Production Checklist (Python)

• Python 3.10+ in the image
• nitrostack-py validate passes
• Secrets only in env / secret manager — never in the wheel
• nitrostack-py pack reviewed with --dry-run
• MCP_TRANSPORT_TYPE set (http or dual)
• HOST=0.0.0.0 in containers
• OAUTH_REQUIRED / API keys set if the server is not public
• MCP_MAX_SESSIONS and session timeout for HTTP
• Logging to file, not stdout, if you also use stdio
• Health: GET /mcp/health on HTTP

Run with nitrostack-py start, not node dist/.