{
  "markdown": "# shipcheck-mcp\n\n[![npm version](https://img.shields.io/npm/v/shipcheck-mcp.svg)](https://www.npmjs.com/package/shipcheck-mcp)\n[![ci](https://github.com/TateLyman/shipcheck-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/TateLyman/shipcheck-mcp/actions/workflows/ci.yml)\n[![MCP Registry](https://img.shields.io/badge/MCP%20Registry-active-2ea44f)](https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck)\n[![shipcheck-mcp MCP server](https://glama.ai/mcp/servers/TateLyman/shipcheck-mcp/badges/score.svg)](https://glama.ai/mcp/servers/TateLyman/shipcheck-mcp)\n\nMCP server that lets local MCP clients run [Shipcheck](https://www.npmjs.com/package/shipcheck-cli) on authorized JavaScript and TypeScript repositories.\n\nShipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.\n\nTool page: https://tateprograms.com/shipcheck.html\n\nFree MCP launch self-check: https://tateprograms.com/mcp-self-check.html\n\nMCP directory launch checklist: https://tateprograms.com/mcp-directory-checklist.html\n\nPaid MCP launch check: https://tateprograms.com/mcp-launch-review.html\n\nOfficial MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck\n\n## Install\n\nRun directly with `npx`:\n\n```bash\nnpx --yes shipcheck-mcp\n```\n\n## MCP Config\n\nAdd this server to an MCP client that supports stdio servers:\n\n```json\n{\n  \"mcpServers\": {\n    \"shipcheck\": {\n      \"command\": \"npx\",\n      \"args\": [\"--yes\", \"--package\", \"shipcheck-mcp\", \"shipcheck-mcp\"]\n    }\n  }\n}\n```\n\nSTDIO MCP client config launches a local command. Review the `command`, `args`, and any `env` values before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.\n\n## Tool\n\n`scan_repository`\n\n```json\n{\n  \"root\": \".\",\n  \"format\": \"markdown\",\n  \"failOn\": \"medium\",\n  \"strict\": true\n}\n```\n\nFormats: `text`, `markdown`, `json`, or `sarif`.\n\nSeverities: `info`, `low`, `medium`, or `high`.\n\nShipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.\n\n## Development\n\n```bash\nnpm install\nnpm run check\n```\n",
  "bytes": 2580,
  "sha": "25c1c90ee72f67474e945c4eb8831b4a57fdaba706521f4cdc30bd7c4cee5df9",
  "repo_slug": "tatelyman/shipcheck-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tatelyman_shipcheck_mcp_2a9f248f/readme"
}