LabscoMCP early access ↗
TateLymanMCP SERVER

Shipcheck MCP

Run a launch-readiness scan over a JavaScript or TypeScript repo and read the findings in the conversation.

by TateLyman ↗Vulnerability Scanning & Application SecurityCommunity

LABSCO SUMMARY

A pre-launch checklist that reads your repo instead of asking you questions about it.

The findings are aimed squarely at people shipping small apps and MCP servers: a secret in the wrong file, an unsigned Stripe webhook, no CI, no smoke-test proof. sarif output means the same scan drops into a CI annotation flow rather than only being read in chat. It is defensive static analysis, not a penetration test — it never runs your code, so anything that only appears at runtime is out of scope.

What it is

One tool, scan_repository, that runs the Shipcheck static analyser over a local JavaScript, TypeScript or MCP repository and reports the things that would go wrong at launch.

What you get

  • Exposed private-looking environment variables, found by reading the project files
  • Unsigned Stripe webhooks, and missing Supabase or Firebase rule evidence
  • Debug routes left in, missing CI, and loosely pinned dependencies
  • Missing usage-cost guardrails and thin release documentation
  • MCP-specific gaps: no smoke-test proof, undocumented STDIO execution boundaries, undocumented remote auth boundaries
  • Findings as text, markdown, json or sarif, with a failOn threshold of info, low, medium or high

Requirements

npx, and a local checkout you own or are authorised to inspect. It reads project files only — no network access, no execution of your code, and no writes to the repository.

Setup effort

One command — npx --yes --package shipcheck-mcp shipcheck-mcp

See installation options