Ship safe. Find risky code before it merges.

Ship Safe scans the agents, MCP servers, and AI code your app actually runs — locally, in one command.

Public repositories only. No account or API key required.

Create an account Run locally
0 GitHub stars0 npm downloadsMIT licensed29 security agents
Ship Safe dashboard showing security score, scan activity, open findings, and agent security coverage
Scanning the stack you already ship on
AnthropicOpenAIMCPVercelSupabaseStripeCursor
29security agentsOWASPAgentic AI Top 10 mappedMITopen source

npm installs per day

7-day trailing average · 3 Feb 2026 – 6 Sept 2026
api.npmjs.org
0150300239/dayFebMarAprMayJunJulAugSep
20,952 installs in the last twelve months, from a standing start. Daily counts are noisy, so the line is a trailing average — and npm reports through 6 Sept 2026, not today.

Coverage that follows the attack surface.

Start with the checks that matter to your application, agent runtime, and release process.

Secrets and credentials

Catch exposed keys and tokens before they reach a repository.

Dependencies and supply chain

Surface vulnerable packages and risky install defaults.

MCP and tool calls

Review transports, allowlists, and agent tool boundaries.

LLM and prompt risks

Trace untrusted input into prompts, models, and tool calls.

CI and release gates

Turn findings into checks and thresholds your pipeline enforces.

AI red teaming

Probe agent behaviour with adversarial scenarios when you need depth.

Coverage across OWASP Agentic Applications 2026

29 agents mapped to ASI01–ASI10
owasp asi 2026
ASI01Planning & reasoning manipulation3ASI02Tool misuse4ASI03Identity & privilege abuse3ASI04Agent supply chain4ASI05Unsafe code execution4ASI06Memory & context poisoning2ASI07Inter-agent communication2ASI08Cascading agent failures2ASI09Human-agent trust exploitation2ASI10Rogue agents3
The ten categories are the published OWASP taxonomy, so you can check them against the standard rather than taking our word for the shape. Which agent answers which category is our mapping. See the full standards coverage.

Every check, on a corpus you can run yourself.

The benchmark is twelve paired scenarios — one vulnerable case and one safe control each. Twelve is a small corpus, so here are all twelve rather than a percentage.

Detection across the paired corpus

12 scenarios · corpus v1.0.0 · Ship Safe v9.5.2
data/benchmark-results.json
VULNERABLE CASESAFE CONTROLInjectionInjectionTesterdetectedcleanAuthenticationAuthBypassAgentdetectedcleanSSRFSSRFProberdetectedcleanAPIAPIFuzzerdetectedcleanLLMLLMRedTeamdetectedcleanMCPMCPSecurityAgentdetectedcleanAgentic AIAgenticSecurityAgentdetectedcleanRAGRAGSecurityAgentdetectedcleanHermesHermesSecurityAgentdetectedcleanModel supply chainModelScanAgentdetectedcleanPackage supply chainInstallGuardAgentdetectedcleanSocial engineeringClickFixAgentdetectedclean
Each row runs one agent against a vulnerable fixture, then against its safe control. This measures scenario detection on a first-party corpus, not real-world precision. Read the methodology and limitations.

One security workflow. Clear decisions.

Ship Safe meets developers where the work already happens, then turns a noisy scan into a decision your team can act on.

01

Scan where your code lives.

Run one command against a local repository. No account, API key, or upload is required for the core scan.

  • Local-first by default
  • One command to start
  • CI-ready output
Run your first scan
Ship Safe CLI scanning a repository
02

See what matters first.

Move past a flat list of warnings. Findings are grouped by severity, confidence, and the context that makes them actionable.

  • Prioritized risk, not just rule matches
  • Security score and clear context
  • Remediation guidance for the next commit
Ship Safe scan results ranked by risk

Findings by severity

juice-shop · 85 findings · security score 32/100
one example scan
6 critical62 high12 medium5 low
Ranking is the point: one scan, and high severity accounts for most of what came back.
03

Stop risky changes before merge.

PR Guardian puts the finding, affected code, and fix guidance inside the review your team is already reading.

  • Pull-request checks and release gates
  • Inline findings with fix guidance
  • SARIF output for security workflows
Explore PR Guardian
Ship Safe PR Guardian configuration
Pull request review

Reviewed before it merges.

Open a pull request and Ship Safe posts one comment containing two reviews: the deterministic scan, and a Kimi K3 read of the same diff for the judgement calls a rules engine cannot make.

Ship Safe review · pull request #65
Secrets            0
Vulnerabilities    0
Changed-file scan  100/100 (A)

### Kimi K3 triage
Docs-only PR adding a paragraph documenting the large-repository
scan limit. No deterministic candidate findings were supplied and
no executable code changed, so there is nothing to confirm or
dispute.

> Advisory context only (high confidence). The Ship Safe scan
> remains the source of truth.

  • The scanner stays the source of truth

    Deterministic findings run on every pull request and remain authoritative. Kimi comments alongside them and can dispute a finding in writing — it cannot suppress one.

  • Ten reviews free, for the life of the account

    Not a trial that expires. Paid plans continue past the allowance, and running out never affects your deterministic scans.

  • A failed review costs nothing

    If the model call fails, times out, or returns nothing, the credit goes back and the comment says what happened.

How the review works

Protect the systems your agents touch.

Security does not end at the repository. Review agent orchestration, tool permissions, and long-context behavior before they become production incidents.

Read the security model
Agent orchestration

Run security agents as a team, not a queue.

Specialized agents hand work to each other with explicit boundaries, so each one sees the context it needs and nothing more.

  • Explicit handoffs between agents
  • Scoped context per agent
  • Deploy from a template in one step
Explore Hermes
Threat intelligence

New advisories, mapped to your stack.

Fresh CVEs and exploit context arrive already connected to the technologies you actually ship, so triage starts with what applies to you.

  • Live advisory and exploit feeds
  • Matched to your dependencies
  • Findings linked to the affected file
See the dashboard
Test the boundary, too.Probe tool calls, long-context behavior, and agent limits with adversarial analysis.
$ npx ship-safe red-team . --no-aiSee the red-team workflow

Built for the people shipping AI.

One tool for the developer at the keyboard, the team operating agents, and the security lead setting the bar.

Developers

Catch the risky default before it becomes a review comment or a production incident.

Run locally

AI builders

Understand how agents, MCP servers, tools, and model integrations change your attack surface.

Explore agent security

Security teams

Give every repository a repeatable baseline with evidence that fits existing CI workflows.

See the security model
Public feedback

What builders are saying

Interesting!
TekniumCofounder and Lead Engineer, Hermes Agent at Nous Research
scanning agent configs for vulnerabilities before deploy is exactly the gap in the current toolchain. most teams don't even audit their MCP tool permissions until something breaks in prod. security-left for agents is a real market.
Saeed AnwarBuilder
22 parallel agents for security is wild. i've been chaining agents for prompt debugging and even 2 talking to each other gets chaotic. curious how they handle conflict when agent 12 says safe and agent 17 says vulnerable.
Youssef Toufik@im_ytoufik
Ship Safe v9.7.4 should make MCP findings replayable: package version, scanner rule, tool name, permission edge, diff path, severity, and fix verdict. Agents can refuse a risky tool call before the risky code becomes a weekend.
Axiom@AxiomBot
Treating existing issues as baseline and focusing on regressions sounds practical
Kumuj@KumujJain
Ship Safe looks like exactly what solo devs need!
Helder Perez@helderbuilds
super useful tool!
Krish@krishcdbry
This is nuts!! haha
kavokie@KavokieKavokie
This is awesome Abbaas! finding vulns ahead of attackers is the real muscle for today
PrismorAI agent security platform
The useful part here is parallelizing the boring checks without losing a single output surface. Security tooling usually dies in handoff hell. If this keeps findings readable, that's the win.
Gerald Sterling@geraldrsterling
this is a real and nasty vulnerability. glad someone's finally building a proper open source scanner for it.
Pranav Malhotra@PranavMalhlz
approval gates are a lifesaver... learned that the hard way when my bot almost posted something wild during testing
Johnny Nel@johnnynelai
That’s the part that matters. Faster models only help if the workflow doesn’t eat the savings.
Devin Kairo@DevinC743
Love ship-safe, locking down MVPs with style
Finance Wisdom@Financewisdom01
You're doing an awesome job for the dev community!
Prismor@prismor_dev
Impressive
John Shina@JohnShina91

Public posts shown with attribution. Select a card to view the original post on X. Hover or focus a card to stop the row.

Start free. Upgrade when the workflow grows.

The scanner stays free. Paid plans add the hosted tools that help teams keep moving.

Free CLI$0/forever

Unlimited local scans and CI-ready security output.

  • Unlimited local scans
  • All 29 security agents
  • 10 lifetime Kimi PR review credits
  • SARIF and CI output
  • MIT licensed, no account needed
Run locally
ProMost popular$9/month

Hosted history, private repos, reports, and PR Guardian.

  • Everything in Free
  • Unlimited cloud scans
  • Private repositories
  • Scan history and score trends
  • PR Guardian checks and comments
  • Branded PDF reports
Start Pro
Team$19/mo per seat

Shared visibility for teams that review each other’s code.

  • Everything in Pro
  • Shared team workspace
  • Role-based access
  • Slack and webhook alerts
  • Aggregate team score
  • Audit log
Start Team
Compare every plan and feature

It reads what your agents already run on.

Ship Safe works against the config that is in the repository — no runtime agent, no proxy, nothing to install in production.

Claude Code

Scans agent definitions, permission policies, and hooks before they run.

.claude/ · settings.json
MCP servers

Checks transports, allowlists, and tool permissions across every configured server.

mcp.json · server configs
GitHub Actions

Runs in CI with threshold gating, and posts findings straight onto the pull request.

ship-safe ci --threshold
Cursor & Codex

Reviews the rules, prompts, and generated code that AI editors leave in the repository.

.cursor/rules · AGENTS.md
OpenClaw

Hardens configs automatically, and scans a skill before you install it.

ship-safe scan-skill
SARIF & security tools

Exports findings to the GitHub Security tab or any SARIF-aware pipeline.

--format sarif

The short answers.

Does Ship Safe work without an API key?
Yes. Core scans run locally without an API key. AI-backed analysis is optional and can be skipped with --no-ai.
Is my code sent to an LLM?
Only in provider-backed modes. Use --no-ai to keep scanning fully local. See the security and data-flow details.
Is the CLI free?
Yes. The CLI is MIT open-source and free for local scans. Free accounts also include 10 lifetime Kimi PR review credits. Paid plans add more hosted PR reviews, history, private repositories, and reports.

Help build security for AI-assisted development.

Ship Safe is MIT open source. Add agents, MCP rules, fixtures, docs, CI examples, and dashboard improvements.

Pick a good first issueRead contributor guide

Find the risk before your users do.

Run locally for free, then add the cloud when your team needs history and automation.

$npx ship-safe scan
Start free scanView pricingRead the guide