Shipcheck MCP
Run read-only Shipcheck launch-risk scans on authorized JavaScript, TypeScript, and MCP repos before you ship or announce.
Overview
Shipcheck MCP is an MCP server for the Ship phase that runs authorized read-only launch-risk scans on JavaScript, TypeScript, and MCP codebases.
What is this MCP server?
- Read-only Shipcheck scans for JS, TS, and MCP projects
- stdio npm package shipcheck-mcp for local agent wiring
- Focused on launch-risk signals rather than generic lint noise
- Requires authorization to the target repo per Shipcheck model
- Package version 0.1.9
- Transport: stdio via npm identifier shipcheck-mcp
- Scopes: JS, TS, and MCP repos (read-only)
What problem does it solve?
You are about to ship a JS or TS product but lack time for a full security review and want agent-friendly launch-risk signal without risky repo mutations.
Who is it for?
Solo builders shipping npm-based apps, MCP servers, or TS SaaS who already use Shipcheck and want scans inside the agent loop.
Skip if: Unauthorized repos, non-JS/TS stacks, or teams needing write-side remediation bots instead of read-only assessment.
What do I get? / Deliverables
Your agent can trigger Shipcheck scans and surface launch-risk items you can fix or accept before release.
- Launch-risk findings list suitable for pre-release checklists
- Agent-readable scan output to paste into issues or ship docs
- Repeatable pre-launch security pass on the same authorized repo
Recommended MCP Servers
Journey fit
How it compares
MCP hook to Shipcheck launch-risk scanning, not a general SAST marketplace or Claude skill for threat modeling.
Common Questions / FAQ
Who is Shipcheck MCP for?
Developers and indie founders with Shipcheck-authorized JS, TS, or MCP repos who want launch-risk results inside MCP-enabled agents.
When should I use Shipcheck MCP?
Use it in the ship phase after feature freeze when you are validating security and launch readiness before tagging a release or going public.
How do I add Shipcheck MCP to my agent?
Install the shipcheck-mcp npm package and add a stdio MCP server entry per your client docs, then complete Shipcheck authorization for each repo you scan.