# Produtype Kit

> Reads a repository and reports what production would demand of it — judged as the kind
> of product it is meant to be, not as code in general. A game is not asked for GDPR
> consent, a command-line package is not asked for authentication, and a phone
> application is not asked for a Dockerfile.

The analyzer is open source and published as `@produtype/core` on npm under MIT; the
hosted product at produtype.dev adds history, a remediation plan and an optional AI
review of the report.

## What it actually does

- Infers which of 10 product profiles a repository is, from the code, and says
  so — or says it could not tell, which is a real answer it is willing to give.
- Reports each finding with the line behind it. Where there is nothing to cite, because
  the finding is about something absent, it prints the terms it searched for instead —
  so a reader whose upload route is called something else can see why it was missed.
- Separates severity from confidence: severity says how bad it would be if true,
  confidence says whether it is. Nothing is reported as critical unless the report can
  point at the line.
- Produces a remediation plan with an effort estimate per task, and maps findings to
  GDPR, NIS2 and OWASP Top 10 obligations.

## What it reads

47 backend frameworks, 14 frontend frameworks, 4 mobile
platforms, 9 databases and 10 ORMs, across
TypeScript, JavaScript, Python, PHP, Go, Ruby, Java, C#, Rust, Kotlin, Swift, Dart.

The full generated list is at https://produtype.dev/stacks and is built from the analyzer
itself, so it cannot drift from what the code recognises.

## Honest limits

- It reads a repository. It does not run the application, so anything true only at
  runtime is outside what it can see.
- A profile it cannot infer is reported as inconclusive rather than guessed.
- The AI review is a paid, separate step over the report the deterministic analyzer
  produced; the score and the findings do not come from a model.

## Measured on itself

The hosted application scores 95 out of 100 against its own analyzer,
regenerated at every build and shown on the home page with the commit it was measured at.

## Links

- Home: https://produtype.dev/
- How it decides: https://produtype.dev/methodology
- What it reads: https://produtype.dev/stacks
- Scan a public repository: https://produtype.dev/scan
- Package: https://www.npmjs.com/package/@produtype/core
- Source: https://github.com/denisbilli/prodkit