Shipcheck MCP
Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.
Open source Open in the app JSON README (API)
About
Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.
Details
- Kind
- MCP servers
- Topic
- No topic detected
- Publisher
- tatelyman
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 0.1.12
- Last push
- 2026-05-10T04:16:00Z
- Repository state
- ativo
- Language
- JavaScript
- License
- MIT
- Added
- 2026-08-29 03:02:16
- Updated
- 2026-08-29 03:02:16
- Origin id
io.github.TateLyman/shipcheck-mcp
README
# shipcheck-mcp
[](https://www.npmjs.com/package/shipcheck-mcp)
[](https://github.com/TateLyman/shipcheck-mcp/actions/workflows/ci.yml)
[](https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck)
[](https://glama.ai/mcp/servers/TateLyman/shipcheck-mcp)
MCP server that lets local MCP clients run [Shipcheck](https://www.npmjs.com/package/shipcheck-cli) on authorized JavaScript and TypeScript repositories.
Shipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.
Tool page: https://tateprograms.com/shipcheck.html
Free MCP launch self-check: https://tateprograms.com/mcp-self-check.html
MCP directory launch checklist: https://tateprograms.com/mcp-directory-checklist.html
Paid MCP launch check: https://tateprograms.com/mcp-launch-review.html
Official MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck
## Install
Run directly with `npx`:
```bash
npx --yes shipcheck-mcp
```
## MCP Config
Add this server to an MCP client that supports stdio servers:
```json
{
"mcpServers": {
"shipcheck": {
"command": "npx",
"args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
}
}
}
```
STDIO MCP client config launches a local command. Review the `command`, `args`, and any `env` values before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.
## Tool
`scan_repository`
```json
{
"root": ".",
"format": "markdown",
"failOn": "medium",
"strict": true
}
```
Formats: `text`, `markdown`, `json`, or `sarif`.
Severities: `info`, `low`, `medium`, or `high`.
Shipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.
## Development
```bash
npm install
npm run check
```