Shipcheck MCP
About
MCP server for read-only Shipcheck launch-risk scans on authorized JavaScript and TypeScript repos
Details
- Author
- TateLyman
- Downloads
- 107
- Categories
- Developer Tools, Security, Other
Jump to
- Scans repos for over a dozen common launch risks
- Defensive static analysis – reads files, does not modify or execute code
- No network access required
- Multiple output formats: text, markdown, JSON, SARIF
- Configurable severity thresholds (info/low/medium/high) and strict mode
- Designed for JavaScript and TypeScript projects
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Shipcheck MCPCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Run directly with npx --yes shipcheck-mcp. Add the server to an MCP client's stdio configuration using command: "npx" and args: ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]. Once configured, invoke the scan_repository tool with parameters such as root, format, failOn, and strict.
scan_repository
Run read-only Shipcheck static analysis on an authorized local JavaScript, TypeScript, or MCP repository. Use before launch, directory submission, or client handoff to find exposed environment values, unsigned webhook handlers, missing database-rule evidence, debug leftovers, dependency risk, weak CI/docs, and usage-cost guardrail gaps. The tool reads project files, does not modify the repository, does not execute project code, and does not require network access. It returns both a formatted report and structured findings with severity, file path, and remediation.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"shipcheck mcp": {
"shipcheck": {
"command": "npx",
"args": [
"--yes",
"--package",
"shipcheck-mcp",
"shipcheck-mcp"
]
}
}
}
}McpServers
{
"shipcheck": {
"command": "npx",
"args": [
"--yes",
"--package",
"shipcheck-mcp",
"shipcheck-mcp"
]
}
}MCP server that lets local MCP clients runShipcheckon authorized JavaScript and TypeScript repositories.
Shipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.
Tool page:https://tateprograms.com/shipcheck.html
Free MCP launch self-check:https://tateprograms.com/mcp-self-check.html
MCP directory launch checklist:https://tateprograms.com/mcp-directory-checklist.html
Paid MCP launch check:https://tateprograms.com/mcp-launch-review.html
Official MCP Registry:https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck
Add this server to an MCP client that supports stdio servers:
{ "mcpServers": { "shipcheck": { "command": "npx", "args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"] } } }
STDIO MCP client config launches a local command. Review thecommand,args, and anyenvvalues before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.
{ "root": ".", "format": "markdown", "failOn": "medium", "strict": true }
Formats:text,markdown,json, orsarif.
Severities:info,low,medium, orhigh.
Shipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Provides AI agents with access to development best practices, security guidelines, and coding standards.
An intelligent security agent that analyzes AI-generated code for vulnerabilities and assists with remediation.
AI code security scanner with 100 built-in rules covering OWASP Top 10 and CWE Top 25
Zephex is a hosted MCP gateway built for AI coding editors. It gives your agent 10 ready-to-use tools — check npm packages for vulnerabilities, audit security headers, read and search code, trace request flows, get project context from any repo, and more. One API key, works instantly with Claude Code, Cursor, VS Code, Windsurf, and others. Free to start at zephex.dev.
Zephex is a hosted MCP gateway built for AI coding editors. It gives your agent 10 ready-to-use tools — check npm packages for vulnerabilities, audit security headers, read and search code, trace request flows, get project context from any repo, and more. One API key, works instantly with Claude Code, Cursor, VS Code, Windsurf, and others. Free to start at zephex.dev.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Enable AI agents to secure code with Semgrep.
AI-to-AI code review platform — Claude, Codex, and Gemini cross-check each other via MCP, REST API, and CLI for consensus-based results.
An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.
A stateful LSP runtime for AI agents: warm language server sessions with 50+ tools for go-to-definition, find-references, diagnostics, rename, and more across 30+ languages.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
