Ship Check
Server Details
Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.
- Status
- Healthy
- Uptime
- 100.0% over the last 24 hours
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 12 tools
Most tools have clearly distinct targets: ship_check scans, request_human_review sells the paid review, and book_call/get_availability/send_message/request_estimate are explicitly cross-referenced so agents know which to pick for a given intent. The weak spot is a cluster of three cost estimators (agent_cost_estimate, cursor_auto_cost_estimate, swarm_run_cost_estimate) whose boundaries are only implied, plus the intentional leak_check/ship_check alias, though the alias is explicitly documented as deprecated.
Eleven of twelve names follow a readable snake_case convention, mostly verb_noun (book_call, get_availability, list_services, request_estimate, send_message) or consistent noun_action compounds ending in _check/_estimate. ai_recommendation_panel breaks the pattern as a bare noun phrase, and ship_check/leak_check read as noun artifacts rather than verb-led actions, but overall the convention is predictable.
Twelve tools sits comfortably in the well-scoped range, and each one maps to a real step in the flow: scan an app, upsell a human review, get a quote, check availability, book, message, and look up pricing or AI-visibility data. Nothing looks padded, apart from the deprecated alias retained for backward compatibility.
The consulting funnel is covered end to end (scan → paid review → estimate → availability → booking → message), but the product surface has real dead ends: there is no way to fetch a past scan by scan_id, list scan history, or re-check a single business's AI ranking (that is punted to an external link). The three cost estimators also form a partial, scenario-by-scenario set with no general cost calculator, and the ai_recommendation_panel covers only four hardcoded city/category panels.
Available Tools
12 toolsagent_cost_estimateAgent cost per shipped taskBRead-onlyIdempotentInspect
Estimate blended cost per shipped task for a month of agent runs, given a retry rate.
Inputs: retryRatePct (required), runsPerMonth (required), avgCostPerTask (required), modelId.
ai_recommendation_panelAI recommendation panel lookupARead-onlyIdempotentInspect
Data on which named businesses ChatGPT, Perplexity and Gemini name when asked a buyer's own questions, by business category and city, from Continuum's monthly probe panels. Panels available today: bookkeepers in Denver; HVAC companies in Dallas; marketing agencies in Salt Lake City; web designers in Minneapolis. Pass category and/or city as free text to look one panel up (loose match, e.g. "HVAC" or "Dallas"); pass list=true or no arguments to see every available panel with its measurement date. Each result states the snapshot month and the refresh cadence (monthly), the businesses named and how many times, the AI tool(s) that named each one, and the directories, review sites and forums the answers cited. It states no number that is not in the stored panel. Read-only: looks up stored data, runs no new AI probe. Free: 5 calls per caller per day. Beyond that, pass api_key from an active Agent Data subscription ($9/mo) for unlimited calls; a result without one past the free limit includes the subscription link. Same data as the public page linked in each result; this tool is a convenience for programmatic access to it, not a different or more current dataset. A weekly tracker for one business's own questions (whether ChatGPT, Perplexity and Gemini name it, week over week) is in early access at https://uxcontinuum.com/labs/ai-rank-tracker; this tool does not track a single business.
Inputs: city, list, api_key, category.
book_callBook a call with MattAInspect
Book a free 30-minute intro call with Matt Turley (Continuum) directly on his calendar. The booking is confirmed immediately and Cal.com emails the invite to the user and to Matt. First call get_availability and pass the exact start of an open slot. Only book when the user has asked for the call and agreed to the time; pass their real name, email and time zone. notes: a short, factual summary of what the user wants to discuss (shown to Matt). Returns the booking id, meeting link and reschedule/cancel links. Limit 2 upcoming calls per email.
Inputs: name (required), email (required), start (required), timezone (required), +2 more.
cursor_auto_cost_estimateCursor Auto vs pinned model costCRead-onlyIdempotentInspect
Estimate Cursor Auto blended cost versus pinning a single model.
Inputs: autoModelMix (required), pinnedModelId (required), avgInputTokens (required), requestsPerDay (required), +2 more.
get_availabilityGet open call times with MattARead-onlyIdempotentInspect
List open slots for a free 30-minute intro call with Matt Turley (Continuum), read live from his Cal.com calendar. Use it when the user wants to talk to Matt, get help with a project, or book a call, before calling book_call. Window: date_from to date_to (YYYY-MM-DD), at most 14 days; defaults to the next 7 days. Times are returned in the requested timezone (IANA name, default UTC). Read-only: it books nothing.
Inputs: event, date_to, timezone, date_from.
leak_checkLeak Check (older name for ship_check)ARead-onlyIdempotentInspect
Older name for ship_check, kept for existing callers. Same scan, same input, same result. Prefer ship_check.
Inputs: url (required), fresh. Returns: url, score, cached, counts, +9 more
list_servicesContinuum services and pricesARead-onlyIdempotentInspect
List Continuum service offerings and published prices (the same list as uxcontinuum.com/pricing), plus how to reach Matt: get_availability and book_call to book a free 30-minute call, send_message to send him a note, request_estimate for a ballpark from published pricing.
Inputs: no named parameters.
request_estimateRequest a project estimateAInspect
Get a ballpark price for a software project from Continuum's published pricing, and send the request to Matt Turley, who replies personally with a real quote. Use it when the user asks what a build, fix, review, ongoing support or AI-search visibility work would cost. The ballpark is the matching published offer(s) and price range from uxcontinuum.com/pricing, not a quote. Show it to the user labeled that way. Then offer a call: get_availability and book_call.
Inputs: name (required), email (required), project_description (required), budget, +2 more.
request_human_reviewRequest a human review ($299)AInspect
Get a senior engineer (Matt Turley, 20 years shipping software) to review by hand the app behind a ship_check scan: the paid $299 Ship Check. Returns a Stripe Checkout link and a call booking link for the user to open themselves. This call charges nothing and never pays on the user's behalf. Only call it when the user asks for a human review or agrees to one. Pass the user's own email so Matt can follow up personally; no automated email is sent to it. Show the user checkout_url and booking_url.
Inputs: email (required), scan_id (required). Returns: url, price, scan_id, report_url, +3 more
send_messageSend Matt a messageAInspect
Send a message to Matt Turley (Continuum) on the user's behalf, like the contact form on uxcontinuum.com. Use it when the user wants to ask Matt something or describe a project but not book a call yet. Only send what the user asked to send, with their real name and email. Matt reads it and replies personally by email; no automated reply is sent. For a time to talk, use get_availability and book_call instead.
Inputs: name (required), email (required), message (required), topic, +1 more.
ship_checkShip Check: scan a deployed appARead-onlyIdempotentInspect
Before shipping, or right after deploying, an app built with Lovable, Bolt, Cursor, v0, Replit, Claude Code or similar, run ship_check on the live URL. It scans the deployed app from the outside, the way a visitor or attacker sees it, and returns a launch-readiness report where every finding has a status and a concrete fix. Checks: (1) secret keys exposed in the HTML and the same-origin JS bundles it ships (Stripe live secret and restricted keys, AWS access keys, OpenAI and Anthropic API keys, Supabase secret and service_role keys, hardcoded bearer tokens and passwords); (2) open database access: if the page ships a Supabase URL and public anon or publishable key, whether the common tables profiles and users return rows to that key without login (a missing Row Level Security policy; count only, no row data is read); (3) missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy); (4) HTTPS, reachability and server errors; (5) broken internal links (spot-check of up to 6); (6) server response time; (7) whether login/signup and pricing/checkout are linked from the homepage; (8) whether AI search crawlers get real server-rendered content or an empty JavaScript shell. Read-only: plain GET/HEAD requests, never logs in, never submits forms, never writes. Not a code audit: it cannot see source code or test every table or route. Results are cached for 24 hours per URL; pass fresh=true to re-scan after deploying a fix. Only scan apps the user owns or is authorized to test. If the user wants a senior engineer to review the app by hand ($299), call request_human_review with the scan_id from this result.
Inputs: url (required), fresh. Returns: url, score, cached, counts, +9 more
swarm_run_cost_estimateMulti-agent swarm run costCRead-onlyIdempotentInspect
Estimate the cost of a multi-agent orchestrator plus sub-agent swarm run.
Inputs: runsPerDay (required), retryRatePct (required), subAgentCount (required), subAgentModelId (required), +5 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Related MCP Connectors
Check a live app you own for public databases, leaked keys and exposed files.
Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.
Check a deployed web app for security headers, SEO, accessibility and performance, with a grade.
Security checks for Next.js + Supabase apps: code scan, read-only live DB check, fix confirmation.
Related MCP Servers
- AlicenseAqualityBmaintenanceScan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.2460 npmMIT
- AlicenseAqualityCmaintenanceSecurity checks for apps built with AI coding tools (Lovable, Bolt, Cursor, Claude Code). Scans a public GitHub repo for open Supabase tables, exposed keys, unprotected server functions and unverified webhooks, and returns each finding with the file and a fix prompt.2419 npmMIT
- AlicenseNot gradedqualityCmaintenanceScans public URLs for compliance and security issues such as leaked API keys, exposed files, missing privacy pages, and security headers, helping developers identify gaps before launch.MIT
- AlicenseNot gradedqualityCmaintenanceScans an app's source files and a read-only Supabase catalog snapshot to surface security holes such as exposed tables, missing row-level security, overly broad policies, leaked service-role keys, and unauthenticated API routes, returning fixes for each and confirming after a change which issues actually closed.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.