Ship code that’s
actually safe.
ShipSafe checks JavaScript, TypeScript, and Python for vulnerabilities, exposed secrets, and AI environment threats. Start locally with one command.
See It In Action
See a scan and fix in action.
An illustrative terminal walkthrough: find a hardcoded secret, review an auto-fix, and scan again.
Free Online Scanner
Scan any repo before installing
Paste a GitHub URL and get a security report in seconds. No install required.
Scan a Repo Now- Vulnerability rules
- 1,062
- Secret patterns
- 174
- MCP tools
- 8
- CLI requirement
- Node 20+
Built-in coverage in CLI v1.4.0. Rule counts describe checks, not a guarantee of detection.
Features
Everything you need to ship safely.
From first scan to production monitoring, ShipSafe covers your entire development lifecycle.
One-Command Scanning
Built-in vulnerability and secret checks in one command. Add installed Semgrep, Gitleaks, or Trivy scanners for extra local coverage.
$ shipsafe scan --scope allKnowledge Graph Engine
Builds a call graph of your codebase to find attack paths, missing auth, and tainted data flows that pattern matching can’t see.
✓ 0 attack paths, 0 missing authAuto-Fix
Hardcoded secrets? ShipSafe moves them to .env automatically. One flag: --fix. No manual work.
$ shipsafe scan --fixPrompt Injection Detection
7 rules catch unsafe LLM patterns: user input in system prompts, unsanitized RAG context, missing input limits, and more.
CRITICAL: User input in system role messageMCP Server
8 tools for Claude, Cursor, and other AI coding assistants. Security insights directly in your AI workflow.
$ shipsafe mcp-serverProduction Monitoring
Lightweight snippet captures errors and performance data. PII scrubbing built in. Auto-disables on failure.
import { init } from '@shipsafe/monitor'Image Metadata Stripping
GPS coordinates, camera serial numbers, timestamps — silently stripped from every image you commit. Zero quality loss.
Powered by MetaStrip→MetaStrip: Stripped 3 images (zero quality loss)Git Hooks
Pre-commit scanning catches issues before they land. Installs in one command. Blocks secrets from ever reaching your repo.
$ shipsafe setup --hooksIntegrations
Works with your stack.
Skip permissions.
Not security.
We get it — you run with --dangerously-skip-permissions because saying yes 400 times is not the vibe. ShipSafe’s git hooks run outside the AI — no prompt needed, no permission required. Your code gets scanned on every commit, whether you’re in YOLO mode or not.
Without ShipSafe
With ShipSafe
Privacy & Security
Choose where your scan runs.
Use the CLI for local analysis or the website for a quick check of public code.
Local source analysis
CLI vulnerability and secret analysis runs on your machine. Use it for private repositories and sensitive source code. Dependency advisory checks can contact npm.
A separate web scanner
The online scanner processes public repositories and pasted text on our server. Temporary scan files are removed after processing. Do not paste private keys or confidential source.
Inspect Everything
@shipsafe/monitor is MIT licensed. The CLI runs from source you can read. PII is scrubbed locally before any optional monitoring data leaves your machine.
Find your workflow
Security tools work better together.
ShipSafe brings local checks, git hooks, and AI environment scanning into your development loop. Compare approaches against the needs of your project.
ShipSafe and Semgrep
Custom static-analysis rules and team scanning workflows
ShipSafe and Snyk
An application security platform across code, dependencies, containers, and IaC
ShipSafe and SonarQube
Code quality, security analysis, and quality gates
ShipSafe and CodeQL
Semantic code analysis with findings in GitHub code scanning
How It Works
Three steps to secure code.
Install
One command. No config files, no setup wizards.
npm install -g @shipsafe/cliScan
Run on staged files or your entire project.
shipsafe scan --scope allShip
Review findings, apply fixes, and scan again.
shipsafe scan --scope allPricing
Simple, fair pricing.
Free
Perfect for solo developers and side projects.
- ✓Built-in vulnerability and secret scanning
- ✓1 project
- ✓Pre-commit hooks
- ✓Community support
Pro
For developers who ship to production.
- ✓Everything in Free
- ✓Knowledge graph engine
- ✓Auto-fix (--fix)
- ✓Production monitoring
- ✓MCP server for AI assistants
- ✓5 projects
Team
For teams that need visibility and control.
- ✓Everything in Pro
- ✓GitHub App (PR scanning)
- ✓Source map upload
- ✓20 projects
- ✓Priority support
FAQ
Straight answers before you scan.
What is ShipSafe?
ShipSafe is a security scanner for JavaScript, TypeScript, and Python projects. The CLI checks source code for vulnerability patterns and hardcoded secrets; scan-environment checks AI assistant configurations for suspicious instructions.
How do I install and run ShipSafe?
Install Node.js 20 or later, run npm install -g @shipsafe/cli, then run shipsafe scan --scope all in your project. Use shipsafe scan-environment to check your AI environment. Review each finding before applying fixes.
Is my source code sent to ShipSafe servers?
Local CLI source analysis runs on your computer. The website scanner downloads a public repository or receives the text you submit and processes it on our server. Use the CLI for private code and secrets. Dependency advisory checks contact npm; optional monitoring and license features also use network services.
What does the online scanner check?
It performs static vulnerability-pattern, secret, and environment checks without running the submitted code or installing repository dependencies. Dependency advisories are best effort. Web limits are 500 KB of pasted text, a 15 MB compressed repository, 75 MB extracted, 5 MB per file, and 10,000 archive entries. Large projects should use the CLI.
Does a clean report guarantee that code is safe?
No. Automated analysis can miss vulnerabilities and report false positives. Review findings, test your application, keep dependencies current, and use appropriate access controls. A scan complements code review and runtime security.
Do I need Semgrep, Gitleaks, or Trivy installed?
No. ShipSafe includes built-in secret, vulnerability-pattern, and dependency checks. If Semgrep, Gitleaks, or Trivy are available locally, the CLI can use them for additional coverage.
Can I use ShipSafe with an AI coding assistant?
Yes. Run shipsafe mcp-server to expose eight tools to an MCP-compatible assistant. Tools cover scans, environment checks, package checks, findings, and production-error workflows. Some features depend on your plan and configuration.
Can I scan an existing codebase?
Yes. Run shipsafe scan --scope all for a full scan. To focus future scans on newly introduced issues, review existing findings and use shipsafe baseline. A baseline suppresses known findings; it does not fix them.
Ready to ship safely?
Install in 10 seconds. No account required. Free forever for solo projects.
Shape the product
What should we build next?
ShipSafe is built for developers who ship fast. Tell us what’s missing.