Servidor MCP que permite a los agentes de codificación de IA ejecutar Shipcheck en repositorios locales de JavaScript y TypeScript.
Shipcheck escanea aplicaciones creadas por IA en busca de riesgos de lanzamiento, como variables de entorno que parecen privadas expuestas, webhooks de Stripe sin firmar, falta de evidencia de reglas de Supabase/Firebase, rutas de depuración, falta de medidas de seguridad en el uso de IA, falta de CI, dependencias sueltas y documentación de lanzamiento escasa.
Página de la herramienta: https://tatelyman.github.io/tate-web-services/shipcheck.html
Registro oficial de MCP: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck
Repositorio de demostración con alertas de escaneo de código de GitHub: https://github.com/TateLyman/shipcheck-demo-ai-app
Ejecutar directamente con npx:
npx --yes shipcheck-mcpRelated MCP server: CodeInspectus
Añade este servidor a un cliente MCP que admita servidores stdio:
{
"mcpServers": {
"shipcheck": {
"command": "npx",
"args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
}
}
}scan_repository
{
"root": ".",
"format": "markdown",
"failOn": "medium",
"strict": true
}Formatos: text, markdown, json o sarif.
Gravedades: info, low, medium o high.
Shipcheck es un análisis estático defensivo, no una prueba de penetración. Ejecútalo solo en repositorios que poseas o que estés autorizado a inspeccionar.
npm install
npm run checkRun Shipcheck on a local JavaScript or TypeScript repo the user owns or is authorized to inspect.
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Local path to the repository root. | . |
| format | No | Report format to return. | text |
| failOn | No | Lowest severity that should mark the report as failing. | high |
| strict | No | Enable stricter release-readiness checks. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only hints at authorization but does not state whether the operation is read-only, modifies files, requires network, or has rate limits. This is insufficient for a scanning tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundant words. It is front-loaded with the action and conditions, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 4 parameters and no output schema, the description does not explain what Shipcheck is, what the report contains, or how the 'failOn' and 'strict' parameters affect behavior. This leaves significant gaps for an agent to select the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented. The overall description adds context about the tool being for JS/TS repos, but does not enhance parameter meaning beyond what the schema provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Run Shipcheck), the resource (local JavaScript or TypeScript repo), and includes an authorization condition. No sibling tools exist, so differentiation is not required.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage on local JS/TS repos the user is authorized to inspect, but does not provide explicit guidance on when to use or when not to use it, nor any alternatives since there are no siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.3scan_repositoryScored across 1 tool
With only one tool, there is no chance of confusion between tools. The single tool has a clear and distinct purpose.
With only one tool, there are no naming inconsistencies. The name 'scan_repository' follows a clear snake_case convention.
A single tool feels thin for most purposes, though for a very specialized server like 'shipcheck' it might be acceptable. It borders on too minimal.
The server only offers one operation (scanning), which may be insufficient for a full workflow. Missing potential tools like listing results or configuration, but the core task is covered.
Open-source licence risk checks for AI coding agents and dependency trees.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.
Stateless TS/JS compiler facts for agents: references, imports, impact. No repo index or OAuth.
