Pre-production checklists for solo founders. 4,337 items, 88% portable to any stack, 26 stack supplements — plus AI/agent security and the bugs AI coding assistants actually write.
Checklists to run before you ship to production.
Built for solo founders and small teams who own the whole stack — the code, the infrastructure, the deploy pipeline, and increasingly the AI agents too — and who don't have a security team to hand it to.
4,337 items across 96 checklists in 5 domains. 88% of them apply to any stack.
Built and maintained by the team at Arioo — where we ship the kind of product this checklist was written for.
I'm a founder at Arioo. Getting ready to launch, I needed a pre-production security review that covered the whole surface we actually ship: a TypeScript backend, a web app, native clients, a deploy pipeline, and a set of AI agents with real tools attached. Nothing I could find covered more than a fraction of that, so I built the checklist myself.
This repository is the checklist, not a report. It is the set of questions, generalized away from our stack and rewritten as a working document anyone can run against their own product.
Two things made it worth publishing rather than keeping:
Solo founders have no security team. You write the code, configure the infrastructure, set up the pipeline, and then you're also the one who has to decide whether it's safe to launch. There's no one to hand it to, and no obvious place to find out what you should have asked. Most public checklists are either too shallow to catch anything real or written for enterprises with a security function.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/FarzamHabibi--pre-production-checklist.html)
MCP security scanner — vet a Model Context Protocol server before you add it to Claude Code, Cursor, or Windsurf. Grades it A–F, catching credential theft, tool-poisoning, and install-script payloads
yagyeshVyas/VibeGuardFree security & privacy scanner for AI-coded apps. 699 rules, 76 MCP tools, 13-layer defense, zero-trust sandbox, AI firewall. Runs locally, never sends data anywhere. Scan your AI-generated app for l
graygnatconsole/mcp-audit-tool🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI
agent-chaperone/agent-chaperoneScreens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
HUA503/mcprismFast single-binary security scanner for MCP (Model Context Protocol) servers — config audit, live capability enumeration, tool-poisoning detection & risk grading. Zero deps, fully offline — trivy for
omaekumiko2-create/kruLocal-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TOTP without exposing hidden plaintext to the model.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.