The findings are aimed squarely at people shipping small apps and MCP servers: a secret in the wrong file, an unsigned Stripe webhook, no CI, no smoke-test proof. sarif output means the same scan drops into a CI annotation flow rather than only being read in chat. It is defensive static analysis, not a penetration test — it never runs your code, so anything that only appears at runtime is out of scope.
One tool, scan_repository, that runs the Shipcheck static analyser over a local JavaScript, TypeScript or MCP repository and reports the things that would go wrong at launch.
- Exposed private-looking environment variables, found by reading the project files
- Unsigned Stripe webhooks, and missing Supabase or Firebase rule evidence
- Debug routes left in, missing CI, and loosely pinned dependencies
- Missing usage-cost guardrails and thin release documentation
- MCP-specific gaps: no smoke-test proof, undocumented STDIO execution boundaries, undocumented remote auth boundaries
- Findings as text, markdown, json or sarif, with a failOn threshold of info, low, medium or high
Npx, and a local checkout you own or are authorised to inspect. It reads project files only — no network access, no execution of your code, and no writes to the repository.
One command — npx --yes --package shipcheck-mcp shipcheck-mcp