English Français العربية

Shipcheck MCP

Official registry Other

Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package shipcheck-mcp
Claude Code 
claude mcp add shipcheck-mcp -- npx -y shipcheck-mcp@0.1.12
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "shipcheck-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "shipcheck-mcp@0.1.12"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. shipcheck-mcp
  2. Install
  3. MCP Config
  4. Tool
  5. Development

shipcheck-mcp

MCP server that lets local MCP clients run Shipcheck on authorized JavaScript and TypeScript repositories.

Shipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.

Tool page: https://tateprograms.com/shipcheck.html

Free MCP launch self-check: https://tateprograms.com/mcp-self-check.html

MCP directory launch checklist: https://tateprograms.com/mcp-directory-checklist.html

Paid MCP launch check: https://tateprograms.com/mcp-launch-review.html

Official MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck

Install

Run directly with npx:

npx --yes shipcheck-mcp

MCP Config

Add this server to an MCP client that supports stdio servers:

{
  "mcpServers": {
    "shipcheck": {
      "command": "npx",
      "args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
    }
  }
}

STDIO MCP client config launches a local command. Review the command, args, and any env values before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.

Tool

scan_repository

{
  "root": ".",
  "format": "markdown",
  "failOn": "medium",
  "strict": true
}

Formats: text, markdown, json, or sarif.

Severities: info, low, medium, or high.

Shipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.

Development

npm install
npm run check

Frequently asked questions

What is Shipcheck MCP?

Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.

How do I install Shipcheck MCP?

It runs on your machine. In Claude Code: claude mcp add shipcheck-mcp -- npx -y shipcheck-mcp@0.1.12. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Shipcheck MCP need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Shipcheck MCP open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains Shipcheck MCP?

It is published by TateLyman. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.