mcpField
G
Greenlit

Greenlit

Local
greenlit.priberry.comSecurity1Updated today
RepositoryVisit website

About Greenlit

Greenlit scans deployed apps for security issues, assigns an A–F grade, and supplies prompts for fixing findings. It is aimed at people shipping AI-built apps and can be run in a browser, CLI, or agent workflow.

Key features

  1. 01A–F security grading
  2. 02Secret and configuration checks
  3. 03Owner-only database checks
  4. 04Fix prompts for findings
  5. 05Change tracking across scans

Use cases

  1. 01Reviewing an AI-built app before launch
  2. 02Checking owned Supabase or Firebase settings
  3. 03Sending findings to a coding agent
  4. 04Verifying fixes with a follow-up scan

MCP support

Greenlit provides an MCP server with the `greenlit_check` tool. MCP clients can request an app grade, findings, and corresponding fix prompts.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "priberry-data-greenlitlab": {
      "command": "npx",
      "args": [
        "-y",
        "greenlitlab"
      ]
    }
  }
}
Run commandnpx -y greenlitlab

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmgreenlitlab0.2.0

Tools

1

Saved tool list · updated 1d ago

ParameterTypeRequiredDescription
urlstringYesThe app's address, for example myapp.lovable.app

Details

From the project README

Greenlit

Is your AI-built app safe to launch? Greenlit grades a deployed app from A to F for what a stranger can use against it. It explains each problem in plain words and gives you a prompt to paste back into Lovable, Bolt, v0, Replit or Emergent that fixes it. Run it again after the fix, and it shows what got fixed.

In the browser: greenlit.priberry.com. Paste your app's address. Nothing to install.

On your computer:

npx greenlitlab myapp.lovable.app

What it checks

CheckWhere it runs
Secret keys in the JavaScript every visitor downloads: 30 kinds, including Stripe, OpenAI, Anthropic, OpenRouter, Gemini, AWS, GitHub, Supabase secret keys, Telegram bots, private keys and service-account JSONeverywhere
A Supabase service_role key in the browsereverywhere
Source maps that hand out your source codeeverywhere
Clickjacking (no frame-ancestors or X-Frame-Options) and no Content-Security-Policyeverywhere
Supabase tables anyone can read with the public keyyour own app, --mine
Supabase storage buckets that list their files to anyoneyour own app, --mine
Supabase sign-up open to anyone without email confirmationyour own app, --mine
A public .env file or .git folderyour own app, --mine
Firebase Realtime Database and Firestore open to everyoneyour own app, --mine

The owner-only checks ask for a row count (Supabase), one file or document name (storage, Firebase), or the sign-up settings, never for data, and never write anything. They run only when you say the app is yours, because testing someone else's database without permission isn't OK.

Commands

npx greenlitlab <url>                 # grade an app
npx greenlitlab <url> --mine          # your own app: database checks too
npx greenlitlab <url> --prompt 1      # print fix prompt 1 only (pipe it to pbcopy)
npx greenlitlab <url> --prompt all    # every fix in one prompt, worst first
npx greenlitlab <url> --json          # the full result
npx greenlitlab <url> --fail-on high  # exit 1 if anything this serious is found, for CI

The last result for each app is kept in ~/.greenlit/sites/ (grade, finding ids and titles only, never keys) so the next run can show what changed.

In Claude, Cursor, VS Code and other agents

Add Greenlit as an MCP server:

{ "mcpServers": { "greenlit": { "command": "npx", "args": ["-y", "[email protected]", "mcp"] } } }

Then ask your agent to check the app it just deployed and apply the fixes. The greenlit_check tool returns the grade, every finding and its fix prompt.

Made by Priberry

Greenlit comes from Priberry, the crash-test lab for AI agents. Its sister tools: Crumple crash-tests coding agents, and Tare shows what they cost.

Apache-2.0. Found a problem? Open an issue, or see SECURITY.md.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.