score breakdown as a PR comment and fails the build if below threshold.

MCP Server

Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:

Claude Code:

claude mcp add prodlint npx prodlint-mcp

Cursor / Windsurf:

{
  "mcpServers": {
    "prodlint": {
      "command": "npx",
      "args": ["-y", "prodlint-mcp"]
    }
  }
}

Ask your AI: "Run prodlint on this project" and it calls the scan tool directly.

Suppression

Suppress a single line:

// prodlint-disable-next-line secrets
const key = "sk_test_example_for_docs"

Suppress an entire file (place at top):

// prodlint-disable secrets

Programmatic API

import { scan } from 'prodlint'

const result = await scan({ path: './my-project' })
console.log(result.overallScore) // 0-100
console.log(result.findings)     // Finding[]

Badge

[![prodlint](https://img.shields.io/badge/prodlint-85%2F100-brightgreen)](https://prodlint.com)

License

MIT