{"locator":"npm:mercato-readiness-scanner","path":"mercato-readiness-scanner","npm":"mercato-readiness-scanner","github":"open-mercato/mercato-readiness-scanner","repoPath":null,"kind":"tool","type":"official","enterprise":false,"title":"Readiness Scanner","summary":"Read-only scan of a create-mercato-app project for weak credentials, encryption keys and deployment gaps.","whenToUse":"Use when you prepare an app for production or want a CI gate that fails on high-severity readiness findings.","whenNotToUse":null,"category":"devtools","tags":["cli","security","production","ci"],"providers":[],"moduleIds":[],"requires":[],"replaces":[],"slotConflicts":[],"renamedFrom":["npm:@open-mercato/readiness-scanner"],"supersededBy":null,"alternatives":[],"status":"active","listed":true,"featured":false,"license":{"spdx":null,"kind":"unknown","mismatch":false},"version":{"latest":"0.2.2","preview":null,"publishedAt":"2026-10-22","integrity":"sha512-ee0dPquU8MPzwoFPf1RGK419ddeKwLT9ZEH6uAKZ/8euDOpzGxGmfCAit68fhfQPcVblgqPB8Df9mYbYMZ0cjA==","installableFrom":"2026-10-22","gitRef":"3fc6a9954069117ae5ab404a23f5f8af009966f3","recommended":{"0.9":null,"0.8":null,"next":null}},"identity":{"builtFrom":"none","claimed":false,"source":"npm"},"compat":{"builtFor":{"range":null,"kind":"missing","lines":[]},"lines":{},"verifiedOn":[]},"anatomy":{"version":"0.2.2","coverage":"partial","counts":{"entities":0,"tables":0,"migrations":0,"routes":0,"publicRoutes":0,"aclFeatures":0,"eventsEmitted":0,"eventsConsumed":0,"backendPages":0,"frontendPages":0,"widgets":0,"workers":0,"cli":0,"aiTools":0,"aiAgents":0,"extends":0},"lists":{"aclFeatures":[],"eventsEmitted":[],"eventsConsumed":[],"env":[],"hosts":[],"tables":[],"publicRoutes":[],"credentials":[]},"callout":"FEW CONTRACTS","diff":{"from":"0.2.1","added":{"tables":0,"routes":0,"publicRoutes":0,"aclFeatures":0,"env":[],"hosts":[]},"removed":{"tables":0,"routes":0,"aclFeatures":0}}},"signals":{"receipt":{"0.9":"skipped","0.8":"skipped","next":"skipped"},"fit":{"0.9":"ok","0.8":"ok","next":"ok"},"anatomy":"partial","supplyChain":{"status":"ok","reasons":[]},"hygiene":{"status":"ok","failing":[]},"maintenance":{"status":"current","lastRelease":"2026-10-22","catchUpDays":null},"declaredVsObserved":{"status":"match","notes":[]}},"tier":"listed","quality":null,"agentPolicy":{"0.9":{"decision":"ask","reasons":[{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."},{"code":"LICENSE","text":"License: unknown."}],"consentText":"Install mercato-readiness-scanner@0.2.2"},"0.8":{"decision":"ask","reasons":[{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."},{"code":"LICENSE","text":"License: unknown."}],"consentText":"Install mercato-readiness-scanner@0.2.2"},"next":{"decision":"ask","reasons":[{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."},{"code":"LICENSE","text":"License: unknown."}],"consentText":"Install mercato-readiness-scanner@0.2.2"}},"install":{"cli":"npx mercato-readiness-scanner@0.2.2","cmm":null,"needsAllowThirdParty":false,"moduleFlag":null},"stats":{"downloads30d":null,"stars":null},"sigil":{"glyph":"0000000","phase":77,"publicRoutes":false},"links":{"page":"https://modules.openmercato.com/m/mercato-readiness-scanner","md":"https://modules.openmercato.com/m/mercato-readiness-scanner.md","json":"https://modules.openmercato.com/m/mercato-readiness-scanner.json","facts":"https://modules.openmercato.com/m/mercato-readiness-scanner/v/0.2.2/facts.json","npm":"https://www.npmjs.com/package/mercato-readiness-scanner","repo":"https://github.com/open-mercato/mercato-readiness-scanner","docs":null},"addedAt":"2026-10-23","updatedAt":"2026-10-25T17:33:15Z","_meta":{"com.openmercato.modules/installable":{"0.9":"0.2.2","0.8":"0.2.2","next":"0.2.2"}},"facts":{"factsVersion":1,"extractor":{"engine":"@open-mercato/cli@0.9.0 extractModuleFacts","factsContractVersion":2,"catalog":"om-modules rentgen 1","durationMs":2},"package":{"locator":"npm:mercato-readiness-scanner","name":"mercato-readiness-scanner","version":"0.2.2","integrity":"sha512-ee0dPquU8MPzwoFPf1RGK419ddeKwLT9ZEH6uAKZ/8euDOpzGxGmfCAit68fhfQPcVblgqPB8Df9mYbYMZ0cjA==","source":"npm-tarball","gitRef":"3fc6a9954069117ae5ab404a23f5f8af009966f3"},"gate":{"installable":false,"needsModuleFlag":false,"reason":"Package has no src/ in the tarball.","modules":[]},"kind":"tool","license":{"value":null,"kind":"unknown","mismatch":false,"sources":{"packageJson":null,"licenseFile":null,"moduleInfo":null,"integrationTs":null}},"omPeers":{},"dependencies":{"semver":"^7.8.5","yaml":"^2.9.1"},"agentsMd":false,"readmeExcerpt":"<p align=\"center\"><img src=\"https://raw.githubusercontent.com/open-mercato/mercato-readiness-scanner/main/.github/readme/open-mercato.svg\" alt=\"Open Mercato logo\" width=\"72\" /></p>\n\n<h1 align=\"center\">Open Mercato Readiness Scanner</h1>\n\n<p align=\"center\"><strong>Find production-readiness gaps before you deploy.</strong></p>\n\n<p align=\"center\">Read-only readiness scans for applications built with create-mercato-app.<br />Check local configuration, get actionable findings, and export reports for your release process.</p>\n\n<p align=\"center\">\n  <a href=\"https://www.npmjs.com/package/mercato-readiness-scanner\"><img src=\"https://img.shields.io/npm/v/mercato-readiness-scanner?color=b4f372&amp;label=npm\" alt=\"npm version\" /></a>\n  <a href=\"https://nodejs.org/\"><img src=\"https://img.shields.io/badge/node-%E2%89%A524-1b1b1b\" alt=\"Node.js 24 or newer\" /></a>\n  <a href=\"https://github.com/open-mercato/mercato-readiness-scanner/actions/workflows/test.yml\"><img src=\"https://github.com/open-mercato/mercato-readiness-scanner/actions/workflows/test.yml/badge.svg\" alt=\"Tests\" /></a>\n  <img src=\"https://img.shields.io/badge/scans-read--only-bc9aff\" alt=\"Read-only scans\" />\n</p>\n\n```bash\nnpx mercato-readiness-scanner scan .\n```\n\n<p align=\"center\"><a href=\"#quick-start\">Quick start</a> · <a href=\"#save-a-report\">Reports</a> · <a href=\"#use-in-ci\">CI</a> · <a href=\"#rule-catalog\">Rules</a> · <a href=\"https://docs.openmercato.com/\">Framework docs</a> · <a href=\"https://discord.gg/f4qwPtJ3qA\">Discord</a></p>\n\n```mermaid\nflowchart LR\n    A[\"📁 Your Open Mercato app\"] --> B[\"🔎 Static readiness scan\"]\n    B --> C[\"🛡️ Configuration & security\"]\n    B --> D[\"🚀 Deployment & operations\"]\n    C --> E[\"📋 Findings & remediation\"]\n    D --> E\n    E --> F[\"💻 Terminal\"]\n    E --> G[\"📝 Markdown\"]\n    E --> H[\"🔧 JSON / CI\"]\n    style B fill:#b4f372,color:#1b1b1b,stroke:#1b1b1b\n    style E fill:#bc9aff,color:#1b1b1b,stroke:#1b1b1b\n```\n\n`scan` is read-only. The explicit [`apply`](#apply-the-remediations) command can add safe fixes to a git working tree.\n\n## Quick start\n\nYou need **Node.js 24 or newer** and an application created with\n[`create-mercato-app`](https://www.npmjs.com/package/create-mercato-app).\nRun from your application directory:\n\n```bash\ncd my-open-mercato-app\nnpx mercato-readiness-scanner scan .\n```\n\nOr pass the application path from another directory:\n\n```bash\nnpx mercato-readiness-scanner scan /path/to/open-mercato-app\n```\n\nNo global install is required. To see all options:\n\n```bash\nnpx mercato-readiness-scanner --help\n```\n\nThe default terminal report groups failed, review-only, skipped, and passing\nchecks with `❌`, `⚠️`, `⏭️`, and `✅` markers. Every actionable result includes\nremediation text and a permanent rule-documentation URL.\n\n## Check credentials and encryption keys\n\nCredential inspection runs automatically in every scan:\n\n```bash\nnpx mercato-readiness-scanner@0.2.2 scan . --fail-on high\n```\n\n`scan` inspects root `.env`, `.env.production`, `.env.local`, and\n`.env.production.local` files, visible runtime settings, and supported Compose\nservice environments. It checks every detected credential-like setting, including\nJWT/signing secrets, database and Redis passwords, other service passwords,\nAPI tokens/keys, and tenant encryption fallback/master keys. Database URL\npasswords, copied template credentials, and `${NAME:-default}` fallbacks are\nincluded. File contents remain in memory; findings contain variable names and\nfixed reasons, never credential values. Application code and shell expressions\nare never executed. `apply` does not read or change these values.\n\n| Finding | Behavior |\n|---|---|\n| ❌ Default, placeholder, or copied template credential | Critical failure |\n| ❌ Short, repeated, or predictable credential | Critical failure |\n| ❌ Weak tenant encryption fallback/master key | Critical failure |\n| ❌ Development fallback enabled without an explicit tenant key | Critical failure |\n| ⚠️ No complete KMS configuration | Configure Vault;","modules":[],"coverage":{"routesAuthResolved":1,"integrationTs":"absent"},"diagnostics":["No src/ in the tarball: anatomy is not available."]},"receipts":[],"rules":[{"id":"LST-1","pass":true,"detail":"Descriptor is valid."},{"id":"LST-2","pass":true,"detail":"Stable version exists and is not deprecated."},{"id":"LST-3","pass":true,"detail":"Kind tool read from package.json."},{"id":"LST-4","pass":true,"detail":"License: unknown."},{"id":"LST-5","pass":true,"detail":"No known malware or open critical advisory."},{"id":"LST-6","pass":true,"detail":"Name reviewed at merge."},{"id":"VER-1","pass":false,"detail":"Receipt on 0.9: skipped."},{"id":"VER-2","pass":true,"detail":"Fits statically on 0.9: ok."},{"id":"VER-3","pass":true,"detail":"Supply chain: ok."},{"id":"VER-4","pass":true,"detail":"No lint errors."},{"id":"VER-5","pass":true,"detail":"Tarball repository.url matches the descriptor."}],"maintainers":["piotrkarwatka"]}