# Shipcheck MCP

> Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.

- **Type:** MCP server
- **Install:** `agentstack add mcp-tatelyman-shipcheck-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [TateLyman](https://agentstack.voostack.com/s/tatelyman)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.11
- **License:** MIT
- **Upstream author:** [TateLyman](https://github.com/TateLyman)
- **Source:** https://github.com/TateLyman/shipcheck-mcp
- **Website:** https://tateprograms.com/shipcheck.html

## Install

```sh
agentstack add mcp-tatelyman-shipcheck-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# shipcheck-mcp

[](https://www.npmjs.com/package/shipcheck-mcp)
[](https://github.com/TateLyman/shipcheck-mcp/actions/workflows/ci.yml)
[](https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck)
[](https://glama.ai/mcp/servers/TateLyman/shipcheck-mcp)

MCP server that lets local MCP clients run [Shipcheck](https://www.npmjs.com/package/shipcheck-cli) on authorized JavaScript and TypeScript repositories.

Shipcheck scans apps and MCP servers for launch risks such as exposed private-looking env vars, unsigned Stripe webhooks, missing Supabase/Firebase rule evidence, debug routes, missing usage-cost guardrails, missing CI, loose dependencies, thin release docs, missing MCP smoke-test proof, undocumented STDIO execution boundaries, and undocumented remote MCP auth boundaries.

Tool page: https://tateprograms.com/shipcheck.html

Free MCP launch self-check: https://tateprograms.com/mcp-self-check.html

MCP directory launch checklist: https://tateprograms.com/mcp-directory-checklist.html

Paid MCP launch check: https://tateprograms.com/mcp-launch-review.html

Official MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=shipcheck

## Install

Run directly with `npx`:

```bash
npx --yes shipcheck-mcp
```

## MCP Config

Add this server to an MCP client that supports stdio servers:

```json
{
  "mcpServers": {
    "shipcheck": {
      "command": "npx",
      "args": ["--yes", "--package", "shipcheck-mcp", "shipcheck-mcp"]
    }
  }
}
```

STDIO MCP client config launches a local command. Review the `command`, `args`, and any `env` values before running generated configs, keep the package source trusted, and prefer pinned package versions when a deployment needs repeatability.

## Tool

`scan_repository`

```json
{
  "root": ".",
  "format": "markdown",
  "failOn": "medium",
  "strict": true
}
```

Formats: `text`, `markdown`, `json`, or `sarif`.

Severities: `info`, `low`, `medium`, or `high`.

Shipcheck is defensive static analysis, not a penetration test. It reads local project files, does not modify the repository, does not execute project code, and does not require network access. Run it only on repos you own or are authorized to inspect.

## Development

```bash
npm install
npm run check
```

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [TateLyman](https://github.com/TateLyman)
- **Source:** [TateLyman/shipcheck-mcp](https://github.com/TateLyman/shipcheck-mcp)
- **License:** MIT
- **Homepage:** https://tateprograms.com/shipcheck.html

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.11 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.11** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-tatelyman-shipcheck-mcp
- Seller: https://agentstack.voostack.com/s/tatelyman
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.