# ShipSafe — Independent security verification (npm · @ship-safe/mcp)

Independent security review for AI-built apps: exposed secrets, broken auth, unsafe data access.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-27

## Components

- remote · `ship-safe.co`: 36/100, [markdown](https://verifymcp.io/servers/co-ship-safe-scanner/api-mcp.md), [page](https://verifymcp.io/servers/co-ship-safe-scanner/api-mcp)
- npm · `@ship-safe/mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp.md), [page](https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp)

## Channel facts

- Registry: `npm`
- Package: `@ship-safe/mcp`
- Version: `0.6.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-27.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 39 of 123 dependencies flagged as unhealthy (1 deprecated).
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (SEE LICENSE IN LICENSE) isn't a recognized OSI-approved license.
  - Actively maintained (last published 1 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2207 tokens (~245/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the ShipSafe — Independent security verification MCP server?

ShipSafe — Independent security verification runs locally as an npm package, launched with npx -y @ship-safe/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add co-ship-safe-scanner -- npx -y @ship-safe/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "co-ship-safe-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@ship-safe/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "co-ship-safe-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@ship-safe/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add co-ship-safe-scanner -- npx -y @ship-safe/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "co-ship-safe-scanner": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@ship-safe/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add co-ship-safe-scanner --command npx --arg -y --arg @ship-safe/mcp
```

### Hermes

```yaml
mcp_servers:
  co-ship-safe-scanner:
    command: "npx"
    args: ["-y", "@ship-safe/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "co-ship-safe-scanner": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@ship-safe/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add co-ship-safe-scanner -t stdio -c npx -a -y @ship-safe/mcp
```

### Other

```json
{
  "mcpServers": {
    "co-ship-safe-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@ship-safe/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-27 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-25 (score 62, +26)

- [security regression] Stability: 0.07 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Tool coverage: 56% → 100%
- [functional improvement] Dependency health: unverified → 0.85
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.6.2 → 0.6.3
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 36, −10)

- [security regression] Known CVEs: pass → unverified
- [security regression] Stability: 0.03 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Dependency health: 0.85 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.6.0 → 0.6.2
- [functional] Package version: 0.6.0 → 0.6.1

### 2026-09-23 (score 46, −15)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.5.3 → 0.6.0

### 2026-09-22 (score 61)

First indexed and scored.

## MCP tools (9)

### `shipsafe_scan` (~385 tokens)

Scan code for security vulnerabilities

Scan a project directory for security vulnerabilities using ShipSafe: exposed secrets, injection, broken auth/access control (IDOR), misconfiguration, and known-vulnerable dependencies (CVEs found in package-lock.json/pnpm-lock.yaml/yarn.lock/requirements.txt/go.sum/Gemfile.lock). A fast local pattern + dependency scan runs for free with no login; with a login it can also run AI deep analysis (automatic on paid plans; a free account includes one AI scan — pass ai: true). Returns plain-English findings (each with the exact fix) AND structured output: a `clean` boolean + severity `counts` you can branch on, plus a `diff` (for full-project scans) showing what your last fix resolved vs what's still open. Pass `paths` or `changedOnly:true` to scan just the files you edited for a fast inner loop. Use right after writing or changing code, and again after fixing to confirm the issues are gone. The user's code is never stored.

Input parameters:

- `ai` (boolean): Run AI deep analysis (needs a login via shipsafe_login or `shipsafe login`; a free account includes one AI scan). Defaults on for paid plans, off otherwise.
- `changedOnly` (boolean): Scan only files changed vs git HEAD plus new untracked files. Falls back to a full scan if the directory isn't a git repo.
- `path` (string): Directory to scan. Defaults to the current working directory.
- `paths` (array): Scan only these files/dirs (relative to path, inside the project), e.g. the files you just edited. Faster than a full scan.
- `severity` (string): Only return findings at or above this severity.
- `upload` (boolean): Save this scan to the user's ShipSafe dashboard (needs login) and return a shareable dashboardUrl. Off by default.

Output parameters:

- `clean` (boolean): True when no findings came back at the requested severity from the files that were scanned. False when findings were returned, OR when total is 0 but nothing was actually scanned (every requested pat…
- `counts` (object)
- `dashboardUrl` (string): Set when upload:true succeeded: a shareable link to this scan in the dashboard.
- `diff` (object): Change vs your previous FULL scan of this directory, over the local pattern findings at ALL severities (a different, broader population than `clean`/`counts`, which honor the severity filter and incl…
- `findings` (array)
- `notes` (array)
- `scanned` (object)
- `total` (number)

### `shipsafe_fix_prompt` (~90 tokens)

Generate a one-paste fix prompt

Scan the project and generate a single paste-ready prompt that fixes ALL findings at once, tailored to the detected AI builder (Cursor, Lovable, Bolt, v0). Requires a login on a monthly plan (`shipsafe login`). Use when the user wants one prompt to hand to their AI tool to fix everything.

Input parameters:

- `path` (string): Directory to scan. Defaults to the current working directory.

Output parameters:

- `findingCount` (number): How many findings the prompt covers; 0 means there was nothing to fix.
- `platform` (string): The AI builder the prompt is written for, or 'manual'.
- `prompt` (string): The paste-ready fix prompt, secrets redacted. Absent when there is nothing to fix.

### `shipsafe_status` (~42 tokens)

Show ShipSafe login + scan quota

Show whether the user is logged in to ShipSafe, their plan, and remaining AI scan quota. Use this to check if AI deep analysis is available before scanning.

Output parameters:

- `aiScans` (object): The AI-scan allowance, when it could be fetched.
- `email` (string): The account's email, when logged in.
- `loggedIn` (boolean): Whether a ShipSafe login is saved on this machine.
- `plan` (string): The plan's name as sold: Free, Solo, Shield, Growth or Pro Audit.
- `quotaRefreshed` (boolean): False when the quota could not be fetched (not logged in, or offline).

### `shipsafe_scan_history` (~213 tokens)

Scan git history for committed secrets

Scan a local git repository's COMMIT HISTORY for secrets that were ever committed: API keys, service-role keys, tokens, secret-named env vars. This catches the dangerous case a normal scan can't see: a credential that was committed and later deleted from the current files but still lives in git history (anyone who clones the repo can recover it). Read-only and fully local; it reads past file versions with git and never writes or pushes. Findings flagged `removedFromHead` are the urgent ones: gone from your code, still in history, so the credential must be rotated AND the history purged (e.g. git filter-repo / BFG). Use after a repo has handled secrets, before going public, or when onboarding an existing repo.

Input parameters:

- `maxCommits` (number): How many commits back from HEAD to scan (default 100). Lower it for a faster pass on huge repos.
- `path` (string): Git repository directory to scan. Defaults to the current working directory.

Output parameters:

- `clean` (boolean): True when no committed secrets were found in the scanned history.
- `findings` (array)
- `isGitRepo` (boolean): False when the path isn't a git repository (then total is 0).
- `notes` (array)
- `removedFromHead` (number): How many secrets are gone from the current tree but still in history: the urgent, must-rotate-and-purge ones.
- `total` (number)

### `shipsafe_dast` (~360 tokens)

Probe a LIVE app you own for security issues (DAST)

Run a non-destructive dynamic scan against a RUNNING app (your localhost dev server or a deployed URL you own). Unlike the static scan (which reads source), this makes real GET requests to find issues only visible at runtime: missing security headers (CSP, HSTS, clickjacking), insecure cookies (Secure/HttpOnly/SameSite), CORS misconfiguration and leaked stack traces. It is read-only (GET only, bounded request count, gentle rate) and never sends payloads that change data. CONSENT REQUIRED: only probe an app you own or operate; you MUST pass confirmOwnership:true. NOTE: probing for exposed files the app never linked (/.env, /.git/config, backups, /admin), and anything in extraPaths, are unsolicited requests, so they run only when the human operator has set SHIPSAFE_MCP_ALLOW_ACTIVE_PROBE=true in their MCP config — a tool argument cannot turn them on. The result says which tier actually ran. Use after deploying, or against your local dev server before shipping.

Input parameters:

- `confirmOwnership` (boolean, required): Must be true. By setting it you confirm you own or operate this app and authorize a non-destructive probe.
- `extraPaths` (array): Additional SAME-ORIGIN paths to check for accidental exposure, e.g. ['/api/internal', '/uploads']. Anything that resolves off the target's origin is skipped and reported, and the whole list runs only…
- `maxRequests` (number): Cap total HTTP requests (default 25).
- `url` (string, required): Base URL of the running app to probe, e.g. http://localhost:3000 or https://yourapp.com.

Output parameters:

- `clean` (boolean): True only when no findings were returned AND every check observed the app (skippedChecks is empty).
- `counts` (object)
- `findings` (array)
- `notes` (array)
- `requestsMade` (number)
- `skippedChecks` (array): Checks that did not observe the app this run (crashed, unreachable, or answered by bot protection). Non-empty means clean is false.
- `target` (string)
- `total` (number)

### `shipsafe_scan_url` (~380 tokens)

Scan a LIVE deployed app you own (headers + leaked client secrets)

Scan a RUNNING deployed app you own in one shot: (1) the DAST runtime probe (security headers, CSP quality, clickjacking) AND (2) the high-value check a source scan can miss: it fetches the deployed CLIENT JS bundles (entry + lazy-loaded chunks) and scans them for SECRETS leaked into the browser. AI builders (Lovable, Bolt, v0) routinely inline API keys at build time, so the leak exists only in the deployed artifact, not the repo. Also flags publicly accessible source maps (original source recoverable). Read-only (GET only, bounded, gentle). CONSENT REQUIRED: only scan an app you own; pass confirmOwnership:true. Secret VALUES are redacted in the output. NOTE: exposed-path probing and validateSecrets send unsolicited requests to the target or to a third party, so they run only when the human operator set SHIPSAFE_MCP_ALLOW_ACTIVE_PROBE=true in their MCP config; a tool argument cannot turn them on, and the result says which tier ran.

Input parameters:

- `confirmOwnership` (boolean, required): Must be true: confirms you own/operate this app and authorize a non-destructive scan.
- `maxAssets` (number): Cap how many JS assets to fetch and scan (default 20).
- `url` (string, required): The deployed app URL, e.g. https://yourapp.com or http://localhost:3000.
- `validateSecrets` (boolean): Opt-in: for each provider key found leaked in the client bundle, make ONE read-only call to that provider (OpenAI/Stripe/GitHub/SendGrid/Slack/GitLab) to prove whether it's LIVE or revoked. The key i…

Output parameters:

- `assetsScanned` (number)
- `baasExposure` (array): Present when validateSecrets:true: BaaS resources (Supabase Storage buckets / RPC, Firebase Realtime DB / Firestore) proven readable by an anonymous visitor.
- `clean` (boolean): True only when there are no leaked secrets, no exposed source maps, no DAST findings, AND every stage observed the app (skippedChecks is empty).
- `dast` (array)
- `exposedSourceMaps` (array)
- `leakedSecrets` (array)
- `liveSecrets` (array): Present when validateSecrets:true: which leaked provider keys actually work right now.
- `notes` (array)
- `requestsMade` (number)
- `skippedChecks` (array): Checks that did not observe the app this run (crashed, unreachable, or answered by bot protection). Non-empty means clean is false.
- `supabaseExposure` (array): Present when validateSecrets:true: Supabase tables proven readable by an anonymous internet visitor (RLS not enforced).
- `target` (string)

### `shipsafe_report_false_positive` (~221 tokens)

Report a finding as a false positive

Tell ShipSafe that a finding it reported is a false positive. This sends the rule + context to ShipSafe's central false-positive database (shared with the web app and CLI) so the team can tune the rule and stop it from misfiring. Use when you and the user agree a finding is wrong, not a real issue. Requires a ShipSafe login. The code snippet is redacted before sending; no secrets leave the machine.

Input parameters:

- `file` (string): File path the finding was reported on.
- `line` (number): Line number of the finding.
- `reason` (string): Why it's a false positive (helps the team tune the rule).
- `ruleId` (string, required): The ruleId of the finding being reported (from a scan result, e.g. 'secrets/public-env-secret-exposed').
- `severity` (string): The finding's severity, as the scan reported it.
- `snippet` (string): The flagged code. Redacted before sending.
- `title` (string): The finding's title.

Output parameters:

- `reported` (boolean): True when ShipSafe recorded the report.
- `ruleId` (string): The rule that was reported.

### `shipsafe_scan_api` (~399 tokens)

Test a live API for IDOR / broken object-level authorization

Test a running API you own for IDOR / BOLA (OWASP API #1, the #1 vuln AI builders ship): can one logged-in user read ANOTHER user's objects by changing the ID? You provide TWO test-account bearer tokens (A and B) and the resource endpoints; for each resource, user A lists their own objects, then user B tries to read them by ID. A 200 = a real IDOR. Also flags collections readable with no token. Read-only (GET only), bounded. CONSENT REQUIRED. Use TWO DISPOSABLE TEST ACCOUNTS on a non-production environment, never real customer IDs. Provide two bearer tokens, OR test-account credentials plus a `login` config and ShipSafe fetches the tokens for you (Supabase Auth or a generic JWT endpoint). Tokens are used read-only and never stored.

Input parameters:

- `accountA` (object): TEST account A credentials (used with `login`).
- `accountB` (object): TEST account B credentials (used with `login`).
- `baseUrl` (string, required): API base URL, e.g. https://api-preprod.yourapp.com.
- `confirmOwnership` (boolean, required): Must be true: you own/operate this API and these are test accounts you authorize testing.
- `login` (object): Auto-login config: with accountA/accountB, ShipSafe fetches both test tokens for you. Supabase Auth or a generic JWT-returning endpoint only; cookie/session auth (Clerk, NextAuth) is not supported, p…
- `resources` (array, required): The resources to test for cross-user access.
- `tokenA` (string): Bearer token for TEST account A. Provide this OR `login` + accountA to fetch it automatically.
- `tokenB` (string): Bearer token for TEST account B. Provide this OR `login` + accountB to fetch it automatically.

Output parameters:

- `findings` (array)
- `idorCount` (number)
- `missingAuthCount` (number)
- `notes` (array)
- `unchecked` (array): Checks that never reached the API (blocked, failed, or nothing to test). Non-empty means the result is NOT clean.

### `shipsafe_login` (~117 tokens)

Log in to ShipSafe from your editor

Log in to ShipSafe without leaving the editor, to unlock AI deep analysis and fix prompts. Two steps: call with NO arguments to start; you'll get a URL and a code to authorize in the browser. After authorizing, call again with the returned `device_code` to finish. The free local + dependency scan works without logging in.

Input parameters:

- `device_code` (string): The device_code returned by the first (no-argument) call. Pass it on the second call, after authorizing in the browser, to complete login.

Output parameters:

- `deviceCode` (string): Pass back as device_code on the next call (status authorize).
- `email` (string): The account that logged in (status logged_in).
- `plan` (string): That account's plan, as sold (status logged_in).
- `status` (string): authorize: open verificationUrl and enter userCode, then call again with deviceCode. logged_in: done. pending: not authorized yet; call again.
- `userCode` (string): The code the user enters at verificationUrl (status authorize).
- `verificationUrl` (string): Where the user authorizes this login (status authorize).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp#diagnostics

## Score history

- 2026-09-27: 63
- 2026-09-26: 62
- 2026-09-25: 62
- 2026-09-24: 36
- 2026-09-23: 46
- 2026-09-22: 61

## Common questions

### What is the ShipSafe — Independent security verification MCP server?

ShipSafe — Independent security verification is an MCP server listed in the public MCP registry as co.ship-safe/scanner. Independent security review for AI-built apps: exposed secrets, broken auth, unsafe data access. This page covers its npm package (@ship-safe/mcp).

### Is the ShipSafe — Independent security verification MCP server safe to use?

ShipSafe — Independent security verification scores 63 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 27 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ShipSafe — Independent security verification MCP server expose?

ShipSafe — Independent security verification exposes 9 tools: shipsafe_scan, shipsafe_fix_prompt, shipsafe_status, shipsafe_scan_history, shipsafe_dast, and 4 more. Their descriptions and schemas cost roughly 2,207 tokens of context every time the server is loaded.

### Is the ShipSafe — Independent security verification MCP server still maintained?

ShipSafe — Independent security verification is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/@ship-safe/mcp
- Socket report: https://socket.dev/npm/package/@ship-safe/mcp
- Website: https://ship-safe.co/
- Changelog RSS feed: https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp.json
- HTML version of this page: https://verifymcp.io/servers/co-ship-safe-scanner/ship-safe-mcp