Which integrations are available for this server?

Checks for pending Drizzle database migrations. Generates a GitHub Actions workflow and pre-push hook to enforce the ship-gate quality gate in CI. Performs penetration testing for GraphQL introspection and related vulnerabilities. Detects LangChain LLM call sites in code and flags AI features shipping without eval suites. Runs Lighthouse audits via headless Chrome to report Core Web Vitals and performance diagnostics. Detects Ollama LLM call sites in code and flags AI features shipping without eval suites. Detects OpenAI LLM call sites in code and flags AI features shipping without eval suites. Checks for pending Prisma database migrations. Audits Supabase projects for security issues like exposed service_role keys and tables without RLS.

How do I use Ultraship?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Ultraship run the ship-gate on my project and tell me if it's ready to deploy" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Ultraship

by Szymonr8065

Overview Schema Source Related Servers Discussions Admin

JavaScript

Claude Code plugin. 43 expert-level skills for building, shipping, and scaling production software. 37 audit tools (accessibility, vibe-coding security, AI evals, pentest, code quality, bundle size, SEO + AI Readiness check) plus a blocking ship-gate close the loop before deploy. A built-in Currency Guard keeps Claude on current docs, not stale training data.

Built by Kaileskkhumar, founder of HouseofMVPs and Kailxlabs

0 dependencies · 274 tests · Node.js ESM · MIT

Install

# Claude Code plugin
claude plugin marketplace add Houseofmvps/ultraship
claude plugin install ultraship

# Or standalone via npx
npx ultraship ship .
npx ultraship seo .
npx ultraship security .

Related MCP server: Claude Flow MCP

How It Works

flowchart LR
    U["You type a<br/>slash command"] --> S["Skill<br/>(markdown instructions)"]
    S --> A["Agent<br/>(dispatched worker)"]
    S --> T["Tools<br/>(Node.js scripts)"]
    A --> T
    T --> O["JSON Results"]
    O --> R["Scorecard / Report /<br/>Actionable Fixes"]

    style U fill:#f59e0b,stroke:#d97706,color:#000
    style S fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style A fill:#3b82f6,stroke:#2563eb,color:#fff
    style T fill:#10b981,stroke:#059669,color:#000
    style R fill:#ef4444,stroke:#dc2626,color:#fff

flowchart TD
    subgraph Lifecycle["Full Lifecycle Coverage"]
        direction LR
        I["Idea<br/>/brainstorm"] --> B["Build<br/>/sprint"]
        B --> AU["Audit<br/>/ship /seo /secure"]
        AU --> D["Ship<br/>/deploy"]
        D --> L["Launch<br/>/launch /compete"]
        L --> G["Grow<br/>/grow /cost"]
        G --> RE["Rescue<br/>/rescue /canary"]
    end

    style I fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style B fill:#3b82f6,stroke:#2563eb,color:#fff
    style AU fill:#f59e0b,stroke:#d97706,color:#000
    style D fill:#10b981,stroke:#059669,color:#000
    style L fill:#06b6d4,stroke:#0891b2,color:#000
    style G fill:#84cc16,stroke:#65a30d,color:#000
    style RE fill:#ef4444,stroke:#dc2626,color:#fff

What `/ship` Does

/ship runs 6 tools in parallel and outputs a scorecard:

flowchart LR
    SHIP["/ship"] --> SEO["seo-scanner<br/>63 rules"]
    SHIP --> A11Y["a11y-scanner<br/>WCAG 2.2"]
    SHIP --> SEC["secret-scanner<br/>+ npm audit"]
    SHIP --> CODE["code-profiler<br/>N+1, leaks, ReDoS"]
    SHIP --> BUNDLE["bundle-tracker<br/>JS/CSS/images"]
    SHIP --> ENV["env-validator<br/>+ migration-checker"]

    SEO --> SC["Scorecard<br/>READY TO SHIP"]
    A11Y --> SC
    SEC --> SC
    CODE --> SC
    BUNDLE --> SC
    ENV --> SC

    style SHIP fill:#f59e0b,stroke:#d97706,color:#000
    style SC fill:#10b981,stroke:#059669,color:#000
    style SEO fill:#3b82f6,stroke:#2563eb,color:#fff
    style SEC fill:#3b82f6,stroke:#2563eb,color:#fff
    style CODE fill:#3b82f6,stroke:#2563eb,color:#fff
    style BUNDLE fill:#3b82f6,stroke:#2563eb,color:#fff
    style ENV fill:#3b82f6,stroke:#2563eb,color:#fff

+===========================================+
|      U L T R A S H I P   S C O R E       |
+===========================================+
|  SEO + AI Vis.  92/100  ############-    |
|  Security        95/100  ############-    |
|  Code Quality    88/100  ###########--    |
|  Bundle Size     97/100  ############-    |
+===========================================+
|   OVERALL         90/100                  |
|   STATUS          READY TO SHIP           |
+===========================================+

Tools (40)

Each tool is a standalone Node.js script (node tools/<name>.mjs). JSON output. Exit 0 always. No build step.

Auditing

Tool	What it checks
`seo-scanner`	63 rules: 39 SEO (meta tags, canonicals, headings, OG tags, structured data, sitemap, cross-page duplicate/orphan detection), 20 GEO (AI bot access in robots.txt, snippet restrictions, llms.txt, structured data for AI extraction), 4 AEO (FAQPage/HowTo/speakable schema)
`a11y-scanner`	WCAG 2.2 A/AA static checks: missing alt text, unlabeled form controls, icon-only buttons, missing `lang`/`title`/`main`, heading order, positive tabindex, zoom disabled, duplicate ids, broken aria references. Zero false positives.
`ship-gate`	Blocking quality gate — scores all auditors (shared math with `/ship`), compares to `.ultraship/ship-gate.json` thresholds, hard-fails on leaked secrets / critical findings, exits 1 on fail. Generates a pre-push hook + GitHub Actions workflow.
`secret-scanner`	AWS keys, Stripe keys, JWT secrets, database URLs, private keys. Redacts values in output.
`vibe-security-scanner`	Vibe-Coding Security Sentinel — context secret-scanner misses: server-only secrets behind a `NEXT_PUBLIC_`/`VITE_` prefix, a decoded Supabase `service_role` key exposed to the client, service_role in a `"use client"` file, Supabase tables with no RLS. Zero false positives.
`eval-scanner`	Locates every LLM call site (Anthropic, OpenAI, Gemini, Mistral, Cohere, Ollama, Vercel AI SDK, LangChain) by provider + model id, detects the test runner and whether an eval suite exists. Flags AI features shipping with no evals. Seeds `/evals`. Zero false positives.
`code-profiler`	N+1 queries, sync I/O in handlers, unbounded queries, missing indexes, memory leaks, sequential awaits, ReDoS risk
`bundle-tracker`	JS/CSS/image sizes in build output. Detects heavy deps (`moment`→`dayjs`, `lodash`→native). History for before/after. Monorepo-aware.
`dep-doctor`	Unused dependencies via import graph analysis (not just grep). Dead wrapper files. Outdated packages.
`content-scorer`	Flesch-Kincaid readability, keyword density, thin content detection, GEO heading analysis
`lighthouse-runner`	Lighthouse via headless Chrome. Core Web Vitals, render-blocking resources, diagnostics.

Validation

Tool	What it checks
`health-check`	HTTP status, response time, SSL certificate (issuer, expiry), 6 security headers
`env-validator`	Compares `.env.example` against actual `.env`. Catches missing/empty/placeholder vars.
`migration-checker`	Pending DB migrations for Drizzle, Prisma, Knex
`og-validator`	Open Graph tags, image reachability, size validation
`redirect-checker`	Redirect chains, loops, mixed HTTP/HTTPS. Sitemap-based bulk check.
`api-smoke-test`	Hit API endpoints, check status codes, response times, CORS headers

Generators

Tool	What it creates
`sitemap-generator`	`sitemap.xml` from HTML files and routes
`robots-generator`	AI-friendly `robots.txt` (allows GPTBot, PerplexityBot, ClaudeBot)
`llms-txt-generator`	`llms.txt` for AI assistant discoverability
`structured-data-generator`	JSON-LD schema markup

Competitive & Launch

Tool	What it does
`compete-analyzer`	Compares two URLs: tech stack, SEO score, security headers, response time. ASCII comparison card.
`launch-prep`	Reads project, generates PH/Twitter/LinkedIn/HN copy, 14-item checklist, press kit
`demo-prep`	Finds console.logs, TODOs, placeholder text, missing favicons. Scores demo readiness.

Operations

Tool	What it does
`incident-commander`	Health check + git culprit analysis + error patterns + rollback commands + post-mortem template
`growth-tracker`	Uptime, git velocity, SEO trajectory, dep health. Stores snapshots for week-over-week comparison.
`cost-tracker`	Log AI token usage per feature/model. Built-in pricing for Claude, GPT-4o, Gemini. Daily trends.
`pentest-scanner`	Automated penetration testing: XSS, SQLi, SSTI, command injection, path traversal, CORS, JWT, GraphQL introspection, prototype pollution, race conditions, request smuggling. Zero false positives, every finding has proof-of-concept.
`canary-monitor`	Post-deploy canary monitoring: HTTP status, response time, error patterns, baseline regression detection. Auto-saves baselines for future comparison.
`retro-analyzer`	Sprint retrospective: git velocity, commit patterns (features vs fixes), test health, hot files, shipping cadence. Generates insights and recommendations.
`learnings-manager`	Project learnings CRUD: save, search, list, prune, export. Structured knowledge that compounds across sessions.

Project Analysis

Tool	What it does
`onboard-generator`	Auto-generates developer guide: stack, directory tree, routes, schema, env vars, Mermaid diagram
`architecture-mapper`	4 Mermaid diagrams: system overview, route tree, DB ER, data flow. Circular dependency + orphan detection.
`pattern-analyzer`	Analyzes testing, error handling, TypeScript usage, CI/CD, git practices. Cross-repo comparison.
`audit-history`	Saves/compares audit scores over time

Integrations (optional)

Tool	What it does
`gsc-client`	Google Search Console: submit sitemaps, inspect URLs, query rankings (requires `ULTRASHIP_GSC_CREDENTIALS`)
`bing-webmaster`	Bing Webmaster: submit sitemaps/URLs, IndexNow instant push, keyword research, backlinks, site-scan, URL inspection (requires `ULTRASHIP_BING_KEY`). Powers ChatGPT Search + Microsoft Copilot.
`ga4-client`	Google Analytics 4: overview, top-pages, landing-pages, traffic-sources, conversions, user-journey, devices, realtime, ai-traffic (ChatGPT/Perplexity/Copilot tracking), organic (search-only). `--organic` flag.
`keyword-intelligence`	12-command keyword engine: analyze, quick-wins, cannibalization, content-gaps, intent-map, trending, high-intent, page-keywords, content-decay, difficulty, anomalies (CTR anomalies), cross-reference (GSC↔GA4). `--brand` flag for non-brand filtering.
`index-doctor`	Index diagnosis: inspect URLs via GSC URL Inspection API, diagnose 15+ coverage states, auto-fix and submit to Bing.

Commands (16)

Every skill is also a slash command. Claude Code merged commands into skills, so /a11y, /sprint, /pentest, /compete, /canary, /launch, /rescue, /grow, /deploy, /learn, /guard, /retro, /investigate, /cost, /onboard, /architecture, /clone-patterns, /demo, /visual-diff, /release, /seo-strategy and /index-fix all work too — they live in Skills above. The commands below are the remaining dedicated command files.

Command	Description
`/ship`	Pre-deploy scorecard. Runs 6 auditors, scores 5 categories
`/seo`	SEO audit (63 rules) + AI visibility checks (bot access, snippet restrictions, schema)
`/secure`	Secret scanning + OWASP patterns + `npm audit`
`/perf`	Lighthouse + bundle size
`/review`	Code review with confidence-scored findings
`/health`	Production health check
`/codex`	Generate a compact codebase index (routes, schema, components, lib) to save AI tokens
`/content`	Readability + keyword density analysis
`/bundle`	Bundle size tracking
`/profile`	Static analysis for backend anti-patterns
`/deps`	Unused/outdated dependency detection
`/redirects`	Redirect chain/loop detection
`/revise-claude-md`	Update CLAUDE.md with session learnings
`/brainstorm`	Deprecated alias → use the `brainstorming` skill
`/write-plan`	Deprecated alias → use the `writing-plans` skill
`/execute-plan`	Deprecated alias → use the `executing-plans` skill

Skills (43)

Skills are markdown instruction files that shape Claude's behavior during your session. They activate based on context. When you're debugging, Claude uses the debugging skill. When you're building UI, it uses the frontend design skill.

Workflow (19): brainstorming, planning, TDD, implementation, code review, debugging, refactoring, frontend design, API design, data modeling, git workflow, deploy pipeline, release, CLAUDE.md management, verification, browser testing, sprint pipeline, investigation, learnings management

Specialist (12): SEO + AI visibility audit, accessibility audit + auto-fix, deterministic ship-gate, AI eval harness, security audit, penetration testing, performance audit, content quality, code profiling, parallel agent dispatching, safety guardrails, staying current

Growth & Intelligence (12): competitive analysis, launch prep, incident response, growth tracking, cost tracking, onboarding, architecture mapping, pattern analysis, demo readiness, visual regression, canary monitoring, sprint retrospective

Agents (13)

Agents are dispatched by skills to run audits in parallel:

code-reviewer · seo-auditor · seo-strategist · security-auditor · pentest-auditor · perf-auditor · a11y-auditor · browser-verifier · compete-analyzer · launch-auditor · incident-responder · growth-tracker · canary-monitor

MCP Servers (2)

Server	Purpose
Context7	Live library documentation. Fetches current docs for any framework/library.
Playwright	Browser automation. Navigate, screenshot, fill forms, test deployed pages.

Both lazy-start on first use. No background processes.

Optional MCP integrations (detect-if-present)

Ultraship doesn't bundle these (they need your credentials and would slow every install), but several skills use them automatically if you've connected them:

Connect	Sharpens
Sentry	`/rescue` pulls live production errors and maps stack traces to code instead of guessing the culprit. `/canary` confirms a post-deploy error spike before recommending rollback.
Vercel	`/deploy` reads real deployment status, build logs, and which commit is live (not just a single HTTP probe).
Supabase	`/deploy` verifies migration state against the actual database to catch dashboard-vs-repo drift.

Add them with claude mcp add (or the /plugin browser). When connected, the skills detect the tools and use them; when not, they fall back to the built-in static checks.

Sprint Workflow

Ultraship skills chain into a structured sprint pipeline. Each phase produces artifacts that feed the next.

flowchart LR
    P["/write-plan<br/>Plan"] --> B["/execute-plan<br/>Build"]
    B --> T["TDD<br/>Test"]
    T --> R["/review + /secure<br/>Review"]
    R --> S["/ship + /deploy<br/>Ship"]
    S --> V["/canary<br/>Verify"]
    V --> RE["/retro + /learn<br/>Reflect"]

    style P fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style B fill:#3b82f6,stroke:#2563eb,color:#fff
    style T fill:#06b6d4,stroke:#0891b2,color:#000
    style R fill:#f59e0b,stroke:#d97706,color:#000
    style S fill:#10b981,stroke:#059669,color:#000
    style V fill:#84cc16,stroke:#65a30d,color:#000
    style RE fill:#ec4899,stroke:#db2777,color:#fff

Phase	Skill	Output
Plan	`/write-plan`	Implementation plan with file map and test strategy
Build	`/execute-plan`	Working code on a feature branch
Test	TDD skill	Passing test suite
Review	`/review` + `/secure`	Review report, security scan
Ship	`/ship` + `/deploy`	Scorecard + production deploy
Verify	`/canary`	Post-deploy health verification
Reflect	`/retro` + `/learn`	Retrospective + saved learnings

Run /sprint to follow the full pipeline, or run individual phases as needed.

Safety Guardrails

/guard activates PreToolUse hooks that block destructive commands before they execute:

flowchart LR
    CMD["Claude runs<br/>a command"] --> HOOK["PreToolUse<br/>Hook"]
    HOOK --> CHECK{"Destructive?"}
    CHECK -->|"rm -rf, DROP TABLE,<br/>git push --force,<br/>kubectl delete..."| BLOCK["BLOCKED"]
    CHECK -->|Safe| ALLOW["Allowed"]

    style HOOK fill:#f59e0b,stroke:#d97706,color:#000
    style BLOCK fill:#ef4444,stroke:#dc2626,color:#fff
    style ALLOW fill:#10b981,stroke:#059669,color:#000

rm -rf, DROP TABLE, TRUNCATE (data destruction)
git push --force, git reset --hard (git history destruction)
git clean -f, git checkout . (working directory destruction)
kubectl delete, docker system prune (infrastructure destruction)

Optional directory freeze restricts all file edits to a specific path. Explicitly confirmed actions always proceed.

Persistent Memory

Ultraship enforces a memory-first rule at session start. The SessionStart hook detects if you have a MEMORY.md file and instructs Claude to read it before performing any task. Context persists across sessions. No more repeating yourself about project state, deploy status, or decisions already made.

If MEMORY.md is found: Claude reads memory files before doing anything
If not found: Claude suggests setting up auto-memory for persistent context

No configuration needed. Just install the plugin.

SEO + AI Visibility

flowchart TD
    subgraph Data["Data Sources (optional API keys)"]
        GSC["Google Search Console<br/>Index status, rankings"]
        GA4["Google Analytics 4<br/>Traffic, AI referrals"]
        BING["Bing Webmaster<br/>Crawl, IndexNow, backlinks"]
    end

    subgraph Analysis["Intelligence Layer"]
        KW["keyword-intelligence<br/>12 commands"]
        IDX["index-doctor<br/>Diagnose + fix"]
        SCAN["seo-scanner<br/>63 rules"]
    end

    subgraph Output["Outputs"]
        STR["/seo-strategy<br/>90-day ranking plan"]
        FIX["/index-fix<br/>Auto-submit fixes"]
        SCORE["/seo<br/>SEO + GEO + AEO score"]
    end

    GSC --> KW
    GSC --> IDX
    GA4 --> KW
    BING --> IDX
    SCAN --> SCORE
    KW --> STR
    IDX --> FIX

    style GSC fill:#4285f4,stroke:#3367d6,color:#fff
    style GA4 fill:#e37400,stroke:#c56200,color:#fff
    style BING fill:#00809d,stroke:#006680,color:#fff
    style KW fill

This server cannot be deployed

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Maintenance

ActivityActive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Related MCP Connectors

opchain A
io.github.asfbay-bit
Claude Code / MCP skills for the dev pipeline: discover, spec, design, build, ship, operate.
Developer Tools CI/CD & DevOps Project Management
2
seo-audit
com.deepseoanalysis
Run SEO + AI-visibility (GEO) audits from Claude, Cursor & other AI clients.
Marketing Search
2
AuditFellowOAuth
app.auditfellow
Your audit methodology inside Claude: findings, risks, controls and workpapers in your team format.
Legal & Compliance
1
AgentSEO C
dev.agentseo.www
Live SEO workflow tools for Claude Code, Codex, and AI agents.
Marketing Browser Automation
454

Related MCP Servers

Claude Code Starter Kit MCP
Testing & QA Tools Code Analysis Penetration Testing
dachivadachkoria
A
license
C
quality
C
maintenance
Enables AI-powered automated testing, security scanning, code review, and maintenance tasks directly within Claude Code or desktop.
Updated 7 months ago (2026-03-08 21:09 UTC)
12
27 PyPI
4
MIT
Claude Flow MCP
Developer Tools Code Analysis AI & Machine Learning
catlog22
F
license
Not graded
quality
F
maintenance
Integrates with Claude Code to execute AI-powered code analysis and workflow automation, supporting pre-defined scenarios like code review and security audit.
Updated a year ago (2025-08-25 14:45 UTC)
5
-
vibescan-mcp-server
Security Penetration Testing Code Analysis
Aguantar
A
license
A
quality
C
maintenance
Enables scanning projects for leaked secrets and security issues directly from Claude Code, detecting secret categories, dangerous code patterns, and git hygiene issues.
Updated 7 months ago (2026-03-19 04:27 UTC)
2
56 PyPI
1
MIT
shieldbot
Code Analysis Security
balasriharsha
A
license
A
quality
C
maintenance
AI-powered security code review for Claude Code that runs multiple scanners (CodeQL, Semgrep, etc.) to detect vulnerabilities, secrets, and dependency CVEs, producing prioritized reports.
Updated 4 months ago (2026-06-07 15:23 UTC)
2
3
MIT