bunjs-production

bunjs-production is a skill for Claude Code from MadAppGang/claude-code. It costs 52 tokens per session (6,313 once invoked), scanned A, original, MIT.

Production deployment guidance for Bun.js TypeScript services, covering Docker containers, AWS ECS/Fargate, Redis caching, security settings, logging, and CI/CD pipelines. CI/CD means automatically testing and delivering code changes.

In plain words
What is it for?
Use it to containerize services, deploy them to AWS, add Redis caching, configure security protections, set up automated delivery, and check production readiness.
Why use it?
It helps move a backend from local development toward a repeatable and more secure production setup.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is COPY prisma ./prisma/.

Part of the dev plugin — 47 skills, 12 commands, 14 agents shipped together

Good fit Use it to containerize services, deploy them to AWS, add Redis caching, configure security protections, set up automated delivery, and check production readiness.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/MadAppGang/claude-code
agentmods
npx agentmods add skills/madappgang/claude-code/bunjs-production

Made for: Claude Code.

Or install dev, the plugin that ships this one along with the rest of its 47 skills, 12 commands, 14 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bunjs-production

README.md
[![agentmods](https://agentmods.dev/badge/skills/madappgang/claude-code/bunjs-production.svg)](https://agentmods.dev/skills/madappgang/claude-code/bunjs-production)
Your own site
<a href="https://agentmods.dev/skills/madappgang/claude-code/bunjs-production"><img src="https://agentmods.dev/badge/skills/madappgang/claude-code/bunjs-production.svg" alt="Measured on agentmods" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,313 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.06313
Opus 5 $0.00026 $0.03157
Sonnet 5 $0.00010 $0.01263
Haiku 4.5 $0.00005 $0.00631

Measured 4d ago against content hash f6efbfa4fb7e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

bunjs-production scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
Origin

Copies of this mod

1 near-identical copy found in the catalogue:

plugins/dev/skills/backend/bunjs-production/SKILL.md · 1,002 lines

How it starts

The opening of the file, as written. The whole thing — 1,002 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bun.js Production Deployment Patterns

Overview

This skill covers production deployment patterns for Bun.js TypeScript backend applications, including Docker containerization, AWS ECS deployment, Redis caching, security hardening, structured logging, CI/CD pipelines, and production readiness checklists.

When to use this skill:

  • Containerizing applications with Docker
  • Deploying to AWS ECS/Fargate
  • Implementing Redis caching strategies
  • Hardening security (headers, CORS, rate limiting)
  • Setting up CI/CD pipelines
  • Preparing for production deployment

See also:

  • dev:bunjs - Core Bun patterns, HTTP servers, database access
  • dev:bunjs-architecture - Layered architecture, camelCase conventions
  • dev:bunjs-apidog - OpenAPI specifications and Apidog integration

Docker Multi-Stage Build

Production Dockerfile

# Stage 1: Base
FROM oven/bun:1-alpine AS base
WORKDIR /app

# Stage 2: Dependencies
FROM base AS deps
COPY package.json bun.lockb ./
COPY prisma ./prisma/
RUN bun install --frozen-lockfile --production

# Stage 3: Build
FROM base AS build
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN bunx prisma generate
RUN bun run build  # Optional: if you have a build step

# Stage 4: Runner
FROM base AS runner
WORKDIR /app
ENV NODE_ENV=production

# Create non-root user
RUN addgroup -g 1001 bungroup && \
    adduser -D -u 1001 -G bungroup bunuser

# Copy dependencies and source
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/src ./src
COPY --from=build /app/prisma ./prisma
COPY --from=build /app/node_modules/.prisma ./node_modules/.prisma
COPY package.json bun.lockb ./

# Set ownership
RUN chown -R bunuser:bungroup /app

USER bunuser
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

CMD ["bun", "src/server.ts"]

docker-compose.yml (Local Development)

Read the full file on GitHub · 1,002 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 1,002 lines · 52 tokens per session scan A f6efbfa4fb7e

Subscribe to this mod's changes

bunjs-production is a skill published in the GitHub repository MadAppGang/claude-code (279 stars, last pushed 5mo ago), licensed MIT. It adds 52 tokens to every session and 6,313 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

implementing-api-rate-limiting-and-throttling

Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API…

xalgorix/xalgorix · 114 tokens

scanning-docker-images-with-trivy

Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati.

xalgorix/xalgorix · 42 tokens

deploy

Elixir/Phoenix deployment patterns — Dockerfile, fly.toml, runtime.exs, mix release, rel/ overlays. Use when configuring Fly.io, Docker, CI/CD, health checks, or production migrations.

oliver-kriska/claude-elixir-phoenix · 46 tokens

performing-container-security-scanning-with-trivy

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

xalgorix/xalgorix · 48 tokens

devops-deployment

Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.

yonatangross/orchestkit · 44 tokens

Docker Testcontainers

Integration testing with real dependencies in throwaway Docker containers using the Testcontainers Node.js API - GenericContainer, exposed ports, wait strategies, module containers, Docker Compose environments, and reliable cleanup.

PramodDutta/qaskills · 42 tokens