Flask Production MCP

A static production-readiness auditor for Flask applications, usable three ways:

• a CLI (flask-production-mcp audit) for local runs and scripts
• a pre-commit hook and a GitHub Action so it runs at the right moments
• an MCP server so an AI coding agent can call it while building

It answers "is this Flask app ready to deploy?" — not just "does it have security bugs?" — across nine categories:

All analysis is static. The target application is never imported or executed; virtual-environments, caches and build dirs are skipped.

Findings: blockers vs. advisories vs. notes

Every finding has a severity and a confidence. The audit sorts them:

The overall_score is confidence-weighted: a confirmed critical bites hard, a long tail of "consider an index" guesses barely moves it. A project is production_ready when it has no blockers and no single category has collapsed below the score floor (default 50).

Install

pip install flask-production-mcp

# with the dependency-CVE and Bandit scanners:
pip install "flask-production-mcp[scanners]"

# or, from a checkout:
uv sync --extra scanners

Python 3.11+. The base install is MCP + the static analyzers. The scanners extra adds pip-audit (needs network) and bandit; without it the audit reports those scans as skipped rather than failing.

CLI

flask-production-mcp audit path/to/your/flask/app

Flask Production Audit  --  /path/to/app
------------------------------------------------------------
Overall score  71/100          NOT READY

  flask          100   clean
  architecture    96   1 finding
  templates       55   1 finding (1 blocker)
  deployment     100   clean
  testing         92   1 finding
  security       100   clean
  database        76   6 findings
  dependencies   100   clean
  code_quality    79   7 findings

BLOCKERS (1)
  x [TMPL-CSRF-001] templates  app/templates/admin/products.html:242
      POST form has no CSRF token field
      -> Add a hidden CSRF field inside the form ...

Result: NOT production ready
  - 1 blocker(s) in templates

Exit codes: 0 pass · 1 fail (per --fail-on) · 2 bad usage.

Configuration

flask-production.toml in the project root, or [tool.flask-production] in pyproject.toml. See flask-production.toml.example.

fail_on = "blockers"
category_floor = 50
scan_dependencies = true
run_bandit = true
ignore = ["DB-PERF-001"]        # drop rules by id
select = []                      # if set, run ONLY these

[severity]
"ARCH-SEC-001" = "high"          # re-grade a rule for this project

pre-commit

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/yemibalogun/flask-production-mcp
    rev: v0.1.0
    hooks:
      - id: flask-production-audit

The hook runs offline (--skip-deps --skip-bandit -q) and fails the commit on blockers only. Override args: to change that.

GitHub Action

# .github/workflows/audit.yml
jobs:
  flask-production-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: yemibalogun/flask-production-mcp@v0.1.0
        with:
          path: .
          fail-on: blockers      # or advisories / any / never

Findings appear as inline annotations on the PR and in the job summary.

MCP server

flask-production-mcp serve      # stdio

Register with an MCP client (Claude Code / Desktop):

{
  "mcpServers": {
    "flask-production": {
      "command": "flask-production-mcp",
      "args": ["serve"]
    }
  }
}

Then: "Run a production audit on /path/to/my_flask_app and list the blockers."

Tools

Every audit_* tool returns the same envelope (success, project_path, score, summary, findings, recommendations, errors).

Development

uv run pytest
uv run ruff check src tests
uv run mypy src

src/flask_production_mcp/
├── cli.py                  # audit / serve subcommands
├── config.py               # flask-production.toml loader + finding policy
├── server.py               # MCP server, registers the tools
├── models/findings.py      # Finding / AuditSummary / AuditResult
├── analyzers/
│   ├── base.py             # scoring (weighted), classification
│   ├── exclusions.py       # shared file-walk + exclusion rules
│   ├── flask.py            # discovery + analyze_flask
│   ├── architecture.py     # Flask-architecture rules
│   ├── templates.py        # Jinja/HTML rules
│   ├── deployment.py       # Dockerfile / compose / Gunicorn / Nginx rules
│   ├── testing.py          # test-suite health
│   ├── security.py         # analyze_security
│   ├── bandit_scan.py      # Bandit integration
│   ├── database.py         # analyze_database
│   ├── dependencies.py     # pip-audit (requirements / lock / pyproject pins)
│   ├── code_quality.py     # analyze_code_quality_file
│   └── production.py       # analyze_production (unified, parallel)
└── tools/                  # one thin MCP wrapper per analyzer

Scope

Everything is static — the app is never run. So it does not do performance profiling or dynamic/runtime security testing (both need a live app + database), and the testing category reads an existing coverage.xml rather than producing one. Unpinned dependencies in a bare pyproject.toml can't be resolved to exact versions without installing — add a lock file for full CVE coverage.