Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ShipStatic

NPM · @SHIPSTATIC/MCP · 2 COMPONENTS · SCANNED SEP 20

Deploy static websites from AI agents. Free at mcp.shipstatic.com — no install, no signup.

Available components

remote · mcp.shipstatic.com 83 npm · @shipstatic/mcp 93
+13 this week 93 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 33 of 99 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to shipstatic/mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability80
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 1570 tokens (~104/item across 15 items; 15 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the ShipStatic MCP server?

ShipStatic runs locally as an npm package, launched with npx -y @shipstatic/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @shipstatic/mcp

# add to Claude Code
claude mcp add com-shipstatic-mcp -- npx -y @shipstatic/mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "com-shipstatic-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@shipstatic/mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-shipstatic-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@shipstatic/mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add com-shipstatic-mcp -- npx -y @shipstatic/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-shipstatic-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@shipstatic/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-shipstatic-mcp --command npx --arg -y --arg @shipstatic/mcp
# ~/.hermes/config.yaml
mcp_servers:
  com-shipstatic-mcp:
    command: "npx"
    args: ["-y", "@shipstatic/mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-shipstatic-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@shipstatic/mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add com-shipstatic-mcp -t stdio -c npx -a -y @shipstatic/mcp
// mcp.json
{
  "mcpServers": {
    "com-shipstatic-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@shipstatic/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 −2
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Tool coverage: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • First check of Schema quality: unverified functional
    • Stability: pass → 0.83 functional
    • Package version: 1.12.2 → 1.12.4 functional
  • 19 Sept 26 0
    • Stability: 0.97 → pass security
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 0
    • Stability: 0.90 → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Tool coverage: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • First check of Schema quality: unverified functional
    • Package version: 1.12.1 → 1.12.2 functional
  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 −2
    • Stability: pass → 0.87 functional
  • 14 Sept 26 +15
    • Malware scan: unverified → pass ▲ security
  • 13 Sept 26 −16
    • Malware scan: pass → unverified ▼ security
    • First check of Tool coverage: 100 functional
    • Package version: 1.10.2 → 1.12.1 functional
    • Package version: 1.10.2 → 1.12.0 functional
    • Package version: 1.10.2 → 1.11.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@shipstatic/mcp@1.12.4

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo shipstatic/mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/shipstatic/mcp/.github/workflows/ci.yml@refs/heads/main
Rekor log index 2898761787
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:d6ffd9e32b4817881c4bce115844d8737c0c22f285e9308a9b8e7dabd1ebd1c2aed5dd65d63a50131be2c3dc38071d2d5453548d65f5299a68c61bee9

Background: How many MCP packages publish verified provenance →

Dependencies 99 packages
Packages resolved 99
Stale 33
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 15 exposed · ~1,257 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
deployments_delete ~42

Permanently deletes a deployment and its files.

NameTypeReqDescription
deploymentstringyesDeployment hostname to delete (e.g. "happy-cat-abc1234.shipstatic.com")
NameTypeReqDescription
deploymentstringyesThe deployment hostname that was marked for removal.
statusstringyesThe state the deployment is in while background cleanup runs. One of: pending, success, failed, deleting.

No examples provided.

deployments_get ~59

Get deployment details including URL, status, file count, size, labels, and password protection state.

NameTypeReqDescription
deploymentstringyesDeployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Returned by deployments_upload or deployments_list.
NameTypeReqDescription
configbooleanyesTrue if the deployment includes a ship.json routing config.
createdintegeryesUnix timestamp (seconds) when the deployment was created.
deploymentstringyesDeployment hostname, e.g. "happy-cat-abc1234.shipstatic.com".
expires–yesUnix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ…
filesintegeryesNumber of files in the deployment.
labelsarrayyesLabels attached to the deployment; empty when none.
passwordbooleanyesTrue if the deployment is password-protected.
screenshotstringyesFull URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate…
sizeintegeryesTotal deployment size in bytes.
statusstringyesDeployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting.
urlstringyesFull URL to the live deployment.
viastring|nullyesHow the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag.

No examples provided.

deployments_list ~97

List all deployments with their URLs, status, labels, and password protection state. The response's `cursor` is null on the last page; pass it back as `cursor` to fetch the next.

NameTypeReqDescription
cursorstring–Opaque position from the previous response's `cursor` field; omit for the first page.
limitinteger–Maximum number of items to return in one page. Omit for the server default.
NameTypeReqDescription
cursorstring|nullyesOpaque cursor for the next page; null on the last page. The whole has-more signal.
deploymentsarrayyesThe deployments on this page.

No examples provided.

deployments_set ~70

Update deployment labels. Replaces all existing labels.

NameTypeReqDescription
deploymentstringyesDeployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Use deployments_list to find deployments.
labelsarrayyesLabels to set. Replaces all existing labels. Pass empty array to clear.
NameTypeReqDescription
configbooleanyesTrue if the deployment includes a ship.json routing config.
createdintegeryesUnix timestamp (seconds) when the deployment was created.
deploymentstringyesDeployment hostname, e.g. "happy-cat-abc1234.shipstatic.com".
expires–yesUnix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ…
filesintegeryesNumber of files in the deployment.
labelsarrayyesLabels attached to the deployment; empty when none.
passwordbooleanyesTrue if the deployment is password-protected.
screenshotstringyesFull URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate…
sizeintegeryesTotal deployment size in bytes.
statusstringyesDeployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting.
urlstringyesFull URL to the live deployment.
viastring|nullyesHow the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag.

No examples provided.

deployments_upload ~372

Deploy a static site instantly: free, no account or API key required. Returns the live URL, file count, and size. Without SHIP_TOKEN, the response also includes a one-time claim URL, and the site expires in 3 days unless claimed. Pass `password` to make the site private.

NameTypeReqDescription
idempotencyKeystring–Makes this deploy replayable instead of repeatable. A deploy is not naturally idempotent: if a call times out you cannot tell "it never landed" from "it landed and the response was lost", and retryin…
labelsarray–Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, 3-25 chars, allows . _ - separators. Up to 10.
passwordstring–Optional password to gate the deployment behind an unlock prompt (6–128 characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains…
pathstringyesAbsolute path to the build output directory to deploy (e.g. "/Users/me/project/dist")
ttlnumber–Seconds until this deployment expires and the platform reclaims it; omit for one that never does. Only for authenticated deploys — an anonymous deployment already expires on the platform's schedule,…
NameTypeReqDescription
claimstring–One-time URL that claims this anonymous deployment to a free account, making it permanent. Only present on anonymous deploys; absent when the deploy was made with a connected account.
configbooleanyesTrue if the deployment includes a ship.json routing config.
createdintegeryesUnix timestamp (seconds) when the deployment was created.
deploymentstringyesDeployment hostname, e.g. "happy-cat-abc1234.shipstatic.com".
expires–yesUnix timestamp (seconds) when the deployment expires; null when permanent. Anonymous deployments expire 3 days after creation unless claimed; an authenticated deployment carries one only when it requ…
filesintegeryesNumber of files in the deployment.
labelsarrayyesLabels attached to the deployment; empty when none.
passwordbooleanyesTrue if the deployment is password-protected.
screenshotstringyesFull URL to the deployment screenshot. Rendered on the first request for it, so the URL is returned immediately and the first request takes a few seconds; every request after that is served immediate…
sizeintegeryesTotal deployment size in bytes.
statusstringyesDeployment lifecycle state; "success" means the site is live. One of: pending, success, failed, deleting.
urlstringyesFull URL to the live deployment.
viastring|nullyesHow the deployment was created, as shown in deployment history (today one of: web, sdk, cli, mcp, git, n8n, gpt, vsc, cld, crs, gmn, api). Null on deployments older than the tag.

No examples provided.

domains_delete ~33

Permanently deletes a domain.

NameTypeReqDescription
domainstringyesDomain name to delete (e.g. "www.example.com")
NameTypeReqDescription
domainstringyesThe domain name that was removed, normalized.

No examples provided.

domains_dns ~63

Returns the DNS provider recorded for the domain, if known (e.g. Cloudflare, Namecheap): where its DNS records are configured.

NameTypeReqDescription
domainstringyesDomain name (e.g. "www.example.com"). Must be a domain previously created with domains_set.
NameTypeReqDescription
dns–yesWhat the platform recorded about the domain's DNS provider when the domain was created; null if nothing was recorded.
domainstringyesThe domain name.

No examples provided.

domains_get ~47

Get domain details including URL, linked deployment, verification status, and labels.

NameTypeReqDescription
domainstringyesDomain name (e.g. "www.example.com"). Use domains_list to find names.
NameTypeReqDescription
createdintegeryesUnix timestamp (seconds) when the domain was created.
deploymentstring|nullyesThe deployment hostname this domain points to; null when reserved but not yet linked.
domainstringyesThe domain name, e.g. "www.example.com".
labelsarrayyesLabels attached to the domain; empty when none.
linked–yesUnix timestamp (seconds) when a deployment was last linked; null if never linked.
linksintegeryesHow many times a deployment has been linked to this domain.
statusstringyesDNS verification state; "success" means the domain serves the linked deployment. One of: pending, partial, success, paused.
urlstringyesFull URL to the domain.

No examples provided.

domains_list ~95

List all domains with their URLs, linked deployment, and verification status. The response's `cursor` is null on the last page; pass it back as `cursor` to fetch the next.

NameTypeReqDescription
cursorstring–Opaque position from the previous response's `cursor` field; omit for the first page.
limitinteger–Maximum number of items to return in one page. Omit for the server default.
NameTypeReqDescription
cursorstring|nullyesOpaque cursor for the next page; null on the last page. The whole has-more signal.
domainsarrayyesThe domains on this page.

No examples provided.

domains_records ~45

Returns the DNS records to configure at the domain's DNS provider. Call after domains_set.

NameTypeReqDescription
domainstringyesDomain name. Must be a domain previously created with domains_set.
NameTypeReqDescription
apexstringyesThe apex (registered) domain where DNS records are managed.
domainstringyesThe domain the records are for.
recordsarrayyesThe records to configure at the DNS provider, in the order to add them.

No examples provided.

domains_set ~123

Create or update a custom domain. Can reserve a name (omit deployment), link it to a deployment, switch deployments, or update labels. domains_records then returns the DNS records to configure.

NameTypeReqDescription
deploymentstring–Deployment to serve on this domain (e.g. "happy-cat-abc1234.shipstatic.com"). Omit to reserve the domain without linking.
domainstringyesDomain name (e.g. "www.example.com" or "blog.example.com")
labelsarray–Labels for organizing domains (e.g. ["production"]).
NameTypeReqDescription
createdintegeryesUnix timestamp (seconds) when the domain was created.
deploymentstring|nullyesThe deployment hostname this domain points to; null when reserved but not yet linked.
domainstringyesThe domain name, e.g. "www.example.com".
isCreatebooleanyesTrue when this call created the domain; false when it updated an existing one.
labelsarrayyesLabels attached to the domain; empty when none.
linked–yesUnix timestamp (seconds) when a deployment was last linked; null if never linked.
linksintegeryesHow many times a deployment has been linked to this domain.
statusstringyesDNS verification state; "success" means the domain serves the linked deployment. One of: pending, partial, success, paused.
urlstringyesFull URL to the domain.

No examples provided.

domains_share ~54

Returns a shareable DNS setup URL that needs no API key, for whoever manages the domain's DNS.

NameTypeReqDescription
domainstringyesDomain name to generate a share link for. Must be a domain previously created with domains_set.
NameTypeReqDescription
domainstringyesThe domain the setup link is for.
urlstringyesThe shareable DNS setup URL; whoever opens it sees the records to configure, with no API key.

No examples provided.

domains_validate ~55

Check if a domain name is valid and available before creating it. Returns the normalized form and availability.

NameTypeReqDescription
domainstringyesDomain name to check (e.g. "www.example.com"). Call before domains_set to check availability.
NameTypeReqDescription
availableboolean|nullyesWhether nobody has registered the name yet; null when invalid. Creating it would be new; re-pointing your own domain is a write, not a create.
normalizedstring|nullyesThe normalized domain name; null when invalid.
reasonstring|nullyesWhy the name is unusable, for display; null when it is usable.
validbooleanyesWhether the domain's shape is usable.

No examples provided.

domains_verify ~78

Trigger DNS verification for a custom domain. Call after the user has configured DNS records from domains_records. Verification is asynchronous — the domain status updates once DNS propagates. A verified domain serves nothing until a deployment is linked with domains_set.

NameTypeReqDescription
domainstringyesDomain name to verify DNS for. Must be a domain previously created with domains_set.
NameTypeReqDescription
domainstringyesThe domain whose DNS verification was queued, normalized. The check runs asynchronously; the domain status updates once DNS propagates.

No examples provided.

whoami ~24

Returns the account's email, name, plan, current usage and plan caps.

Input schema present but exposes no named parameters.

NameTypeReqDescription
capsobjectyesWhat the account is allowed to hold: the same three keys as usage, so the pair divides.
emailstringyesThe account email address.
namestring|nullyesDisplay name; null if not set.
planstringyesThe tier the account stands at. One of: free, pro, team, scale, sponsored.
usageobjectyesWhat the account currently holds.

No examples provided.

Common questions

What is the ShipStatic MCP server?

ShipStatic is an MCP server listed in the public MCP registry as com.shipstatic/mcp. Deploy static websites from AI agents. Free at mcp.shipstatic.com, no install, no signup. This page covers its npm package (@shipstatic/mcp).

Is the ShipStatic MCP server safe to use?

ShipStatic scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ShipStatic MCP server expose?

ShipStatic exposes 15 tools: deployments_upload, deployments_list, deployments_get, deployments_set, deployments_delete, and 10 more. Their descriptions and schemas cost roughly 1,257 tokens of context every time the server is loaded.

Is the ShipStatic MCP server still maintained?

ShipStatic is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the ShipStatic MCP server under?

ShipStatic declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.