Analyzes Dockerfiles for runtime readiness evidence such as external base image digests, final explicit user, startup command form, and development reload, distinguishing internal build stages from runtime.
Inspects FastAPI applications for production-readiness evidence, including debug/Uvicorn reload settings and directly declared conventional GET health routes.
Scans supported YAML/JSON GitHub Actions workflow declarations for action references and permission scope, without treating comments or run strings as action findings.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Production Readiness Inspector scan this FastAPI repo for production readiness issues before release"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Static Python/FastAPI, Docker and GitHub Actions evidence for your next release. Run the local scanner free, keep source on your machine, and optionally save private release reports with instance-level baseline history.
Open Inspector — 3 free hosted reports, then $19 USD for 100 reports. No subscription or automatic top-up.
Python 3.12 on Linux/Ubuntu WSL2 is qualified. Use a dedicated environment; this distribution overlaps the Inspector namespace in the older MCPProducts suite.
python3 -m venv .venv
.venv/bin/python -m pip install --no-deps \
https://inspector.contentsweep.ai/inspector/download/contentsweep_prodcheck-0.3.0-py3-none-any.whl
.venv/bin/prodcheck /path/to/application --format json > report.jsonDownload hashes are at the release manifest. Direct HTTPS and GitHub releases are available. PyPI and registry publication are not claimed.
Default CI exits: 0 when the configured finding threshold is clear, 2 for high
findings, 5 for failed/incomplete evaluation. --fail-on medium|high|critical|none
sets finding policy; evaluation errors always fail. --baseline reviewed.json --new-only compares finding instances instead of collapsing rule IDs.
Related MCP server: MCP DevOps Toolbox
Save the workspace key privately before purchasing. It is the only workspace credential; there is no email/password recovery. Three hosted reports are free. Preview what will leave your machine:
.venv/bin/python -m mcp_products.inspector.cloud preview report.json
# Supply INSPECTOR_API_KEY privately, or use --key-file with a private key file:
.venv/bin/python -m mcp_products.inspector.cloud submit report.json --project my-service --key-file private-key-fileOnly structured rule/version/instance identities, relative paths/lines, coverage and fingerprints are submitted. Raw source, evidence prose and repository archives are excluded. Review paths for sensitivity. The server preserves caller-submitted evidence; it does not independently verify source or deployment.
One new complete hosted report uses one credit. Exact retries reuse their receipt without another credit. Unsupported/incomplete inputs and platform failures are free. Hosted reports include new/unchanged/resolved instance comparisons, 30-day private history and HTML/JSON exports. Credits do not expire. See the product's terms, privacy and refund policy.
Literal FastAPI debug / Uvicorn reload and directly declared conventional GET health routes; route declarations do not prove runtime health.
Docker external base digests, final explicit user, startup command form and development reload. Internal build stages are distinguished from runtime.
Supported YAML/JSON workflow declarations, action references and permission scope; comments and run strings do not become action findings.
Bounded, read-only traversal with ignore rules and symlink/private-file exclusions; parsing runs in a resource-limited child. No target code is imported or executed and local scans make no network/model calls.
Dynamic settings and unsupported syntax disclose incomplete coverage. Broader YAML, cross-file router resolution, Compose/Kubernetes, CVEs, general secrets and runtime readiness are outside this beta. No score, certification, accuracy percentage or incident-prevention guarantee is claimed.
.venv/bin/python -m pip install 'mcp==2.3.0'
.venv/bin/python -m mcp_products.inspector.mcp --root /approved/local/repositoryThe official-SDK stdio server exposes the same offline inspection engine. Hosted submission is explicit through the cloud CLI/REST API; it never happens during a local scan. Workspace purchase accounting is independent of other products.
To run the owned tests from a source checkout:
python3 -m venv .venv
.venv/bin/python -m pip install -e '.[hosted,mcp]' pytest==9.1.1 httpx==0.28.1
.venv/bin/python -m pytest tests/test_inspector_engine.py tests/test_inspector_interfaces.py tests/test_inspector_commerce.pyRule contract and primary sources · Hosted operating record · Synthetic benchmark method. Synthetic correctness parity with a maintained script is not independent accuracy, customer ROI or paid adoption evidence.
Apache-2.0. Content Sweep LLC. Billing/support: founder@contentsweep.ai.
This server cannot be deployed
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Detects database migration table locks, terraform cost leaks, and OWASP API flaws.
Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.
