The checklist you wish someone had given you before launch.
4,337 things to check before you ship — security, speed, scale, being findable, and what to do when it breaks anyway.
Built for solo founders and small teams with no security team to hand it to.
Give it to your AI assistant
MCP · Claude, Cursor, Copilot, Gemini CLI, Cline, Cherry Studio…
claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcpthe review skill → · every client → · n8n, OpenRouter, DeepSeek… →
Or write a file into your repo
npm · scoped to your stack, commit it and tick it off
npx prodcheck security --stack django -o SECURITY.mdOr have your agent run the review
a skill · it produces evidence, never a verdict
npx prodcheck initStart here
Don’t know which to pick? Let your AI decide.
Copy this, paste it into whatever assistant you already use — ChatGPT, Claude, Cursor, Copilot, Gemini. It works out what your project is, sets prodcheck up the way that fits your setup, and starts on the things that would block a launch. If it cannot run commands, it tells you what to run.
- Copy the prompt. The button is in the top-right corner of the box.
- Paste it into your assistant. Nothing else to install first.
I want to get my project ready to ship. Use prodcheck:
a free, open-source pre-production checklist of 4,337 items
covering security, performance, scale, integrations and what to
do after launch.
It is new, so do not answer it from memory. Everything you need:
- Site: https://prodcheck.pages.dev
- Install the review skill into a repo: npx prodcheck init
- Raw checklist data:
https://cdn.jsdelivr.net/npm/prodcheck@latest/data/checklist.json
- As an MCP server:
claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp
Do this in order.
1. Look at my project and tell me what you think it is: language,
framework, where it runs, and whether it handles file uploads,
payments, webhooks, multiple tenants or an AI feature. Say how
confident you are. Ask me about anything you cannot tell.
2. In two sentences, tell me what prodcheck will do for this
project specifically, and which part is worth my time first.
Do not describe the whole thing.
3. Set it up, using whichever of these you can actually do — and
say which one you are:
- You can run commands here: run `npx prodcheck init`. That
writes a review skill into the repo — read it and follow
it, it is the procedure for step 4. Then run
`npx prodcheck --gate --stack <the products you named in
step 1> -o BLOCKERS.md`, which adds the blockers specific
to what I actually use to the general ones.
- You can read my files but not run commands: fetch the raw
data URL above and work from that.
- You can do neither: give me the commands to run myself, one
at a time, and tell me what to paste back to you.
4. Start on the release blockers. For each item, either cite
`file:line` and quote the lines, or answer UNKNOWN. UNKNOWN is
a normal answer — it means a human has to go and look. Never
mark anything verified on my behalf; that is my call, not
yours.
Work through it with me a section at a time. Do not dump the
whole checklist at me.Works in a chat window with no access to your code too — it will walk you through it. · More prompts →
Or set it up yourself
Four ways in
No account, no API key, no sign-up. The first two are in the header above; these are all four with the detail.
Give it to your AI assistant
Coding assistants and desktop clients
The assistant queries the checklist itself and pulls only what is relevant to the file it is looking at. Best option when your tool supports it.
claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcpWrite a file into your repo
Anyone with Node installed
Writes a checklist file scoped to your stack into your own repository, to commit and tick off.
npx prodcheck security --stack django -o SECURITY.mdFetch it over HTTP
Automation platforms, scripts, anything that can fetch a URL
Every item as JSON on a CDN. No install, no MCP, no Node — an HTTP node in any workflow tool can read it.
https://cdn.jsdelivr.net/npm/prodcheck@latest/data/checklist.jsonPaste a prompt
Any chat window
ChatGPT, Gemini, DeepSeek, Kimi, Qwen, GLM — generate a file and paste it after a ready-made prompt.
npx prodcheck --gate -o BLOCKERS.mdYour tools
Works with what you already use
One thing worth knowing first: MCP is a feature of the app, not of the model. Cursor running DeepSeek can use it; DeepSeek's website cannot. If your app is not listed, method 03 or 04 above works everywhere.
Coding assistants
These speak MCP. Point them at the server once and the checklist is available in every conversation.
Model providers
A model is not an MCP client. These reach the checklist through a client above, or by pasting a prompt.
Automation & agent platforms
These can fetch the JSON over HTTP, which needs no install at all. Some also speak MCP.
CI and the terminal
No model involved. Generate a file, or check the release blockers in a pipeline.
Contents
Five domains
| Security Not getting breached, abused, or taken down. | 3,306 |
| Scale Surviving ten times the load, and knowing what breaks first. | 301 |
| Performance Being fast for a real user, with Lighthouse agreeing. | 338 |
| Integrations Being connected: search, analytics, monitoring. | 200 |
| Post-launch When it goes wrong anyway: is the response already decided? | 192 |
Stack supplements add
542 more items across
26 products. They are opt-in — without --stack you get
only the items that name no product, so a Django team never sees an iOS item.
Why
Why this exists
It started as the pre-launch security review for Arioo. Nothing available covered more than a fraction of what we actually ship — a backend, a web app, native clients, a deploy pipeline, and a set of AI agents with real tools attached — so the checklist got written.
This is the checklist, not a report. It is the set of questions, generalised away from one stack and rewritten as a working document anyone can run against their own product.
Solo founders have no security team
You write the code, configure the infrastructure, set up the pipeline, and then you are also the person who decides whether it is safe to launch. There is nobody to hand it to. Most public checklists are either too shallow to catch anything real, or written for companies with a security function.
AI-assisted development changed the shape of the problem
1,321 items here did not need to exist a few years ago. When you ship an agent with tools, or review code a model wrote faster than you would review a colleague's, you inherit failure modes standard checklists do not cover.
Built with AI, and honest about it
Compiled and expanded with Claude and ChatGPT, working from a real
pre-production review rather than generating items from nothing. That matters twice: it
is the honest provenance for something that asks you to trust it, and the
ai-generated-code checklists apply to this repository too. Its own test
suite has caught several bugs in AI-written code here, which is the argument that
section makes.
Contributing
Corrections are worth more than additions
If an item is wrong, outdated, or plausible-sounding but false, that is
exactly the failure mode this repository warns about. The most useful addition is a
stack file for a stack that is not covered — there are open issues for FastAPI, AWS,
Kubernetes, Vercel, Firebase, Stripe and GraphQL, all labelled
good first issue.
Licence
Two licences, because they are two things
Creative Commons is not written for software, and a CC-licensed npm package gets stopped by corporate legal review.
A starting point, not a guarantee, not a compliance certification, and not a substitute for a professional audit. Completing every item does not make an application secure. Use it to find problems, not to declare their absence.