{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T18:52:31.568Z","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch","markdownUrl":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch.md","server":{"slug":"com-shiplatch-scanner","name":"ShipLatch","registryName":"com.shiplatch/scanner","description":"Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"shiplatch","type":"remote","identifier":"https://shiplatch.com/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch","version":"1.0.0","transport":null,"scoredAt":"2026-11-05T02:09:11.209Z"},"score":{"total":74,"tier":"medium","status":"scored","weekDelta":4,"history":[{"date":"2026-11-05","total":74},{"date":"2026-11-04","total":73},{"date":"2026-11-03","total":73},{"date":"2026-11-02","total":72},{"date":"2026-11-01","total":72},{"date":"2026-10-31","total":71},{"date":"2026-10-30","total":71},{"date":"2026-10-29","total":70},{"date":"2026-10-28","total":70},{"date":"2026-10-27","total":69},{"date":"2026-10-26","total":69},{"date":"2026-10-25","total":68},{"date":"2026-10-24","total":68},{"date":"2026-10-23","total":67},{"date":"2026-10-22","total":67}]},"categories":[{"name":"Endpoint Security","score":63,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation.","HTTPS check failed: the endpoint is reachable over plaintext HTTP.","HSTS check failed: the Strict-Transport-Security header is absent.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_no_destructive","args":{}},{"code":"https.plaintext","args":{}},{"code":"headers.hsts_absent","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":77,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 432 tokens (~144/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"144","items":"3","tools":"3","tokens":"432","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":47,"verdict":"partial","reasons":["Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"14"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"shiplatch","type":"remote","identifier":"https://shiplatch.com/mcp","withdrawn":false,"score":74,"current":true,"url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch","markdownUrl":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch.md"}],"facts":[{"label":"Endpoint","value":"https://shiplatch.com/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"1.0.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"scan_url","title":"Scan a web app (free, passive)","description":"Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status \"running\" and a scan_ref: call get_scan with it.","inputs":[{"name":"focus","type":"string","required":false,"description":"Optional: also answer one question yes/no. env = is a .env file public; vite = is a dev server exposed; rls = Supabase key exposure; gemini = Gemini/Google AI key exposure."},{"name":"url","type":"string","required":true,"description":"The app's public URL, e.g. https://myapp.lovable.app"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":215},{"name":"get_scan","title":"Get a scan result","description":"Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status \"running\". Results are kept for 7 days.","inputs":[{"name":"scan_ref","type":"string","required":true,"description":"The scan_ref returned by scan_url"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":59},{"name":"list_checks","title":"List what ShipLatch checks","description":"List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":35}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T02:09:11.000Z","track":"remote","endpoint":"https://shiplatch.com/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=shiplatch.com","issuer":"CN=WE1,O=Google Trust Services,C=US","notBefore":"2026-10-24T15:21:56Z","notAfter":"2027-01-22T16:21:53Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=WE1,O=Google Trust Services,C=US","issuer":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","notBefore":"2023-12-13T09:00:00Z","notAfter":"2029-02-20T14:00:00Z","keyType":"ECDSA","keyBits":256,"isCa":true},{"subject":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","issuer":"CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE","notBefore":"2023-11-15T03:43:21Z","notAfter":"2028-01-28T00:00:42Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"shiplatch.com.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"com.","outcome":"verified","label":"Verified"},{"zone":"shiplatch.com.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"plaintext_served","label":"Served over HTTP","status":200},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-22","recent":[{"id":"chg_01a1a977-9e47-731d-b3f7-9cfbc6754ae9","kind":"score.total_changed","summary":"Trust score (73 → 74)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a1a977-9e47-731d-b3f7-9cfbc6754ae9"},{"id":"chg_01a19f28-58a6-7c84-a6be-51fda860a1ba","kind":"score.total_changed","summary":"Trust score (72 → 73)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a19f28-58a6-7c84-a6be-51fda860a1ba"},{"id":"chg_01a194d9-00dd-7814-a7ea-d3a3f65fbe1b","kind":"score.total_changed","summary":"Trust score (71 → 72)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a194d9-00dd-7814-a7ea-d3a3f65fbe1b"},{"id":"chg_01a18a8b-8b07-717e-8b95-d039f5230688","kind":"score.total_changed","summary":"Trust score (70 → 71)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a18a8b-8b07-717e-8b95-d039f5230688"},{"id":"chg_01a1803e-0e1a-7d69-8072-305fd60414a0","kind":"score.total_changed","summary":"Trust score (69 → 70)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a1803e-0e1a-7d69-8072-305fd60414a0"},{"id":"chg_01a175f1-64c0-7255-91d5-47fbd8cbcd75","kind":"score.total_changed","summary":"Trust score (68 → 69)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a175f1-64c0-7255-91d5-47fbd8cbcd75"},{"id":"chg_01a16ba4-8a27-7320-b78d-ccfc3e9dcfb3","kind":"score.total_changed","summary":"Trust score (67 → 68)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a16ba4-8a27-7320-b78d-ccfc3e9dcfb3"},{"id":"chg_01a1667e-5809-7983-8a4f-680370a505e4","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-23","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a1667e-5809-7983-8a4f-680370a505e4"},{"id":"chg_01a1637c-8e22-7cec-9439-7ffdadc69b59","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch#chg-chg_01a1637c-8e22-7cec-9439-7ffdadc69b59"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch/changelog.json"},"links":{"html":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch","markdown":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch.md","changelogJson":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch/changelog.json","changelogRss":"https://verifymcp.io/servers/com-shiplatch-scanner/shiplatch.xml","external":[{"label":"Remote endpoint","href":"https://shiplatch.com/mcp"},{"label":"Website","href":"https://shiplatch.com/mcp"}]}}