Scan repository with Shipcheck
scan_repositoryScans a local JavaScript/TypeScript repository for launch risks including exposed environment variables, unsigned webhooks, and missing security guardrails.
Instructions
Run Shipcheck on a local JavaScript or TypeScript repo the user owns or is authorized to inspect.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Local path to the repository root. | . |
| format | No | Report format to return. | text |
| failOn | No | Lowest severity that should mark the report as failing. | high |
| strict | No | Enable stricter release-readiness checks. |
Implementation Reference
- src/scan.ts:19-34 (handler)The runShipcheck function is the core handler that executes the scan_repository tool. It normalizes inputs (root, format, failOn, strict), calls scanRepository from the shipcheck-cli library, and returns the report along with a formatted string.
export async function runShipcheck(input: ScanRepositoryInput): Promise<ScanRepositoryOutput> { const root = input.root?.trim() || "."; const format = normalizeFormat(input.format); const failOn = normalizeSeverity(input.failOn); const report = await scanRepository({ root, failOn, strict: input.strict ?? false }); return { report, formatted: formatReport(report, format) }; } - src/scan.ts:4-14 (schema)Input type definition for scan_repository: root path, report format, minimum failure severity, and strict mode flag.
export type ScanRepositoryInput = { root?: string; format?: ReportFormat; failOn?: Severity; strict?: boolean; }; export type ScanRepositoryOutput = { report: ScanReport; formatted: string; }; - src/scan.ts:11-14 (schema)Output type definition for scan_repository: the raw ScanReport object and a formatted string representation.
export type ScanRepositoryOutput = { report: ScanReport; formatted: string; }; - src/server.ts:12-37 (registration)Registration of the scan_repository tool with the MCP server, including Zod schema for inputs (root, format, failOn, strict) and handler that calls runShipcheck.
server.registerTool( "scan_repository", { title: "Scan repository with Shipcheck", description: "Run Shipcheck on a local JavaScript or TypeScript repo the user owns or is authorized to inspect.", inputSchema: { root: z.string().default(".").describe("Local path to the repository root."), format: z.enum(["text", "markdown", "json", "sarif"]).default("text").describe("Report format to return."), failOn: z.enum(["info", "low", "medium", "high"]).default("high").describe("Lowest severity that should mark the report as failing."), strict: z.boolean().default(false).describe("Enable stricter release-readiness checks.") } }, async ({ root, format, failOn, strict }) => { const output = await runShipcheck({ root, format, failOn, strict }); return { content: [ { type: "text", text: output.formatted } ], structuredContent: output.report }; } );