# ShipDapp (remote · api.shipdapp.com)

Deploy Dockerized apps to Akash devnet with ShipDapp MCP build, deploy, update, and logs tools.

- Trust score: 57/100 (low)
- Change this week: −1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.shipdapp.com`: 57/100 (this document), [markdown](https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse.md), [page](https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse)

## Channel facts

- Endpoint: `https://api.shipdapp.com/api/mcp/sse`
- Transports: `sse`
- Auth: `required`
- Version: `0.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 16 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS check failed: the endpoint is reachable over plaintext HTTP.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 40/100
  - Verified sse transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2491 tokens (~155/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 95% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http yash1ts-shipdapp https://api.shipdapp.com/api/mcp/sse
```

### Codex

```toml
[mcp_servers.yash1ts-shipdapp]
url = "https://api.shipdapp.com/api/mcp/sse"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yash1ts-shipdapp": {
      "type": "remote",
      "url": "https://api.shipdapp.com/api/mcp/sse",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yash1ts-shipdapp --url https://api.shipdapp.com/api/mcp/sse --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  yash1ts-shipdapp:
    url: "https://api.shipdapp.com/api/mcp/sse"
```

### Other

```json
{
  "mcpServers": {
    "yash1ts-shipdapp": {
      "type": "http",
      "url": "https://api.shipdapp.com/api/mcp/sse"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 57, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 56, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 58, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 57)

First indexed and scored.

## MCP tools (16)

### `get_auth_challenge` (~75 tokens)

CALL THIS FIRST before deploy/build tools ONLY if you are NOT using a ShipDapp API key in MCP client headers. Returns a Sign-In-With-Solana message for local wallet signing.

Input parameters:

- `walletAddress` (string, required): Solana wallet public key (base58), e.g. from ~/.config/solana/id.json

### `authenticate` (~88 tokens)

CALL THIS IMMEDIATELY AFTER get_auth_challenge. Submit the base58 signature of the challenge message to unlock the session. All deploy/build/status tools require authentication — do not call them until this succeeds.

Input parameters:

- `signature` (string, required): Base58 ed25519 signature of challengeMessage, signed locally off-chain
- `walletAddress` (string, required): Same wallet address used in get_auth_challenge

### `get_usage_limits` (~63 tokens)

CALL THIS AFTER A GUARDRAIL BLOCK or before planning multiple deploys. Returns your wallet's deployment quotas and current usage (active apps, hourly build/deploy counts). Use to understand why deploy_app was rejected and what to do next (close_app or wait).

### `list_templates` (~155 tokens)

CALL THIS WHEN STARTING A NEW APP or when you need a templateId for deploy_app/build_image. Returns available templates (e.g. webapp-static = frontend SPA, framework-agnostic). Optional starter via includeFiles=true is React+Vite+Tailwind — not required. Production start uses serve -s dist in the starter. Prefer list_template_files + validate_upload before deploy_app. Upload your complete project as-is (mergeMode=strict never injects Tailwind/PostCSS).

Input parameters:

- `appName` (string): Substituted into template files like index.html title (default: my-app)
- `includeFiles` (boolean): Set true when bootstrapping a new project — returns scaffold files to write to disk

### `list_template_files` (~84 tokens)

CALL THIS BEFORE deploy_app to see required vs optional paths. Required is minimal (package.json + index.html); component filenames are not fixed — validate_upload checks that the HTML entry's imports resolve.

Input parameters:

- `appName` (string): Optional — only affects scaffold content, not path lists
- `templateId` (string, required): From list_templates (e.g. webapp-static)

### `validate_upload` (~129 tokens)

DRY-RUN before deploy_app/update_app/build_image. Checks file count, bytes, missing required paths, template-default fills, and placeholder garbage — without starting a Cloud Build. Call this when unsure the files map is complete.

Input parameters:

- `appName` (string)
- `files` (object, required): Same files map you would pass to deploy_app
- `mergeMode` (string): strict (default): reject missing required files and placeholder garbage. scaffold: fill omitted scaffold files from template defaults (emits warnings).
- `templateId` (string, required): From list_templates (e.g. webapp-static)

### `build_image` (~258 tokens)

USE ONLY when you want to build a container image WITHOUT creating a deployment. For normal shipping, prefer deploy_app instead (build + deploy in one step). Call this if you need to verify the image builds successfully before deploying, or if you plan to deploy the image manually later. After calling, poll get_build_status until SUCCESS. Prefer validate_upload first.

Input parameters:

- `appName` (string, required): Application name — becomes part of the Artifact Registry image tag
- `buildCommand` (string): Override template default (webapp-static: npm run build)
- `dockerfileContent` (string): Only if you need a custom Dockerfile instead of buildpacks
- `files` (object, required): Complete local project files (path → content). Must include required paths (see list_template_files). Omit package-lock.json. Test with npm run build locally first.
- `mergeMode` (string): strict (default): reject missing required files and placeholder garbage. scaffold: fill omitted scaffold files from template defaults (emits warnings).
- `startCommand` (string): Override template default (webapp-static production: npm start → serve -s dist)
- `templateId` (string, required): From list_templates (e.g. webapp-static). Required — provides build defaults.

### `get_build_status` (~140 tokens)

Optional debug tool for Cloud Build progress. Prefer polling get_app_status(deploymentId) after deploy_app/update_app — the server auto-promotes BUILDING → Akash deploy when the build succeeds. Use this when you only have a buildId (e.g. after build_image) or need build-level detail. On FAILURE, returns failureSummary and buildLogTail when available.

Input parameters:

- `buildId` (string, required): buildId from build_image, deploy_app, or file-based update_app response
- `deploymentId` (string): Optional. If omitted and this build belongs to a BUILDING deployment, the server still auto-starts Akash deploy on SUCCESS.

### `deploy_app` (~422 tokens)

PRIMARY SOURCE DEPLOY TOOL — call when the app is built/tested locally and ready to ship. Prefer validate_upload first. Uploads files + templateId (mergeMode=strict by default: upload-as-is — never injects starter Tailwind/PostCSS/React files; requires package.json + index.html and that the HTML entry's local imports resolve). Framework-agnostic SPA. Returns uploadSummary + warnings. Next: poll get_app_status until ACTIVE and httpReady=true, then share proxyUri. Apps are unlisted by default (live URL still works); pass listOnStore=true or call set_app_listing to appear on the App Store. Omit package-lock.json. Use deploy_image for prebuilt images. See prompt deploy_app_guide.

Input parameters:

- `appName` (string, required): Unique app name used for the image tag and My Apps
- `buildCommand` (string): Override template build command if needed
- `description` (string): Short description shown on the app listing when listed
- `dockerfileContent` (string): Custom Dockerfile — omit to use Google Cloud Buildpacks
- `files` (object, required): Complete local project files including all required paths (list_template_files). Omit package-lock.json. Must pass local npm run build first.
- `imageUrl` (string): Preview/thumbnail URL for the app card in the store
- `listOnStore` (boolean): If true, list this app on the public App Store. Default false (unlisted; proxyUri still works).
- `mergeMode` (string): strict (default): reject missing required files and placeholder garbage. scaffold: fill omitted scaffold files from template defaults (emits warnings).
- `port` (number): Container listen port (webapp-static default: 3000)
- `startCommand` (string): Override production start (webapp-static default: npm start → serve -s dist). Do not use vite preview for production.
- `templateId` (string, required): From list_templates (e.g. webapp-static). Must match how the app was scaffolded.

### `deploy_image` (~287 tokens)

CALL THIS WHEN YOU ALREADY HAVE A PUBLIC DOCKER/OCI IMAGE and want to deploy it to devnet without uploading source files or running Cloud Build. Requires dockerImage + appName. Use deploy_app instead when the agent has local source files and wants ShipDapp to build the image. Guardrails apply: max active deployments, daily limit, duplicate appName blocked, hourly deploy rate limit, cooldown. Returns deploymentId, network=devnet, dockerImage. Apps are unlisted by default; pass listOnStore=true or call set_app_listing to appear on the App Store. Next step: poll get_app_status until ACTIVE and share proxyUri.

Input parameters:

- `appName` (string, required): Unique app name shown in My Apps
- `description` (string): Short description shown on the app listing when listed
- `dockerImage` (string, required): Public container image URI, e.g. ghcr.io/acme/my-app:latest or docker.io/library/nginx:alpine
- `imageUrl` (string): Preview/thumbnail URL for the app card in the store
- `listOnStore` (boolean): If true, list this app on the public App Store. Default false (unlisted; proxyUri still works).
- `port` (number): Container listen port (default: 3000)
- `startCommand` (string): Optional command override if the image needs one

### `update_app` (~261 tokens)

CALL THIS WHEN AN APP IS ALREADY DEPLOYED and you want to push new code or change config. Pass files + templateId to rebuild (same strict upload rules as deploy_app — prefer validate_upload first), OR pass dockerImage alone to redeploy an existing image. Do NOT use deploy_app for updates. Blocked while status is DEPLOYING — wait and poll get_app_status. After calling, poll until ACTIVE and httpReady=true.

Input parameters:

- `appName` (string): Rename the app (optional)
- `buildCommand` (string)
- `deploymentId` (string, required): Existing deployment ID from deploy_app or list_apps
- `description` (string): Update the app description (optional)
- `dockerImage` (string): Pre-built image URI — use instead of files when image is already built
- `files` (object): New local files — triggers a cloud rebuild before redeploying
- `mergeMode` (string): strict (default): reject missing required files and placeholder garbage. scaffold: fill omitted scaffold files from template defaults (emits warnings).
- `port` (number): Change container port (optional)
- `startCommand` (string)
- `templateId` (string): Required when files is provided — same template used originally

### `get_app_status` (~106 tokens)

PRIMARY STATUS POLL after deploy_app, update_app, or deploy_image. Poll every 10–20s until status is ACTIVE and httpReady is true (then share proxyUri), or FAILED (read lastError / buildLogTail). ACTIVE alone can still mean HTTP 503 while the process starts — wait for httpReady. On FAILED, buildLogTail may be attached automatically.

Input parameters:

- `deploymentId` (string, required): deploymentId from deploy_app response, or pick from list_apps

### `list_apps` (~58 tokens)

CALL THIS to see all your deployed apps (listed and unlisted), find a deploymentId, or check which apps are ACTIVE vs DEPLOYING. Use before update_app, set_app_listing, or close_app when you don't know the deploymentId.

### `set_app_listing` (~96 tokens)

CALL THIS to list or unlist an existing app on the public App Store. Unlisted apps stay reachable via proxyUri if you know the URL. Use list_apps to find deploymentId. Does not change the live deployment.

Input parameters:

- `deploymentId` (string, required): deploymentId from deploy_app, deploy_image, or list_apps
- `listed` (boolean, required): true = appear on App Store; false = unlisted (private from discovery)

### `close_app` (~94 tokens)

CALL THIS WHEN PERMANENTLY SHUTTING DOWN an app — stops the Akash lease, frees resources, and marks the deployment DELETED. This is irreversible for that deploymentId. Use list_apps first if you don't know the ID. Do NOT use this for updates — use update_app instead.

Input parameters:

- `deploymentId` (string, required): deploymentId to tear down (from deploy_app, get_app_status, or list_apps)

### `get_logs` (~175 tokens)

CALL THIS WHEN SOMETHING WENT WRONG or you need to debug. type=build + buildId: after FAILURE — returns failureSummary and inline buildLogTail when Cloud Logging is available (else logUrl). type=runtime: container stdout/stderr from Akash when ACTIVE; on provider HTTP errors, returns a clear message plus lastError fallback. Runtime logs are NOT available until the deployment has an Akash lease.

Input parameters:

- `buildId` (string): Required when type=build — from deploy_app or build_image response
- `deploymentId` (string, required): deploymentId from deploy_app or list_apps
- `tail` (number): Max approximate log lines for runtime logs (default 500)
- `type` (string): build = GCB build logs (needs buildId). runtime = live container logs (needs ACTIVE deployment)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse#diagnostics

## Score history

- 2026-08-03: 57
- 2026-08-02: 57
- 2026-08-01: 56
- 2026-07-31: 56
- 2026-07-30: 60
- 2026-07-29: 59
- 2026-07-28: 59
- 2026-07-27: 58
- 2026-07-26: 57

## Links

- Remote endpoint: https://api.shipdapp.com/api/mcp/sse
- Authorisation metadata: https://api.shipdapp.com/.well-known/oauth-protected-resource/api/mcp/sse
- Repository: https://github.com/yash1ts/shipdapp
- Website: https://shipdapp.com/
- Changelog RSS feed: https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse/changelog.json
- HTML version of this page: https://verifymcp.io/servers/yash1ts-shipdapp/api-mcp-sse