ShipStatic
REMOTE · MCP.SHIPSTATIC.COM · 2 COMPONENTS · SCANNED SEP 20
Deploy static websites from AI agents. Free at mcp.shipstatic.com — no install, no signup.
Available components
Recent critical change
Authorization (11 Aug 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (deployments_set). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1654 tokens (~103/item across 16 items; 15 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the ShipStatic MCP server?
ShipStatic is a hosted endpoint at https://mcp.shipstatic.com/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.shipstatic.com
claude mcp add --transport http com-shipstatic-mcp 'https://mcp.shipstatic.com/'
{
"mcpServers": {
"com-shipstatic-mcp": {
"url": "https://mcp.shipstatic.com/"
}
}
} {
"servers": {
"com-shipstatic-mcp": {
"type": "http",
"url": "https://mcp.shipstatic.com/"
}
}
} [mcp_servers.com-shipstatic-mcp] url = "https://mcp.shipstatic.com/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-shipstatic-mcp": {
"type": "remote",
"url": "https://mcp.shipstatic.com/",
"enabled": true
}
}
} openclaw mcp add com-shipstatic-mcp --url 'https://mcp.shipstatic.com/' --transport streamable-http
mcp_servers:
com-shipstatic-mcp:
url: "https://mcp.shipstatic.com/" {
"McpServers": {
"com-shipstatic-mcp": {
"Transport": "http",
"Url": "https://mcp.shipstatic.com/"
}
}
} assistant mcp add com-shipstatic-mcp -t streamable-http -u 'https://mcp.shipstatic.com/'
{
"mcpServers": {
"com-shipstatic-mcp": {
"type": "http",
"url": "https://mcp.shipstatic.com/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “domains_verify” rewrote its description, which is the text the model reads security
- Server version: 1.12.2 → 1.12.4 functional
- 17 Sept 26 0
- Server version: 1.12.1 → 1.12.2 functional
- 13 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “deployments_delete” rewrote its description, which is the text the model reads security
- Tool “domains_delete” rewrote its description, which is the text the model reads security
- Tool “deployments_upload” rewrote its description, which is the text the model reads security
- Tool “domains_share” rewrote its description, which is the text the model reads security
- Tool “whoami” rewrote its description, which is the text the model reads security
- Tool “domains_dns” rewrote its description, which is the text the model reads security
- Tool “domains_records” rewrote its description, which is the text the model reads security
- Tool “domains_set” rewrote its description, which is the text the model reads security
- Tool “deployments_set” is now declared destructive security
- Tool “domains_set” is now declared destructive security
- Tool coverage: 7% → 100% ▲ functional
- Tool “domains_get” now declares an output schema ▲ functional
- Tool “deployments_delete” now declares an output schema ▲ functional
- Tool “deployments_get” now declares an output schema ▲ functional
- Tool “deployments_list” now declares an output schema ▲ functional
- Tool “deployments_set” now declares an output schema ▲ functional
- Tool “domains_delete” now declares an output schema ▲ functional
- Tool “domains_dns” now declares an output schema ▲ functional
- Tool “domains_list” now declares an output schema ▲ functional
- Tool “domains_records” now declares an output schema ▲ functional
- Tool “domains_set” now declares an output schema ▲ functional
- Tool “domains_share” now declares an output schema ▲ functional
- Tool “domains_validate” now declares an output schema ▲ functional
- Tool “domains_verify” now declares an output schema ▲ functional
- Tool “whoami” now declares an output schema ▲ functional
- Server version: 1.11.0 → 1.12.1 functional
- Server version: 1.10.2 → 1.11.0 functional
- “domains_dns” reworded the description of “domain” cosmetic
- Tool “domains_dns” changed its title: Look Up DNS Provider → Get DNS Provider cosmetic
- 7 Sept 26 0
- Server version: 1.9.0 → 1.10.2 functional
- 1 Sept 26 0
- Server version: 1.8.0 → 1.9.0 functional
- 31 Aug 26 0
- Server version: 1.7.0 → 1.8.0 functional
- 30 Aug 26 0
- Tool “domains_share” rewrote its description, which is the text the model reads security
- Server version: 1.6.1 → 1.7.0 functional
- 28 Aug 26 0
- Server version: 1.6.0 → 1.6.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://mcp.shipstatic.com
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=shipstatic.com | CN=WE1,O=Google Trust Services,C=US | 31 Aug 2026 | 29 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | d21e36dc6e68370b0e093bf730439b67 |
| SANs: shipstatic.com, *.shipstatic.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.shipstatic.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| shipstatic.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.shipstatic.com | Verified | 200 | |
| http (plaintext) | http://mcp.shipstatic.com | HTTPS enforced | 301 | https://mcp.shipstatic.com/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
deployments_delete Delete Deployment ~42
Permanently deletes a deployment and its files.
| Name | Type | Req | Description |
|---|---|---|---|
| deployment | string | yes | Deployment hostname to delete (e.g. "happy-cat-abc1234.shipstatic.com") |
| Name | Type | Req | Description |
|---|---|---|---|
| deployment | string | yes | The deployment hostname that was marked for removal. |
| status | string | yes | The state the deployment is in while background cleanup runs. One of: pending, success, failed, deleting. |
No examples provided.
deployments_get Get Deployment ~59
Get deployment details including URL, status, file count, size, labels, and password protection state.
| Name | Type | Req | Description |
|---|---|---|---|
| deployment | string | yes | Deployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Returned by deployments_upload or deployments_list. |
| Name | Type | Req | Description |
|---|---|---|---|
| config | boolean | yes | True if the deployment includes a ship.json routing config. |
| created | integer | yes | Unix timestamp (seconds) when the deployment was created. |
| deployment | string | yes | Deployment hostname, e.g. "happy-cat-abc1234.shipstatic.com". |
| expires | – | yes | Unix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ… |
| files | integer | yes | Number of files in the deployment. |
| labels | array | yes | Labels attached to the deployment; empty when none. |
| password | boolean | yes | True if the deployment is password-protected. |
| screenshot | string | yes | Full URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate… |
| size | integer | yes | Total deployment size in bytes. |
| status | string | yes | Deployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting. |
| url | string | yes | Full URL to the live deployment. |
| via | – | yes | How the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag. |
No examples provided.
deployments_list List Deployments ~97
List all deployments with their URLs, status, labels, and password protection state. The response's `cursor` is null on the last page; pass it back as `cursor` to fetch the next.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque position from the previous response's `cursor` field; omit for the first page. |
| limit | integer | – | Maximum number of items to return in one page. Omit for the server default. |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | yes | Opaque cursor for the next page; null on the last page. The whole has-more signal. |
| deployments | array | yes | The deployments on this page. |
No examples provided.
deployments_set Update Deployment Labels ~70
Update deployment labels. Replaces all existing labels.
| Name | Type | Req | Description |
|---|---|---|---|
| deployment | string | yes | Deployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Use deployments_list to find deployments. |
| labels | array | yes | Labels to set. Replaces all existing labels. Pass empty array to clear. |
| Name | Type | Req | Description |
|---|---|---|---|
| config | boolean | yes | True if the deployment includes a ship.json routing config. |
| created | integer | yes | Unix timestamp (seconds) when the deployment was created. |
| deployment | string | yes | Deployment hostname, e.g. "happy-cat-abc1234.shipstatic.com". |
| expires | – | yes | Unix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ… |
| files | integer | yes | Number of files in the deployment. |
| labels | array | yes | Labels attached to the deployment; empty when none. |
| password | boolean | yes | True if the deployment is password-protected. |
| screenshot | string | yes | Full URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate… |
| size | integer | yes | Total deployment size in bytes. |
| status | string | yes | Deployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting. |
| url | string | yes | Full URL to the live deployment. |
| via | – | yes | How the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag. |
No examples provided.
deployments_upload Deploy Static Site ~429
Deploy a static site to a live URL: free, no account or API key required. **File content is plain text by default.** Pass HTML/CSS/JS/JSON/SVG/etc. directly in each file's `content` as a regular string. Only set `encoding: "base64"` per-file for binary content (images, fonts) — do not base64-encode text. Returns the live URL. Without a connected account, the response also includes a one-time claim URL, and the site expires in 3 days unless claimed. Pass `password` to make the site private.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | Files that make up the site. The site root is implied by these paths. |
| idempotencyKey | string | – | Makes this deploy replayable instead of repeatable. A deploy is not naturally idempotent: if a call times out you cannot tell "it never landed" from "it landed and the response was lost", and retryin… |
| labels | array | – | Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, 3-25 chars, allows . _ - separators. Up to 10. |
| password | string | – | Optional password to gate the deployment behind an unlock prompt (6–128 characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains… |
| ttl | number | – | Seconds until this deployment expires and the platform reclaims it; omit for one that never does. Only for authenticated deploys — an anonymous deployment already expires on the platform's schedule,… |
| Name | Type | Req | Description |
|---|---|---|---|
| claim | string | – | One-time URL that claims this anonymous deployment to a free account, making it permanent. Only present on anonymous deploys; absent when the deploy was made with a connected account. |
| config | boolean | yes | True if the deployment includes a ship.json routing config. |
| created | integer | yes | Unix timestamp (seconds) when the deployment was created. |
| deployment | string | yes | Deployment hostname, e.g. "happy-cat-abc1234.shipstatic.com". |
| expires | – | yes | Unix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ… |
| files | integer | yes | Number of files in the deployment. |
| labels | array | yes | Labels attached to the deployment; empty when none. |
| password | boolean | yes | True if the deployment is password-protected. |
| screenshot | string | yes | Full URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate… |
| size | integer | yes | Total deployment size in bytes. |
| status | string | yes | Deployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting. |
| url | string | yes | Full URL to the live deployment. |
| via | – | yes | How the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag. |
No examples provided.
domains_delete Delete Domain ~33
Permanently deletes a domain.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name to delete (e.g. "www.example.com") |
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The domain name that was removed, normalized. |
No examples provided.
domains_dns Get DNS Provider ~63
Returns the DNS provider recorded for the domain, if known (e.g. Cloudflare, Namecheap): where its DNS records are configured.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name (e.g. "www.example.com"). Must be a domain previously created with domains_set. |
| Name | Type | Req | Description |
|---|---|---|---|
| dns | – | yes | What the platform recorded about the domain's DNS provider when the domain was created; null if nothing was recorded. |
| domain | string | yes | The domain name. |
No examples provided.
domains_get Get Domain ~47
Get domain details including URL, linked deployment, verification status, and labels.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name (e.g. "www.example.com"). Use domains_list to find names. |
| Name | Type | Req | Description |
|---|---|---|---|
| created | integer | yes | Unix timestamp (seconds) when the domain was created. |
| deployment | – | yes | The deployment hostname this domain points to; null when reserved but not yet linked. |
| domain | string | yes | The domain name, e.g. "www.example.com". |
| labels | array | yes | Labels attached to the domain; empty when none. |
| linked | – | yes | Unix timestamp (seconds) when a deployment was last linked; null if never linked. |
| links | integer | yes | How many times a deployment has been linked to this domain. |
| status | string | yes | DNS verification state; "success" means the domain serves the linked deployment. One of: pending, partial, success, paused. |
| url | string | yes | Full URL to the domain. |
No examples provided.
domains_list List Domains ~95
List all domains with their URLs, linked deployment, and verification status. The response's `cursor` is null on the last page; pass it back as `cursor` to fetch the next.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque position from the previous response's `cursor` field; omit for the first page. |
| limit | integer | – | Maximum number of items to return in one page. Omit for the server default. |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | yes | Opaque cursor for the next page; null on the last page. The whole has-more signal. |
| domains | array | yes | The domains on this page. |
No examples provided.
domains_records Get DNS Records ~45
Returns the DNS records to configure at the domain's DNS provider. Call after domains_set.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name. Must be a domain previously created with domains_set. |
| Name | Type | Req | Description |
|---|---|---|---|
| apex | string | yes | The apex (registered) domain where DNS records are managed. |
| domain | string | yes | The domain the records are for. |
| records | array | yes | The records to configure at the DNS provider, in the order to add them. |
No examples provided.
domains_set Connect Custom Domain ~123
Create or update a custom domain. Can reserve a name (omit deployment), link it to a deployment, switch deployments, or update labels. domains_records then returns the DNS records to configure.
| Name | Type | Req | Description |
|---|---|---|---|
| deployment | string | – | Deployment to serve on this domain (e.g. "happy-cat-abc1234.shipstatic.com"). Omit to reserve the domain without linking. |
| domain | string | yes | Domain name (e.g. "www.example.com" or "blog.example.com") |
| labels | array | – | Labels for organizing domains (e.g. ["production"]). |
| Name | Type | Req | Description |
|---|---|---|---|
| created | integer | yes | Unix timestamp (seconds) when the domain was created. |
| deployment | – | yes | The deployment hostname this domain points to; null when reserved but not yet linked. |
| domain | string | yes | The domain name, e.g. "www.example.com". |
| isCreate | boolean | yes | True when this call created the domain; false when it updated an existing one. |
| labels | array | yes | Labels attached to the domain; empty when none. |
| linked | – | yes | Unix timestamp (seconds) when a deployment was last linked; null if never linked. |
| links | integer | yes | How many times a deployment has been linked to this domain. |
| status | string | yes | DNS verification state; "success" means the domain serves the linked deployment. One of: pending, partial, success, paused. |
| url | string | yes | Full URL to the domain. |
No examples provided.
domains_share Share DNS Setup ~54
Returns a shareable DNS setup URL that needs no API key, for whoever manages the domain's DNS.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name to generate a share link for. Must be a domain previously created with domains_set. |
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The domain the setup link is for. |
| url | string | yes | The shareable DNS setup URL; whoever opens it sees the records to configure, with no API key. |
No examples provided.
domains_validate Check Domain Availability ~55
Check if a domain name is valid and available before creating it. Returns the normalized form and availability.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name to check (e.g. "www.example.com"). Call before domains_set to check availability. |
| Name | Type | Req | Description |
|---|---|---|---|
| available | – | yes | Whether nobody has registered the name yet; null when invalid. Creating it would be new; re-pointing your own domain is a write, not a create. |
| normalized | – | yes | The normalized domain name; null when invalid. |
| reason | – | yes | Why the name is unusable, for display; null when it is usable. |
| valid | boolean | yes | Whether the domain's shape is usable. |
No examples provided.
domains_verify Verify Domain DNS ~78
Trigger DNS verification for a custom domain. Call after the user has configured DNS records from domains_records. Verification is asynchronous — the domain status updates once DNS propagates. A verified domain serves nothing until a deployment is linked with domains_set.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name to verify DNS for. Must be a domain previously created with domains_set. |
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The domain whose DNS verification was queued, normalized. The check runs asynchronously; the domain status updates once DNS propagates. |
No examples provided.
whoami Show Account ~24
Returns the account's email, name, plan, current usage and plan caps.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| caps | object | yes | What the account is allowed to hold: the same three keys as usage, so the pair divides. |
| string | yes | The account email address. | |
| name | – | yes | Display name; null if not set. |
| plan | string | yes | The tier the account stands at. One of: free, pro, team, scale, sponsored. |
| usage | object | yes | What the account currently holds. |
No examples provided.
What is the ShipStatic MCP server?
ShipStatic is an MCP server listed in the public MCP registry as com.shipstatic/mcp. Deploy static websites from AI agents. Free at mcp.shipstatic.com, no install, no signup. This page covers its hosted endpoint (https://mcp.shipstatic.com).
Is the ShipStatic MCP server safe to use?
ShipStatic scores 83 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ShipStatic MCP server expose?
ShipStatic exposes 15 tools: deployments_upload, deployments_list, deployments_get, deployments_set, deployments_delete, and 10 more. Their descriptions and schemas cost roughly 1,314 tokens of context every time the server is loaded.
Does the ShipStatic MCP server require authentication?
No. We connected to ShipStatic without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ShipStatic MCP server still maintained?
ShipStatic is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.