MCP-Server, der es KI-Coding-Agenten ermöglicht, Shipcheck auf lokalen JavaScript- und TypeScript-Repositories auszuführen.
Shipcheck scannt von KI erstellte Apps auf Startrisiken wie offengelegte, potenziell private Umgebungsvariablen, unsignierte Stripe-Webhooks, fehlende Nachweise für Supabase/Firebase-Regeln, Debug-Routen, fehlende KI-Nutzungsrichtlinien, fehlende CI, lockere Abhängigkeiten und unzureichende Release-Dokumentation.
Tool-Seite: https://tatelyman.github.io/tate-web-services/shipcheck.html
Offizielles MCP-Register: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck
Demo-Repo mit GitHub-Code-Scanning-Warnungen: https://github.com/TateLyman/shipcheck-demo-ai-app
Direkt mit npx ausführen:
npx --yes shipcheck-mcpRelated MCP server: CodeInspectus
Fügen Sie diesen Server einem MCP-Client hinzu, der stdio-Server unterstützt:
{
"mcpServers": {
"shipcheck": {
"command": "npx",
"args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
}
}
}scan_repository
{
"root": ".",
"format": "markdown",
"failOn": "medium",
"strict": true
}Formate: text, markdown, json oder sarif.
Schweregrade: info, low, medium oder high.
Shipcheck ist eine defensive statische Analyse, kein Penetrationstest. Führen Sie es nur auf Repositories aus, die Sie besitzen oder für die Sie eine Inspektionsberechtigung haben.
npm install
npm run checkRun Shipcheck on a local JavaScript or TypeScript repo the user owns or is authorized to inspect.
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Local path to the repository root. | . |
| format | No | Report format to return. | text |
| failOn | No | Lowest severity that should mark the report as failing. | high |
| strict | No | Enable stricter release-readiness checks. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only hints at authorization but does not state whether the operation is read-only, modifies files, requires network, or has rate limits. This is insufficient for a scanning tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundant words. It is front-loaded with the action and conditions, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 4 parameters and no output schema, the description does not explain what Shipcheck is, what the report contains, or how the 'failOn' and 'strict' parameters affect behavior. This leaves significant gaps for an agent to select the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented. The overall description adds context about the tool being for JS/TS repos, but does not enhance parameter meaning beyond what the schema provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Run Shipcheck), the resource (local JavaScript or TypeScript repo), and includes an authorization condition. No sibling tools exist, so differentiation is not required.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage on local JS/TS repos the user is authorized to inspect, but does not provide explicit guidance on when to use or when not to use it, nor any alternatives since there are no siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.3scan_repositoryScored across 1 tool
With only one tool, there is no chance of confusion between tools. The single tool has a clear and distinct purpose.
With only one tool, there are no naming inconsistencies. The name 'scan_repository' follows a clear snake_case convention.
A single tool feels thin for most purposes, though for a very specialized server like 'shipcheck' it might be acceptable. It borders on too minimal.
The server only offers one operation (scanning), which may be insufficient for a full workflow. Missing potential tools like listing results or configuration, but the core task is covered.
Open-source licence risk checks for AI coding agents and dependency trees.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.
Stateless TS/JS compiler facts for agents: references, imports, impact. No repo index or OAuth.
