ProdKit

ProdKit is a deterministic local CLI that analyzes an existing web application repository and generates a production-readiness report or a remediation plan.

It is designed for early-stage and AI-generated apps where architecture and security quality can vary significantly.

ProdKit is read-only: it never modifies the target repository.

What ProdKit does

ProdKit inspects a target project and detects:

• Frontend framework signals
• Backend framework signals
• Database technologies
• Package manager
• Docker and Docker Compose presence
• Environment file and env-usage hygiene
• Authentication and authorization signals
• Tenant/organization signals
• GDPR/privacy signals
• Security hardening signals
• Upload exposure signals
• Billing signals: payment processors declared in any manifest this reads
• Observability/logging signals
• Background jobs/queue signals
• Deployment readiness signals

Then it builds a structured production-readiness report with:

• Overall score (0-100), or null where too little of the repository could be read to characterise it
• Maturity level (inconclusive, prototype, early, partial, production_ready)
• Findings grouped by category
• Critical issues and warnings
• Passed checks
• Suggested next steps
• Technical evidence for each finding — a file and a line you can open, not a summary

Two things the report says about its own reading, because a finding is only worth what the reading behind it is:

• How deeply each language was read. A syntax tree answered the question, or a keyword search did, or the language was not read at all — and the report names which, per language. The optional typescript peer dependency decides whether JavaScript and TypeScript are parsed; without it they are searched as text, and the report says so rather than claiming otherwise.
• Which questions could not be asked. A check whose answer depends on a reader that could not run comes back unknown, never passed and never missing. Blindness can turn a verdict into no verdict; it is not allowed to turn one into its opposite.

From the report, ProdKit can also build a deterministic remediation plan with phases, task priorities, effort estimates, and test suggestions.

Installation

npm install -g @produtype/core
prodkit analyze .

The MCP server needs one extra package, and only if you use it:

npm install @modelcontextprotocol/sdk   # for prodkit-mcp

It is an optional peer dependency rather than a dependency because it brings 164 packages with it — nine tenths of what this package used to install — for a server most people never run, along with network, shell and eval access that the analyzer itself does not use. Installing this package alone brings 19.

The command is prodkit; the package is @produtype/core. They differ on purpose: prodkit on npm is an unrelated and actively maintained package, so this one is published under the @produtype scope. npm i prodkit installs somebody else's project.

Local development install

1. Install dependencies:

npm install

2. Build CLI:

npm run build

3. Link globally for local usage:

npm link

After linking, use:

prodkit --help

Local development

npm install
npm run build
npm test

Optional lint:

npm run lint

Checking a detector against real repositories

The fixture corpus only contains what somebody wrote into it, so a pattern broad enough to match ordinary code passes it untouched. One did: it changed nothing across 234 fixtures and inferred three real B2B products as marketplaces, because no fixture happens to write a Next.js redirect.

npm run wild clones the repositories listed in scripts/wild-repos.json, records the profile it infers and the status of every capability, compares that against scripts/wild-baseline.json, and deletes the sources again. It needs the network, so it is not part of CI — run it before releasing a change to a detector.

npm run wild            # compare against the baseline
npm run wild -- --write # record current behaviour as the baseline

A change it reports is not automatically a regression; it is a change that has to be explained before it ships. Only the verdicts are kept in the repository — no cloned source is retained.

Commands

Diagnostic command:

prodkit analyze <path-to-project>

Remediation planning command:

prodkit plan <path-to-project>

Options:

• --format markdown|json output format for the report or plan payload
• --summary print summary only
• --output <path> write output to file
• --profile <name> evaluate expected product capabilities (static-site, internal-tool, b2c-app, b2b-saas, ai-saas, marketplace, game, client-app, mobile-app, auto, observed-only)
• --fail-under <score> (analyze only) exit with code 1 if the overall score is below the threshold — useful as a CI quality gate
• --min-maturity <level> (analyze only) exit with code 1 if maturity is below prototype|early|partial|production_ready
• --ai (analyze only) add an AI stack/architecture insight — opt-in, advisory only, does not affect the score
• --ai-review (analyze only) add an AI semantic review of fine-grained code issues — opt-in, advisory only, does not affect the score

Optional AI layer:

• A separate package. The AI features live in @produtype/ai, which is commercial and is not a dependency of this package. An open source install runs the deterministic analysis only, and --ai reports that the package is not installed rather than failing. That package brings its own model access; nothing needs to be configured here to run the analysis.
• ProdKit stays deterministic, offline, and read-only: nothing here makes a network call.
• When @produtype/ai is installed, it redacts secrets from repository content before sending anything, and its output stays advisory — it never changes the deterministic score.

Profile warning:

• Without a product profile, ProdKit only scores observed deterministic findings. Use --profile to evaluate expected product capabilities.

Inconclusive assessments:

• Where nothing identifies the repository, where too few checks reach a verdict, or where most of it is written in a language this cannot read, the report is marked inconclusive and there is no score at all: overallScore is null and the maturity level is inconclusive. It used to cap the score at 39 instead, which was a number standing where an answer was missing.

Examples

prodkit analyze ../my-app
prodkit analyze ../my-app --profile b2b-saas
prodkit analyze ../my-app --profile auto
prodkit analyze ../my-app --summary
prodkit analyze ../my-app --format markdown
prodkit analyze ../my-app --format json
prodkit analyze ../my-app --output prodkit-report.md
prodkit analyze tests/fixtures/express-basic --format json --output report.json
prodkit analyze ../my-app --fail-under 65
prodkit analyze ../my-app --min-maturity partial
prodkit plan ../my-app
prodkit plan ../my-app --profile b2b-saas
prodkit plan ../my-app --profile observed-only
prodkit plan ../my-app --format markdown
prodkit plan ../my-app --format json
prodkit plan ../my-app --output prodkit-plan.md

Supported stacks

Generated from the analyzer itself — run npm run docs:stacks after changing a detector.

• Backend: Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Phoenix, Plug, Bandit, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
• Frontend: React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
• Mobile: Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
• Databases: Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
• Hosted data platforms: Supabase, Firebase, PlanetScale, Neon, Vercel Postgres, Turso, Upstash, DynamoDB, Convex
• ORMs: Prisma, Drizzle, TypeORM, Sequelize, Knex, MikroORM, Kysely, SQLAlchemy, Tortoise, Peewee

How some of these are decided:

• Express — the dependency, or an import in the source
• Astro — counted as a backend only when configured to serve requests
• Django — manage.py, settings.py and urls.py together
• Flask — the dependency, or an import in the source
• FastAPI — the dependency, or an import in the source
• aiohttp — aiohttp.web in the source — the dependency alone is a client
• Go — a go.mod with no framework in it — net/http is a real answer
• Ruby — a Gemfile with no web framework in it
• PHP — PHP sources with no framework in composer.json
• ASP.NET Core — the Microsoft.NET.Sdk.Web SDK attribute
• Cloudflare Workers — a wrangler manifest beside a module exporting a fetch handler
• Flutter — pubspec.yaml — classified as a client application, not a backend
• React Native — the react-native or expo dependency
• iOS (native) — Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree
• Android (native) — AndroidManifest.xml, or build.gradle in either dialect
• SwiftUI — import SwiftUI
• UIKit — import UIKit
• Jetpack Compose — import androidx.compose
• Android views — import androidx.appcompat, or android.app.Activity
• Supabase — recorded alongside the engine it is — Postgres
• Firebase — Firestore
• PlanetScale — MySQL
• Neon — Postgres
• Vercel Postgres — Postgres
• Turso — SQLite
• Upstash — Redis

A hosted platform is recorded separately from the engine underneath it, so rules written about an engine keep working without knowing about the host, while "this data lives on infrastructure someone else operates" stays a question the report can ask on its own.

Current limitations

• Deterministic heuristics only: the AI layer is a separate package (see above)
• JavaScript and TypeScript are parsed when the optional typescript peer dependency is installed; every other language is read as text, matched against what its frameworks and its standard library define. The report states which of the two it did.
• Signal-based detection can produce false positives and false negatives. Where a reading rests on something this could not check, the answer is unknown rather than a guess.
• Plan output is deterministic and read-only only
• No cloud dashboard or UI: this package is the CLI and the library

Verifying what you installed

Every release from 0.3.3 onwards is published with npm provenance: an attestation, signed during the release workflow, that ties the tarball to the commit and the build that produced it.

npm view @produtype/core --json | grep -A5 provenance

Releases 0.3.0 to 0.3.2 have no attestation. They were published while this repository was private, and provenance is only meaningful when anyone can read the commit it points at.

Roadmap

Shipped: the deterministic analyzer, deterministic remediation planning, and the optional AI layer as @produtype/ai.

Next: applying fixes as generated pull requests, and a hosted GitHub integration.