Readiness Scanner

Read-only readiness scans for applications built with create-mercato-app. Check local configuration, get actionable findings, and export reports for your release process.

npx mercato-readiness-scanner scan .

Quick start · Reports · CI · Rules · Framework docs · Discord

flowchart LR
    A["📁 Your Open Mercato app"] --> B["🔎 Static readiness scan"]
    B --> C["🛡️ Configuration & security"]
    B --> D["🚀 Deployment & operations"]
    C --> E["📋 Findings & remediation"]
    D --> E
    E --> F["💻 Terminal"]
    E --> G["📝 Markdown"]
    E --> H["🔧 JSON / CI"]
    style B fill:#b4f372,color:#1b1b1b,stroke:#1b1b1b
    style E fill:#bc9aff,color:#1b1b1b,stroke:#1b1b1b

scan is read-only. The explicit apply command can add safe fixes to a git working tree.

Quick start

You need Node.js 24 or newer and an application created with create-mercato-app. Run from your application directory:

cd my-open-mercato-app
npx mercato-readiness-scanner scan .

Or pass the application path from another directory:

npx mercato-readiness-scanner scan /path/to/open-mercato-app

No global install is required. To see all options:

npx mercato-readiness-scanner --help

The default terminal report groups failed, review-only, skipped, and passing checks with ❌, ⚠️, ⏭️, and ✅ markers. Every actionable result includes remediation text and a permanent rule-documentation URL.

Check credentials and encryption keys

Credential inspection runs automatically in every scan:

npx [email protected] scan . --fail-on high

scan inspects root .env, .env.production, .env.local, and .env.production.local files, visible runtime settings, and supported Compose service environments. It checks every detected credential-like setting, including JWT/signing secrets, database and Redis passwords, other service passwords, API tokens/keys, and tenant encryption fallback/master keys. Database URL passwords, copied template credentials, and ${NAME:-default} fallbacks are included. File contents remain in memory; findings contain variable names and fixed reasons, never credential values. Application code and shell expressions are never executed. apply does not read or change these values.