How do I connect Ship Safe MCP Server to Claude?

Run `claude mcp add ship-safe -- npx -y ship-safe` in Claude Code, or add the same command and arguments under mcpServers in Cursor's mcp.json or Claude Desktop's claude_desktop_config.json, then restart the client. The blocks above are ready to paste.

Is Ship Safe MCP Server free?

The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.

What can Ship Safe MCP Server do?

MCPVault has not yet recorded the tool list for Ship Safe MCP Server; it is captured when the server passes a live MCP handshake. The description above is what the project publishes.

Ship Safe

Claimed

by asamassekou10

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

Set up this server

Compare servers My Stack

01 / Choose your client

02 / Before you connect

Authentication is not specified. Check the project instructions before connecting.

Install the runtime required by the project and make it available to your client.

Project instructionsEnvironment variable names (optional)

Use names from the project instructions, separated by commas. Enter names only, never secret values.

03 / Add the configuration

Source: generated from public install instructions

claude mcp add --transport stdio 'ship-safe' -- 'npx' '-y' 'ship-safe'

Run in your terminal after replacing any placeholders.

04 / Check it in your client

Open your client’s MCP settings and confirm the server connects and lists its tools. A copied configuration does not confirm a working connection.

agentic-aiai-securityclidevscopsllm-securitymcpnpmowaspsecretssecuritysecurity-toolsstatic-analysis

Show this listing on your README and website

Get verified and your listing links back to your site with a do-follow link. The badge is optional while first-100 launch spots remain.

Get the embed code

Security profile

Exposure: Extensive

Reaches several sensitive areas at once. Read the list before installing.

What this server can reach, from a static read of the shipped code. Nothing was executed and nothing here is a verdict: a browser tool has to run commands and an API wrapper has to call its API. Decide what fits your setup.

NVIDIA SkillSpector v2.11.0, MCPVault MCP-server policy. Scanned yesterday @ ae4010c.

Detected

Talks to external services37 places
Makes outbound requests. The hosts are listed so you can see where data goes.
api.anthropic.com, api.cohere.com, api.deepseek.com, api.first.org, api.github.com, api.groq.com, api.mistral.ai, api.moonshot.ai, api.openai.com, api.osv.dev, api.perplexity.ai, api.sendgrid.com, api.slack.com, api.stripe.com, api.together.xyz, api.vercel.com
Reads environment variables in bulk2 places
Copies or enumerates the whole environment, which can include keys meant for other tools.
Sends conversation content outward1 places
Logs or forwards prompts, messages or tool results to a service outside your machine.
Runs shell commands1 places
Spawns processes on your machine. Expected for command, browser and build tools.
Reads or writes other agents' configuration5 places
Touches folders such as ~/.claude, ~/.codex or ~/.cursor, which hold settings and sometimes keys.
Reads local configuration files5 places
Loads a .env, .npmrc or config file. Normal for a server that needs an API key.
Contains instructions aimed at AI agents37 places
Text in code or agent-facing files that steers a model. Worth reading before you trust it.
Passes model output on without checks3 places
Model output reaches HTML, SQL or a shell without validation.
Runs unpinned packages at runtime191 places
Executes npx or uvx without a version, so a compromised upstream release would run.

Not detected: accesses credential files, uses elevated privileges, installs itself to run later, matches a known malicious pattern.

Dependencies with known advisories

None found in the lockfiles and manifests checked against OSV.dev.

Left out of the profile

79 pattern matches in documentation, configuration or CI files were recorded but are not part of the profile, because they do not run when the server does. The owner dashboard lists them.

How the profile works Maintainers see file, line and a fix for each item in their dashboard.

Tool change history

Compared across complete checks of the same configuration. Tools were listed, not invoked. Input-schema changes are not measured here.

No complete tool checks yet.

FAQ

Questions about Ship Safe MCP Server

How do I connect Ship Safe MCP Server to Claude?: Run `claude mcp add ship-safe -- npx -y ship-safe` in Claude Code, or add the same command and arguments under mcpServers in Cursor's mcp.json or Claude Desktop's claude_desktop_config.json, then restart the client. The blocks above are ready to paste.
Is Ship Safe MCP Server free?: The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
What can Ship Safe MCP Server do?: MCPVault has not yet recorded the tool list for Ship Safe MCP Server; it is captured when the server passes a live MCP handshake. The description above is what the project publishes.