Catch deploy-blockers before you ship.
30+ security and readiness checks across your code and running app. Get a 0–100 score and one-approval AI fixes — locally, in a single command.
npx deployready@latestNo config · runs locally · works offline, no AI required
Built by Belsoft · member of
One command. Complete visibility.
Static analysis, live app testing, active authorization probing, and AI fixes — the whole pipeline runs in seconds, locally.
- 30+
- structured checks
- 4
- testing stages
- 0–100
- readiness score
- 1
- command to run it
How a scan runs
Four stages, start to finish. No config, no agents to install — point it at a project and go.
- 01
Parse
DeployReady reads your codebase with a Babel AST for JS/TS and Python — detecting your stack, dependencies, and routes.
- 02
Static scan
30+ static checks: secret detection, OWASP Top 10, weak crypto, Row-Level-Security gaps, and insecure patterns — each mapped to a CWE.
- 03
Dynamic & active tests
Probe the running app for auth bypass, exposed routes, and CORS. With a token, actively test access control: IDOR/BOLA, tenant isolation, and privilege escalation.
- 04
Analyze & score
Claude, OpenAI, or Ollama explains each finding and proposes a fix. You get a 0–100 readiness score, reports, and one-approval fixes.
Everything it checks
30+ structured tests across your code and your running app — the full OWASP-aligned surface, in one pass.
Parse. Scan. Score. Fix.
The whole pipeline in one command — watch it run.
Find an issue, fix it in place
DeployReady doesn’t just flag problems. It proposes a concrete fix, shows you the diff, and applies it only on your approval.
Context-aware analysis
Each finding is explained with its file, line, severity, and the CWE behind it.
Fixes you approve
Proposed as a red/green diff. Nothing changes until you say yes.
Backed up and re-verified
Every fix writes a backup patch, then re-runs the check to confirm it’s resolved.
Interactive Commands
Guided session with interactive commands to scan, view findings, apply fixes, and verify results.
Reports & Dashboard
Export detailed findings as markdown reports or view in an interactive HTML dashboard. Share with your team.
$ npx deployready@latest ./my-app
What would you like to do?
1 Scan this project now (recommended)
2 Set up or change the AI model
3 How does DeployReady work?
4 Go to the command prompt
5 Exit
Pick a number: 1
✦ Parsing codebase... done in 0.8s
✦ Running static analysis... done in 2.3s
✦ Testing localhost app... done in 4.1s
✦ Analyzing with AI... done in 6.2s
Production Readiness Score: 0 / 100
🔴 16 critical issues found
🟡 0 warnings
🔵 0 suggestions
deployready › issues
Finding #1: [CRITICAL] Hardcoded secret in .env
Finding #2: [CRITICAL] Hardcoded secret in .env
...
deployready › show 1
Full details, code snippet, and fix guidance
deployready › fix 1
AI-proposed fix applied. Backup created.
deployready › verify 1
Re-running checks... ✓ Fixed!
deployready › export
Report saved to deployready-report.md
deployready › open
Opening HTML dashboard...Static, Dynamic & Active Testing
30+ structured tests: code analysis, secrets & RLS detection, live app testing, and opt-in active authorization testing (IDOR, tenant, privilege, JWT).
Stage 1: Parse
✓ Detects tech stack (Next.js, Express, etc.)
✓ Maps routes and dependencies
✓ Analyzes AST for JavaScript/TypeScript/Python
Stage 2: Static Analysis
✓ Hardcoded secrets & credentials
✓ XSS sinks and vulnerable patterns
✓ Weak cryptography & randomness
✓ OWASP Top 10 violations
✓ CWE-mapped findings
Stage 3: Dynamic Testing (Live Localhost)
✓ Auth bypass vulnerabilities
✓ Exposed admin routes
✓ Missing security headers
✓ Wildcard CORS issues
✓ Rate limiting gaps
✓ Slow endpoints & caching problems
Stage 4: Active Authorization Testing (opt-in, --active)
✓ Broken object-level access (IDOR/BOLA)
✓ Broken tenant isolation (org/tenant swap)
✓ Privilege escalation (forged role: admin)
✓ Unverified JWTs (alg:none accepted)
Stage 5: AI Analysis (Optional)
✓ Deeper vulnerability context
✓ Fix recommendations with diffs
✓ Architecture improvement suggestionsOne-Shot CI/CD Integration
Run DeployReady in your CI pipeline with simple flags. Fail on critical issues to block unsafe deployments.
name: DeployReady Security Gate
on: [push, pull_request]
jobs:
deployready:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '18'
- name: Run DeployReady
run: |
npx deployready@latest analyze . \
--no-ai \
--export \
--fail-on critical
- name: Upload Report
if: always()
uses: actions/upload-artifact@v3
with:
name: deployready-report
path: deployready-report.mdOffline & Privacy First
All static analysis runs locally. Optional AI analysis redacts secrets. With Ollama, nothing leaves your machine.
# Fully offline: no AI, no external calls
npx deployready@latest analyze . --no-ai --no-dynamic
✦ Parsing codebase... done
✦ Running static analysis... done
No data sent anywhere. Results stay local.
All findings are structured JSON you can integrate.
# With Claude (structured findings only)
npx deployready@latest analyze . --no-ai
🔒 Security & Privacy Model:
• No source code sent to Claude
• Only structured findings (JSON)
• All secrets redacted first
• You approve before sending
• API key stored locally (0600 perms)
• Config at ~/.deployready/config.json
# With Ollama (completely local)
npx deployready@latest init
> Select: Ollama
> Model: llama2
npx deployready@latest analyze .
✓ Running locally on your machine
✓ Nothing leaves your network
✓ Free & fully privateHand it to your AI agent
DeployReady runs from a single npx command and writes machine-readable JSON and Markdown — so Claude Code, Cursor, or any agent can scan your project and fix findings on its own. Paste the prompt and go.
Install and run DeployReady on this project, then help me fix what it finds. 1. Run: npx deployready@latest analyze . --no-ai --export 2. Read deployready-report.md and summarize every CRITICAL finding (file, line, why it blocks deploy). 3. Propose a fix for each one as a diff. Apply it only after I approve. 4. Re-run the scan and confirm the readiness score went up. Agent instructions & flags: https://deployready.dev/docs/agent-install
Use the AI you already pay for
Bring your own key for Claude or OpenAI — no new subscription. Or run it fully offline with a local Ollama model.
Claude
Anthropic
Sonnet · Opus
Best analysis quality
OpenAI
OpenAI
GPT-4o · o-series
Fast & reliable
Ollama
Local / open source
Llama 3 · Mistral · Phi-3
No API key, nothing leaves your machine
The core scan runs without any model — AI only adds explanations and the fix workflow.
Need a hand with security?
If DeployReady uncovers issues beyond automated fixes or you want human expertise validating your security posture, our team can help. Schedule a security check with our specialists.
Schedule a security checkPowered by Belsoft · Expert security reviews · No pressure, no commitments