Skip to content
Now with knowledge graph security analysis

Ship code that’s
actually safe.

Security scanning, auto-fix, and production monitoring — all from your terminal. One command. Zero config.

See It In Action

From vulnerable to secure in 30 seconds.

Watch ShipSafe find real vulnerabilities, auto-fix a hardcoded secret, and deliver a clean security score.

~/my-project

0+

Detection rules

0

Files scanned

0.0s

Avg. scan time

0

Security engines

Trusted by teams shipping fast

ACMETERRAFORMSHIPYARDHARBORCLOUDFLEET

Testimonials

Loved by developers who ship fast.

I was mass-producing API keys in my env files like a factory. ShipSafe caught 12 hardcoded secrets in my first scan and moved them all to .env in seconds.

Marcus Chen

Full-Stack Developer

The MCP server is a game-changer. Claude now checks security while I’m writing code instead of after. It’s like having a security engineer on the team for free.

Sarah Okonkwo

Indie Maker

Snyk wanted $100/month for my side project. ShipSafe does more and the free tier actually works. The knowledge graph found a SQL injection that pattern matching missed.

David Park

Solo Founder

Features

Everything you need to ship safely.

From first scan to production monitoring, ShipSafe covers your entire development lifecycle.

One-Command Scanning

Wraps Semgrep, Gitleaks, and Trivy into a single shipsafe scan. Secrets, vulnerabilities, and misconfigurations — caught before they ship.

$ shipsafe scan --scope all

Knowledge Graph Engine

Builds a call graph of your codebase to find attack paths, missing auth, and tainted data flows that pattern matching can’t see.

✓ 0 attack paths, 0 missing auth

Auto-Fix

Hardcoded secrets? ShipSafe moves them to .env automatically. One flag: --fix. No manual work.

$ shipsafe scan --fix

Prompt Injection Detection

7 rules catch unsafe LLM patterns: user input in system prompts, unsanitized RAG context, missing input limits, and more.

CRITICAL: User input in system role message

MCP Server

7 tools for Claude, Cursor, and other AI coding assistants. Security insights directly in your AI workflow.

$ shipsafe mcp-server

Production Monitoring

Lightweight snippet captures errors and performance data. PII scrubbing built in. Auto-disables on failure.

import { init } from '@shipsafe/monitor'

Git Hooks

Pre-commit scanning catches issues before they land. Installs in one command. Blocks secrets from ever reaching your repo.

$ shipsafe setup --hooks

Integrations

Works with your stack.

Node.jsTypeScriptJavaScriptPythonReactNext.jsExpressHonoFastify
$claude --dangerously-skip-permissions

Skip permissions.
Not security.

We get it — you run with --dangerously-skip-permissions because saying yes 400 times is not the vibe. ShipSafe’s git hooks run outside the AI — no prompt needed, no permission required. Your code gets scanned on every commit, whether you’re in YOLO mode or not.

Without ShipSafe

AI writes code with hardcoded secrets
SQL injection? Committed and pushed
Prompt injection in your AI endpoints
You find out in production

With ShipSafe

AI writes code freely — no interruptions
Git hook scans before commit — blocks threats
64 vuln rules + 174 secret patterns
Nothing dangerous ships. Ever.

Privacy & Security

Your code. Your data. Your control.

Source Code Never Leaves Your Machine

All scanning and analysis runs locally. Zero data transmitted.

Automatic PII Scrubbing

Emails, credit cards, SSNs, and IPs stripped from all monitoring data.

Open Source Monitor

@shipsafe/monitor is MIT licensed. Inspect every line.

Comparison

How ShipSafe compares.

ShipSafe

One-command setup
Runs locally (code never leaves)
Knowledge graph analysis
Auto-fix secrets
MCP server for AI assistants
Production monitoring
Free tier: Forever · $0–49/mo

Snyk

One-command setup
Runs locally (code never leaves)
Knowledge graph analysis
Auto-fix secrets
MCP server for AI assistants
Production monitoring
$25–100+/mo

SonarQube

One-command setup
Runs locally (code never leaves)
Knowledge graph analysis
Auto-fix secrets
MCP server for AI assistants
Production monitoring
$150+/mo

DIY / Nothing

One-command setup
Runs locally (code never leaves)
Knowledge graph analysis
Auto-fix secrets
MCP server for AI assistants
Production monitoring
$0

How It Works

Three steps to secure code.

1

Install

One command. No config files, no setup wizards.

npm install -g @shipsafe/cli
2

Scan

Run on staged files or your entire project.

shipsafe scan --scope all
3

Ship

Score A means you're good to go.

Score: A ✓ Ship it.

Pricing

Simple, fair pricing.

Free

$0/mo

Perfect for solo developers and side projects.

  • Pattern scanning (Semgrep, Gitleaks, Trivy)
  • 1 project
  • Pre-commit hooks
  • Community support
Get Started Free
Most Popular

Pro

$19/mo

For developers who ship to production.

  • Everything in Free
  • Knowledge graph engine
  • Auto-fix (--fix)
  • Production monitoring
  • MCP server for AI assistants
  • 5 projects
Start Pro Trial

Team

$49/mo

For teams that need visibility and control.

  • Everything in Pro
  • GitHub App (PR scanning)
  • Source map upload
  • 20 projects
  • Priority support
Contact Sales

FAQ

Common questions.

Ready to ship safely?

Install in 10 seconds. No account required. Free forever for solo projects.

$npm install -g @shipsafe/cli