Public · read-only · MCP

Ask for proof that production is actually live.

ProdVerity lets ChatGPT and other MCP clients inspect any public HTTPS web application without logging in or changing it. It separates basic reachability from deterministic production evidence, and never claims that a visual result was verified when no browser-render check occurred.

Make your app verifiable

Inspect

prodverity.inspect_web_app checks the public homepage status, final URL, content type and page title.

Security headers

prodverity.check_security_headers reports five common defensive response headers. It is a configuration check, not a penetration test.

Discover evidence

prodverity.discover_manifest reads a bounded /.well-known/prodverity.json manifest from the same application.

Verify production

prodverity.verify_production executes declared read-only checks and can compare a public build marker with an expected commit or release identifier.

Optional verification manifest

Any developer can opt in without creating an account. Publish this file at /.well-known/prodverity.json. Checks are restricted to same-origin paths, bounded in number and size, and use GET only.

{
  "version": "1",
  "name": "My Web App",
  "build_marker": {
    "path": "/build-version.json",
    "json_field": "commit"
  },
  "checks": [
    {
      "id": "homepage",
      "path": "/",
      "expected_status": [200]
    },
    {
      "id": "health",
      "path": "/health",
      "expected_status": [200],
      "body_contains": "healthy"
    }
  ]
}

Safety model

ProdVerity accepts public HTTPS hostnames only. Direct IPs, private/local DNS targets, custom ports and cross-domain redirects are blocked. It does not accept credentials in URLs, does not expose an arbitrary HTTP proxy, and does not perform write operations.

Great Skills Academy is the first reference implementation and publishes its own ProdVerity manifest.