1---2name: frontmcp-production-readiness3description: Pre-production audit, hardening, and go-live checklists for FrontMCP servers. Use before shipping to verify security hardening, performance, reliability, and observability, and for target-specific production checklists: Node server (Docker, graceful shutdown, Redis session scaling), Vercel and edge (cold-start, stateless design), AWS Lambda (cold start, scaling, monitoring), Cloudflare Workers (KV, Durable Objects, runtime limits), CLI binary and local daemon (stdio and socket transport), browser SDK bundle, and embedded npm SDK. Also configuring /healthz and /readyz health and readiness endpoints with custom probes, and distributed high-availability (multi-pod heartbeat, session takeover, notification relay). Triggers: production ready, security audit, hardening, performance check, production checklist, go live, pre-launch review.4license: Apache-2.05---67# FrontMCP Production Readiness Audit89Router for production readiness checklists. Start with the common checklist (security, performance, reliability, observability), then follow the target-specific checklist for your deployment environment.1011## When to Use This Skill1213### Must Use1415- Before deploying a FrontMCP server to production for the first time16- After major feature additions or architectural changes17- During security reviews or compliance audits1819### Recommended2021- As part of PR reviews for infrastructure-touching changes22- Quarterly health checks on production deployments23- When switching deployment targets2425### Skip When2627- Building a prototype or proof-of-concept28- Running in development/local mode only2930> **Decision:** Use this skill when preparing for production. Start with `common-checklist`, then pick your deployment target.3132## Prerequisites3334- A deployable FrontMCP project (build target chosen, see `frontmcp-deployment`).35- Observability and structured logging available (see `frontmcp-observability`) — production hardening assumes you can see what the server is doing.36- A staging environment matching production target (Node, Vercel, Lambda, Cloudflare, CLI, browser) to validate the checklist before go-live.3738## Steps3940### Step 1: Detect Deployment Target4142Check the project to determine the deployment target:43441. Look at `package.json` scripts for `frontmcp build --target <target>`452. Check for target-specific files: `ci/Dockerfile` (node), `vercel.json` (vercel), `wrangler.toml` (cloudflare), `ci/template.yaml` (lambda)463. Check if the build target is `cli` or `browser` in the build config474. If unclear, ask the user which environment they're deploying to4849### Step 2: Run Common Checklist5051Always start with the common checklist — it covers security, performance, reliability, and observability that apply to every target.5253### Step 3: Run Target-Specific Checklist5455After the common checklist, run the checklist for your deployment target.5657## Scenario Routing Table5859| Scenario | Reference | Description |60| -------------------------------------------------------- | ------------------------------------------ | --------------------------------------------------- |61| Common security, performance, reliability, observability | `references/common-checklist.md` | Applies to ALL targets — run this first |62| Health & readiness endpoints (/healthz, /readyz) | `references/health-readiness-endpoints.md` | Custom probes, Kubernetes, runtime-aware readiness |63| Standalone Node.js server with Docker | `references/production-node-server.md` | Docker, health checks, Redis, scaling, CI/CD |64| Node.js SDK / direct client (npm package) | `references/production-node-sdk.md` | create()/connect() API, disposal, npm publishing |65| Vercel serverless / edge | `references/production-vercel.md` | Vercel config, edge runtime, cold starts, Vercel KV |66| Cloudflare Workers | `references/production-cloudflare.md` | Wrangler, Workers runtime, KV, Durable Objects |67| AWS Lambda | `references/production-lambda.md` | SAM template, cold starts, DynamoDB, API Gateway |68| CLI daemon (local MCP server) | `references/production-cli-daemon.md` | Process manager, socket files, service registration |69| CLI binary (one-shot execution) | `references/production-cli-binary.md` | Fast startup, stdio transport, exit codes, npm bin |70| Browser SDK | `references/production-browser.md` | Bundle size, browser APIs, CSP, CDN distribution |7172## Quick Reference: Target Detection7374| File / Signal Found | Target |75| ----------------------------------------------------- | ----------------------------------------------- |76| `ci/Dockerfile` or `ci/docker-compose.yml` | Standalone server → `production-node-server.md` |77| `serve: false` or `create()` API usage | SDK / direct client → `production-node-sdk.md` |78| `vercel.json` | Vercel → `production-vercel.md` |79| `wrangler.toml` | Cloudflare → `production-cloudflare.md` |80| `ci/template.yaml` | Lambda → `production-lambda.md` |81| `frontmcp start` / `socket` / `service install` usage | CLI daemon → `production-cli-daemon.md` |82| `build --target cli` + `bin` in package.json | CLI binary → `production-cli-binary.md` |83| `build --target browser` in scripts | Browser → `production-browser.md` |8485## Common Patterns8687| Pattern | Correct | Incorrect | Why |88| ------------------ | --------------------------------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------- |89| Checklist order | Common checklist first, target-specific second | Skip straight to vendor checklist | Common items (auth, rate limits, observability) gate all targets |90| Storage | Redis / Vercel KV in production | In-memory session/elicitation stores | Memory stores reset on every cold start and don't span replicas |91| Health checks | `/healthz` (liveness) + `/readyz` (readiness) endpoints | Single `/health` endpoint that always returns 200 | Kubernetes/load balancers need separate liveness vs readiness signals |92| Secret loading | Read from env vars (`process.env.X`) | Hardcode tokens / paste into config | Hardcoded secrets leak via the build artefact and source control |93| Build verification | Run `frontmcp doctor` + smoke test against built artefact | Trust local `dev` mode behaviour | Production targets (Vercel, Lambda, Cloudflare, browser) have different runtimes |9495## Troubleshooting9697| Problem | Cause | Solution |98| --------------------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------- |99| Sessions disappear after a deploy | Memory session store on a stateless platform | Switch to Redis / Vercel KV; see `setup-redis` and `configure-session` |100| Liveness probe passes while requests fail | `/healthz` doesn't exercise the request path | Add `/readyz` that checks dependencies (DB, Redis, downstream APIs); see `health-readiness-endpoints` |101| Cold-start latency above SLA | Heavy provider construction at request time | Construct shared clients in module scope or `onInit`; see `production-vercel` / `production-lambda` |102| Rate-limit exceeded under normal load | Global throttle too tight, no per-tool overrides | Tune `throttle.requestsPerSecond`; add per-tool overrides; see `configure-throttle` |103| `frontmcp doctor` flags missing observability | Observability disabled or not wired | Set `observability: true` in `@FrontMcp` and configure a sink; see `frontmcp-observability` |104| Browser build exceeds bundle budget | Server-only deps imported into the browser entry | Split entries; gate Node-only imports behind `availableWhen.platform`; see `production-browser` |105106## Verification Checklist107108After completing both common and target-specific checklists:1091101. Run `frontmcp doctor` to check project configuration1112. Run `frontmcp test` to ensure all tests pass1123. Run `frontmcp build` to verify production build succeeds1134. Deploy to staging and run E2E tests against it1145. Review logs for any warnings or errors during startup1156. Update README for the deployment target (see `frontmcp-setup` → `references/readme-guide.md`)116117## Examples118119Each reference has matching examples under [`examples/<reference>/`](./examples/):120121### `common-checklist`122123| Example | Level | Description |124| ----------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |125| [`caching-and-performance`](./examples/common-checklist/caching-and-performance.md) | Advanced | Shows how to configure caching with TTL, optimize responses, and manage memory with proper provider lifecycle cleanup. |126| [`observability-setup`](./examples/common-checklist/observability-setup.md) | Intermediate | Shows how to configure structured logging, error handling with MCP error codes, and monitoring integration for production. |127| [`security-hardening`](./examples/common-checklist/security-hardening.md) | Basic | Shows how to configure authentication, CORS, input validation, and rate limiting for a production FrontMCP server. |128129### `production-browser`130131| Example | Level | Description |132| --------------------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |133| [`browser-bundle-config`](./examples/production-browser/browser-bundle-config.md) | Basic | Shows how to configure package.json for browser-compatible SDK distribution with ESM/CJS/UMD entry points, TypeScript declarations, and CDN support. |134| [`cross-platform-crypto`](./examples/production-browser/cross-platform-crypto.md) | Intermediate | Shows how to use `@frontmcp/utils` for cross-platform crypto operations that work in both browser and Node.js, and how to avoid Node.js-only APIs. |135| [`security-and-performance`](./examples/production-browser/security-and-performance.md) | Advanced | Shows how to ensure no secrets are bundled in browser code, configure CSP headers on the server, optimize bundle size, and avoid blocking the main thread. |136137### `production-cli-binary`138139| Example | Level | Description |140| ------------------------------------------------------------------------------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |141| [`binary-build-config`](./examples/production-cli-binary/binary-build-config.md) | Basic | Shows how to configure a FrontMCP CLI binary with correct package.json `bin` field, shebang, stdio transport, and npm distribution settings. |142| [`stdio-transport-error-handling`](./examples/production-cli-binary/stdio-transport-error-handling.md) | Intermediate | Shows how to handle stdin/stdout transport correctly, implement proper exit codes, and handle edge cases like EOF and broken pipes. |143144### `production-cli-daemon`145146| Example | Level | Description |147| -------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |148| [`daemon-socket-config`](./examples/production-cli-daemon/daemon-socket-config.md) | Basic | Shows how to configure a FrontMCP server as a long-running local daemon with Unix socket transport, process management, and SQLite storage. |149| [`graceful-shutdown-cleanup`](./examples/production-cli-daemon/graceful-shutdown-cleanup.md) | Intermediate | Shows how to implement graceful shutdown for a daemon process, including completing in-flight requests, closing database connections, removing the socket file, and cleaning up the PID file. |150| [`security-and-permissions`](./examples/production-cli-daemon/security-and-permissions.md) | Advanced | Shows how to secure a local daemon with restrictive socket permissions, XDG-compliant config storage, and file-based secret management. |151152### `production-cloudflare`153154| Example | Level | Description |155| ------------------------------------------------------------------------------------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |156| [`durable-objects-state`](./examples/production-cloudflare/durable-objects-state.md) | Advanced | Shows how to use Cloudflare Durable Objects for stateful coordination alongside the stateless Workers runtime, with KV for cache and R2 for blob storage. |157| [`workers-runtime-constraints`](./examples/production-cloudflare/workers-runtime-constraints.md) | Intermediate | Shows how to write tools that are compatible with the Cloudflare Workers runtime: no Node.js APIs, no eval, only async I/O, and using Web APIs. |158| [`wrangler-config`](./examples/production-cloudflare/wrangler-config.md) | Basic | Shows how to configure `wrangler.toml` with correct routes, KV bindings for session storage, and secret management for a FrontMCP Cloudflare Worker. |159160### `production-lambda`161162| Example | Level | Description |163| -------------------------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |164| [`cold-start-connection-reuse`](./examples/production-lambda/cold-start-connection-reuse.md) | Intermediate | Shows how to minimize Lambda cold starts with lazy initialization, tree-shaking, and the connection reuse pattern for external services. |165| [`sam-template`](./examples/production-lambda/sam-template.md) | Basic | Shows a complete SAM/CloudFormation template for deploying a FrontMCP server to AWS Lambda with API Gateway routing, DynamoDB for session storage, and proper environment configuration. |166| [`scaling-and-monitoring`](./examples/production-lambda/scaling-and-monitoring.md) | Advanced | Shows how to configure concurrency limits, dead letter queues, provisioned concurrency, and CloudWatch alarms for a production Lambda deployment. |167168### `production-node-sdk`169170| Example | Level | Description |171| ------------------------------------------------------------------------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |172| [`basic-sdk-lifecycle`](./examples/production-node-sdk/basic-sdk-lifecycle.md) | Basic | Shows the complete lifecycle of a FrontMCP SDK package used as an embedded client: initialization, tool invocation, and proper cleanup. |173| [`multi-instance-cleanup`](./examples/production-node-sdk/multi-instance-cleanup.md) | Advanced | Shows how multiple SDK instances can coexist without conflicts, and how to implement proper cleanup to prevent memory leaks from event listeners, timers, and provider resources. |174| [`package-json-config`](./examples/production-node-sdk/package-json-config.md) | Intermediate | Shows the correct package.json configuration for publishing a FrontMCP SDK package with CJS + ESM entry points, peer dependencies, and proper file inclusions. |175176### `production-node-server`177178| Example | Level | Description |179| ------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |180| [`docker-multi-stage`](./examples/production-node-server/docker-multi-stage.md) | Basic | Shows a production-ready Dockerfile with multi-stage build, non-root user, and container health check for a FrontMCP Node.js server. |181| [`graceful-shutdown`](./examples/production-node-server/graceful-shutdown.md) | Intermediate | Shows how to implement graceful shutdown with SIGTERM handling, in-flight request draining, and health check status transitions. |182| [`redis-session-scaling`](./examples/production-node-server/redis-session-scaling.md) | Advanced | Shows how to configure Redis-backed session storage, connection pooling, and stateless server design for horizontal scaling behind a load balancer. |183184### `production-vercel`185186| Example | Level | Description |187| -------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |188| [`cold-start-optimization`](./examples/production-vercel/cold-start-optimization.md) | Intermediate | Shows how to minimize cold start time by lazy-loading dependencies, avoiding heavy initialization at module scope, and caching expensive operations. |189| [`stateless-serverless-design`](./examples/production-vercel/stateless-serverless-design.md) | Advanced | Shows a fully stateless server design that works on Vercel edge runtime with no Node.js-only APIs, using `@frontmcp/utils` for cross-platform crypto. |190| [`vercel-edge-config`](./examples/production-vercel/vercel-edge-config.md) | Basic | Shows how to configure a FrontMCP server for Vercel deployment with Vercel KV for session storage and correct route configuration. |191192### `health-readiness-endpoints`193194| Example | Level | Description |195| ----------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------ |196| [`basic-health-setup`](./examples/health-readiness-endpoints/basic-health-setup.md) | Basic | Default health endpoints with Redis session store, showing /healthz and /readyz responses. |197| [`custom-probes`](./examples/health-readiness-endpoints/custom-probes.md) | Intermediate | Custom database and API probes with Kubernetes deployment configuration. |198199### `distributed-ha`200201| Example | Level | Description |202| ----------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------ |203| [`ha-kubernetes-3-replicas`](./examples/distributed-ha/ha-kubernetes-3-replicas.md) | Intermediate | Deploy FrontMCP with 3 replicas, Redis, and automatic session failover on Kubernetes |204205## Accessing This Skill206207Skills are distributed as plain SKILL.md files plus a sibling `references/`208and `examples/` tree, so consumers can pick whichever access mode fits:209210| Mode | How it works |211| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |212| **Filesystem** | Read `libs/skills/catalog/frontmcp-production-readiness/` directly from a clone of the catalog repo, or from a published `@frontmcp/skills` install. SKILL.md is the entry point. |213| **`frontmcp` CLI** | `frontmcp skills list`, `frontmcp skills read frontmcp-production-readiness`, `frontmcp skills read frontmcp-production-readiness:references/<file>.md`, `frontmcp skills install frontmcp-production-readiness` — no server required. |214| **MCP `skill://`** | When a developer mounts this skill into their own FrontMCP server (`@FrontMcp({ skills: [...] })`), the SDK exposes it via SEP-2640 resources: `skill://frontmcp-production-readiness/SKILL.md`, `skill://frontmcp-production-readiness/references/{file}.md`, etc. The server’s `skill://index.json` returns the SEP-2640 discovery document for everything mounted on it. |215216The catalog itself is **not** an MCP server. The `skill://` URIs only resolve217when a server has been configured to host this skill.218219## Reference220221- [Production Build](https://docs.agentfront.dev/frontmcp/deployment/production-build)222- Related skills: `frontmcp-config`, `frontmcp-deployment`, `frontmcp-testing`, `frontmcp-setup`, `frontmcp-observability`
agentfront