MCP Server Reference
ShipSafe includes an MCP (Model Context Protocol) server with 8 tools that integrate directly with Claude Code, Cursor, Windsurf, and any MCP-compatible AI coding assistant.
Setup
Add ShipSafe to your MCP configuration. For Claude Code, add to .mcp.json in your project or ~/.claude/claude_desktop_config.json globally:
{
"mcpServers": {
"shipsafe": {
"command": "shipsafe",
"args": ["mcp-server"]
}
}
}For Cursor and Windsurf, add the same configuration to their respective MCP config files. See the Cursor integration guide for step-by-step instructions.
shipsafe_scan
Run a full security scan on the current project or a specific directory. Returns all findings with severity, location, and fix suggestions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| path | string | No | Directory to scan. Defaults to current working directory. |
| severity | string | No | Minimum severity to report: critical, high, medium, low. |
| format | string | No | Output format: text or json. |
Example Prompt
Use the shipsafe_scan tool to check this project for security issues.
Example Result
Scanned 47 files in 2.3s 2 findings: HIGH sql-injection/template-literal-in-query src/routes/users.ts:12 MEDIUM auth/missing-csrf-protection src/routes/api.ts:8
shipsafe_status
Check ShipSafe installation status, version, license tier, and project configuration. Useful for verifying setup.
Example Prompt
Use shipsafe_status to check if ShipSafe is properly configured.
Example Result
ShipSafe v1.0.6 License: Free Hooks: installed Baseline: set (47 suppressed findings) Config: shipsafe.config.json found
shipsafe_check_package
Check an npm package for known vulnerabilities, suspicious scripts, and typosquatting risk before installing it.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| package | string | Yes | Package name to check (e.g., 'express' or 'express@4.18.0'). |
Example Prompt
Before installing, use shipsafe_check_package to check "sketchy-formatter" for issues.
Example Result
Package: sketchy-formatter@1.2.0 WARNING Suspicious postinstall script detected Downloads and executes remote code from external server. WARNING Low download count (23/week) Package may be a typosquatting attempt. Recommendation: Do not install.
shipsafe_scan_environment
Scan the development environment for threats: malicious MCP servers, prompt injection in CLAUDE.md, credential theft hooks, and suspicious npm scripts.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| path | string | No | Project directory to scan. Defaults to current working directory. |
Example Prompt
Use shipsafe_scan_environment to check this cloned repo for environment threats.
Example Result
Scanning development environment... CRITICAL env/credential-theft-hook .git/hooks/pre-commit:3 Git hook exfiltrates environment variables. 1 finding (1 critical)
shipsafe_scan_file
Scan a single file for vulnerabilities. Faster than a full scan when you just modified one file.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| file | string | Yes | Path to the file to scan. |
Example Prompt
Scan src/routes/chat.ts for security issues using shipsafe_scan_file.
Example Result
Scanning src/routes/chat.ts... HIGH prompt-injection/unsanitized-llm-input src/routes/chat.ts:5 User input from req.body passed directly to LLM prompt. 1 finding (1 high)
shipsafe_explain_rule
Get a detailed explanation of a specific detection rule, including what it catches, why it matters, and how to fix it.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| rule_id | string | Yes | Rule ID to explain (e.g., 'sql-injection/template-literal-in-query'). |
Example Prompt
Use shipsafe_explain_rule to explain "secrets/stripe-live-key".
Example Result
Rule: secrets/stripe-live-key
Severity: CRITICAL
Category: Hardcoded Secrets
Description: Detects Stripe live secret keys (sk_live_*) hardcoded in source code.
Stripe live keys have full access to your Stripe account including payments.
Fix: Move the key to an environment variable.
Before: const stripe = require("stripe")("sk_live_...");
After: const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY);shipsafe_baseline
Manage baselines. Create a new baseline from current findings or show baseline status.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| action | string | Yes | Action: 'create', 'show', or 'reset'. |
Example Prompt
Use shipsafe_baseline with action "create" to set the current findings as baseline.
Example Result
Baseline created. 47 findings suppressed. Future scans will only show new findings. Stored at .shipsafe/baseline.json
shipsafe_fix
Auto-fix a specific finding. Applies the recommended fix and shows the diff. Pro feature.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| file | string | Yes | File containing the finding. |
| rule_id | string | Yes | Rule ID of the finding to fix. |
| line | number | Yes | Line number of the finding. |
Example Prompt
Use shipsafe_fix to auto-fix the secrets/stripe-live-key finding in src/payments.ts at line 3.
Example Result
Fixed: secrets/stripe-live-key in src/payments.ts:3
- const stripe = require("stripe")("sk_live_4eC39HqLyjWDarjtT1zdp7dc");
+ const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY);
Added STRIPE_SECRET_KEY to .env.example