Start here · free
Two steps. The first one is free.
Step 1 · free
The free check: what would leak, lose or break?
Your coding agent reads your app and tells you, in plain words, what would leak data, lose data or break once real people use it, and how bad each one is. You get a score and a short report, and you can send it to your client whenever you like: a link and a code, nothing to install on their side.
Step 2 · when you want it fixed
The SDLC: fix it the way serious teams do.
Say “SDLC on” and your agent works through the fixes properly: plan each change, build it, test it, have it reviewed, then ship. Until your app is ready for real customers. After every sprint you get a report you can send straight to your client.
critical From a real report · an invoicing app built in Lovable, 40 paying customers
Three tables with customer data have no row-level security in the code: invoices, clients, line items. Unless someone switched it on by hand, the public key every browser receives reads all three, signed in or not.
What it costs: any visitor can read every customer's invoices. The whole sample report →
Install it once, in the coding tool you already use. It runs in your coding tool, on your machine. What reaches us: counts, rule names and file paths with line numbers. Never your source, your data or a secret value. Your report page is kept 7 days behind an access code.
claude mcp add --transport http prodready https://mcp.prodready.si/mcp --scope user
codex mcp add prodready --url https://mcp.prodready.si/mcp
{"mcpServers":{"prodready":{"url":"https://mcp.prodready.si/mcp"}}}
Paste it into ~/.cursor/mcp.json, merged with what is there. Windsurf, Cline and others: their config.
https://mcp.prodready.si/mcp
Settings → Connectors → Add custom connector, paste the URL.
- Add it. Run the line in a terminal, or paste it where your tool keeps MCP servers.
- Sign in. The first call opens a sign-in page (in Claude Code:
/mcp→ prodready → Authenticate). A browser page asks for your email; type the 6-digit code we send (or click its link), then approve. No password, no card. - Ask. Type “check my app”. A few minutes later you have the report.
Built in Lovable, Replit, Base44 or Bolt? The check reads your code, so it runs in a coding tool: sync the project to GitHub, open it in Claude Code or Cursor, add the line. The steps →
Every host's native config: all install lines →
The problem
Every year, thousands of demos go to production.
A demo is built to be looked at; production is where it gets used. The data lives in the browser. The settings fail open, so it starts with no password set. Thirty-six tests passed on the day they were written, and nobody loaded a year of real traffic until a customer did, on a Monday.
Looks done. Isn't.
In plain words
What is an SDLC? Think of it as building a house.
Anyone can put up walls in a weekend. Nobody moves a family in until there is a plan, an inspector has checked the wiring and someone signs off. In software that routine is an SDLC, a software development life cycle. Serious teams have one. Weekend apps do not.
What is an SDLC — in eight frames
- 01An idea

- 02A story, not a prompt

- 03The gate

- 04Build

- 05Verify

- 06Three reviewers

- 07Audit and re-score

- 08Ship, and keep going

Swipe for all eight. Read the eight frames, one sentence each →
Ours is the routine our team runs for enterprises and global brands. Now your coding tool follows it on every feature, so the house stays up to code.
How it works
Three steps. Inside the tool you already use.
- 30 SECONDS
Sign in.
Paste one line. The first call asks for your email and sends a 6-digit code. No password, no card.
- FREE
The free check.
Say check my app. Your agent runs the checks in your repository and returns a graded report.
- LICENCE
"SDLC on".
The same MCP runs our delivery process: refined backlog, gated sprints, three reviewers, audits, until it scores 4 out of 5.
Who it is for
Is the SDLC for you?
The due diligence is for anyone with an app. The SDLC is for the moment the app starts to matter.
You built it, and people use it.
Made in Lovable, Replit or Base44 over a few weekends. Now there are real users, maybe paying ones, and every change feels like it could break something.
You code with an agent, alone.
Claude Code or Cursor writes most of it. You want the discipline of an enterprise team: a plan, reviews and an audit trail, without hiring the team.
You ship apps to clients.
Your developers build with agents and deliver faster than ever. You need every change reviewed and every decision on record, so you can show the client how it was built.
Someone built an internal tool.
It started as a side project and now the department runs on it. Before IT and security sign it off, it needs to look like something a professional team delivered.
You need it if two of these are true
- Real users or real data are in it.
- Someone has asked you about backups, security or uptime.
- You are about to sign a contract or raise money.
- The free due diligence scored it below 3 out of 5.
It is not for you if
- It is a prototype you will throw away, or a demo for a pitch.
- You already have a full delivery process with reviews and QA.
- You want someone else to build it for you. Here your own agent does the work.
Not sure? Run the free due diligence first. The score answers the question. Install the MCP
Proof
They built it in a weekend. The process made it survive Monday.

A product catalogue built on Replit now runs one of Europe's largest fashion e-commerce brands.

From 36 tests to 3,650 in 48 hours: the sales app whose data lived in the browser.

Every customer could read every other customer's invoices. Forty of them were paying.
Two ways in
Start free. Go as far as you need.
Prices, all in one place: see pricing →
The first serious client asked where their data was backed up and I had no answer. The report was blunt. Two evenings of my own agent working through the process, and I had something I could put in a contract.
Monday evening I ran the check, more or less as a test. By Wednesday my agent had it on our own server, with backups and a written decision for every shortcut I had been avoiding.
Nothing was rewritten. It is still our code, with three reviews on every change. It now refuses to start if a setting is wrong. That is the point.
Company names are hidden on purpose. The people behind these words are real, and so are their apps.
FAQ
Everything people ask before they install it.
Getting started
What is ProdReady, in one sentence?
Which coding tools does it work with?
mcp-remote. Every install line is on the MCP page.How do I install it?
https://mcp.prodready.si/mcp as a custom connector. The first call opens a sign-in page: type your email and click the link, or enter the six-digit code. No password, no card. Not at your computer? Use “Email me the line” and do it later.We built it with Lovable, Replit, Base44, Bolt or v0. Does that count?
Do I need to be a developer?
The free due diligence
What is a due diligence?
What exactly does it check?
Is it really free? What is the catch?
Does my code leave my machine?
Can I send the reports to my client?
How reliable is the score?
The SDLC
What is an SDLC?
What happens when I say “SDLC on”?
Who writes the code? Do you see it?
What is autonomous mode?
Is there a dashboard?
npx line opens it: the board, the sprints, the due diligence trend, decisions, reports and the autonomous run with its open questions. The command is in the docs.Does it work on an existing app, or only on new ones?
Licence and account
What does the SDLC cost?
How does the licence unlock?
sdlc_request_access, or use the form on the pricing page.





