Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@shipcheck-mcp scan the current directory for launch risks"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that lets local MCP clients run Shipcheck on authorized JavaScript and TypeScript repositories.
Shipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.
Tool page: https://tateprograms.com/shipcheck.html
Free MCP launch self-check: https://tateprograms.com/mcp-self-check.html
MCP directory launch checklist: https://tateprograms.com/mcp-directory-checklist.html
Paid MCP launch check: https://tateprograms.com/mcp-launch-review.html
Official MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck
Run directly with npx:
npx --yes shipcheck-mcpRelated MCP server: CodeInspectus
Add this server to an MCP client that supports stdio servers:
{
"mcpServers": {
"shipcheck": {
"command": "npx",
"args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
}
}
}STDIO MCP client config launches a local command. Review the command, args, and any env values before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.
scan_repository
{
"root": ".",
"format": "markdown",
"failOn": "medium",
"strict": true
}Formats: text, markdown, json, or sarif.
Severities: info, low, medium, or high.
Shipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.
npm install
npm run checkRun Shipcheck on a local JavaScript or TypeScript repo the user owns or is authorized to inspect.
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Local path to the repository root. | . |
| format | No | Report format to return. | text |
| failOn | No | Lowest severity that should mark the report as failing. | high |
| strict | No | Enable stricter release-readiness checks. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only hints at authorization but does not state whether the operation is read-only, modifies files, requires network, or has rate limits. This is insufficient for a scanning tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundant words. It is front-loaded with the action and conditions, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 4 parameters and no output schema, the description does not explain what Shipcheck is, what the report contains, or how the 'failOn' and 'strict' parameters affect behavior. This leaves significant gaps for an agent to select the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented. The overall description adds context about the tool being for JS/TS repos, but does not enhance parameter meaning beyond what the schema provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Run Shipcheck), the resource (local JavaScript or TypeScript repo), and includes an authorization condition. No sibling tools exist, so differentiation is not required.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage on local JS/TS repos the user is authorized to inspect, but does not provide explicit guidance on when to use or when not to use it, nor any alternatives since there are no siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.3scan_repositoryScored across 1 tool
With only one tool, there is no chance of confusion between tools. The single tool has a clear and distinct purpose.
With only one tool, there are no naming inconsistencies. The name 'scan_repository' follows a clear snake_case convention.
A single tool feels thin for most purposes, though for a very specialized server like 'shipcheck' it might be acceptable. It borders on too minimal.
The server only offers one operation (scanning), which may be insufficient for a full workflow. Missing potential tools like listing results or configuration, but the core task is covered.
Open-source licence risk checks for AI coding agents and dependency trees.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.
Stateless TS/JS compiler facts for agents: references, imports, impact. No repo index or OAuth.
