# ShipSafe

> Security scanning for JavaScript, TypeScript, and Python projects, with a local CLI and a separate free web scanner.

## Start here
- Website: https://shipsafe.org/
- Scanner: https://shipsafe.org/scan
- Install and first scan: https://shipsafe.org/docs/getting-started
- CLI reference: https://shipsafe.org/docs/cli-reference
- MCP setup: https://shipsafe.org/docs/mcp-server
- Configuration: https://shipsafe.org/docs/configuration
- Privacy: https://shipsafe.org/privacy
- Source: https://github.com/ICXCNIKAanon/shipsafe
- npm package: https://www.npmjs.com/package/@shipsafe/cli

## Verified package capabilities
CLI v1.4.0 contains 1,062 vulnerability rules, 174 secret patterns, and eight MCP tools. Requires Node.js 20 or later. Install with `npm install -g @shipsafe/cli`; run `shipsafe scan --scope all` in a project. Run `shipsafe scan-environment` for AI environment checks. Optional Semgrep, Gitleaks, and Trivy add coverage when installed.

## Processing and limits
CLI source analysis is local. Dependency advisory checks contact npm; optional monitoring and license features use network services. The online scanner processes public repositories and submitted text on the server, without executing submitted code or installing its dependencies. Temporary scan files are removed after processing. Use the CLI for private source and secrets. The site uses Vercel analytics and performance measurement.

Web limits: 500 KB pasted text, 15 MB compressed repository, 75 MB extracted, 5 MB per archive file, and 10,000 archive entries. Scan requests are rate limited. Dependency advisory checks are best effort; some file types, generated files, and large files are excluded by the scanning engines.

## Interpretation
A clean scan is not proof that code is safe. Automated checks can miss issues and generate false positives. Review findings, keep dependencies current, and test before shipping. Baselines suppress known findings; they do not remediate them. Feature access may depend on plan and configuration. See current visible pricing for available plans.