ShipStatic

NPM · @SHIPSTATIC/MCP · 2 COMPONENTS · SCANNED AUG 3

Deploy websites from AI agents. Free at mcp.shipstatic.com. Install for the full toolset.

Available components

remote · mcp.shipstatic.com 70 npm · @shipstatic/mcp 81

+35 this week 81 81 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (125 of 129), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (125 of 129), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to shipstatic/mcp). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 6 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability83

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1202 tokens (~80/item across 15 items; 15 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @shipstatic/mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add com-shipstatic-mcp -- npx -y @shipstatic/mcp

# add to Codex CLI

codex mcp add com-shipstatic-mcp -- npx -y @shipstatic/mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-shipstatic-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@shipstatic/mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add com-shipstatic-mcp --command npx --arg -y --arg @shipstatic/mcp

# ~/.hermes/config.yaml

mcp_servers:
  com-shipstatic-mcp:
    command: "npx"
    args: ["-y", "@shipstatic/mcp"]

// mcp.json

{
  "mcpServers": {
    "com-shipstatic-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@shipstatic/mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +29
- Known CVEs: unverified → partial ▲ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- The attested source repository moved: shipstatic/mcp security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Stability: unverified → 0.27 ▲ functional
- Licence: MIT functional
2 Aug 26 +31
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
1 Aug 26 −29
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 +4
- Malware scan: pass → unverified ▼ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- The attested source repository moved: shipstatic/mcp security
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@shipstatic/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: shipstatic/mcp
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/shipstatic/mcp/.github/workflows/npm-publish.yml@refs/heads/main
Rekor log index:: 1548075796
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:0526ce0a8d39860f26724edf405deb5303ca22a442d2a5fb6cd887ba972b8d45a5565c5dc936943f0449dcf85e6691909c701a377fac6f89ab2d7258e
Discovery method:: attestation_endpoint

Dependencies 125 packages

125 packages in the resolved dependency tree · 122 deprecated · 39 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 15 exposed · ~974 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

deployments_get ~59

Get deployment details including URL, status, file count, size, labels, and password protection state.

Input Output Examples

Name	Type	Req	Description
deployment	string	yes	Deployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Returned by deployments_upload or deployments_list.

No output schema declared.

No examples provided.

deployments_list ~24

List all deployments with their URLs, status, labels, and password protection state.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

deployments_remove ~57

Permanently delete a deployment and its files. You MUST confirm with the user before calling this tool, referencing the deployment.

Input Output Examples

Name	Type	Req	Description
deployment	string	yes	Deployment hostname to delete (e.g. "happy-cat-abc1234.shipstatic.com")

No output schema declared.

No examples provided.

deployments_set ~70

Update deployment labels. Replaces all existing labels.

Input Output Examples

Name	Type	Req	Description
deployment	string	yes	Deployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Use deployments_list to find deployments.
labels	array	yes	Labels to set. Replaces all existing labels. Pass empty array to clear.

No output schema declared.

No examples provided.

deployments_upload ~197

Deploy a static site instantly — free, no account or API key required. Returns the live URL, file count, and size. Without SHIP_API_KEY, the response includes a claim URL (site expires in 3 days) — always show both the deployment URL and claim URL to the user. To make the site private, pass `password`; always show the password to the user if you set one.

Input Output Examples

Name	Type	Req	Description
labels	array	—	Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, 3-25 chars, allows . _ - separators.
password	string	—	Optional password to gate the deployment behind an unlock prompt (6–128 characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains…
path	string	yes	Absolute path to the build output directory to deploy (e.g. "/Users/me/project/dist")

No output schema declared.

No examples provided.

domains_dns ~60

Look up the DNS provider for a domain (e.g. Cloudflare, Namecheap). Helps the user know where to configure their DNS records.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name to look up DNS provider for (e.g. "www.example.com")

No output schema declared.

No examples provided.

domains_get ~47

Get domain details including URL, linked deployment, verification status, and labels.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name (e.g. "www.example.com"). Use domains_list to find names.

No output schema declared.

No examples provided.

domains_list ~22

List all domains with their URLs, linked deployment, and verification status.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

domains_records ~56

Get the DNS records the user needs to configure at their DNS provider. Call after domains_set. You MUST show the returned records to the user.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name. Must be a domain previously created with domains_set.

No output schema declared.

No examples provided.

domains_remove ~49

Permanently delete a domain. You MUST confirm with the user before calling this tool, referencing the domain name.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name to delete (e.g. "www.example.com")

No output schema declared.

No examples provided.

domains_set ~128

Create or update a custom domain. Can reserve a name (omit deployment), link it to a deployment, switch deployments, or update labels. After creating, call domains_records and show the DNS records to the user.

Input Output Examples

Name	Type	Req	Description
deployment	string	—	Deployment to serve on this domain (e.g. "happy-cat-abc1234.shipstatic.com"). Omit to reserve the domain without linking.
domain	string	yes	Domain name (e.g. "www.example.com" or "blog.example.com")
labels	array	—	Labels for organizing domains (e.g. ["production"]).

No output schema declared.

No examples provided.

domains_share ~66

Get a shareable DNS setup hash for a domain. The hash can be shared with the user so they can view the required DNS records without needing an API key.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name to generate a share link for. Must be a domain previously created with domains_set.

No output schema declared.

No examples provided.

domains_validate ~55

Check if a domain name is valid and available before creating it. Returns the normalized form and availability.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name to check (e.g. "www.example.com"). Call before domains_set to check availability.

No output schema declared.

No examples provided.

domains_verify ~64

Trigger DNS verification for a custom domain. Call after the user has configured DNS records from domains_records. Verification is asynchronous — the domain status updates once DNS propagates.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	Domain name to verify DNS for. Must be a domain previously created with domains_set.

No output schema declared.

No examples provided.

whoami ~20

Show authenticated account details including email, plan, and usage.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug