Find risky code, AI-agent vulnerabilities, and supply-chain issues before they ship.

Website · Docs · Pricing · Blog

Ship Safe is an AI security scanner for modern software teams. It runs locally in your repo, finds issues across application code, AI agents, MCP configs, prompts, dependencies, CI/CD, secrets, and cloud-adjacent configuration, then helps you review and apply safe fixes.

Start a scan with one command:

npx ship-safe

No signup. No API key required for scanning. Works offline for core checks.

# Interactive REPL: scan, fix, and ask questions in one session
npx ship-safe

# Full audit: secrets + 29 agents + deps + remediation plan
npx ship-safe audit .

# Interactive fix agent: plan, diff, approve, verify
npx ship-safe agent .
npx ship-safe agent . --severity critical   # critical findings only
npx ship-safe agent . --branch --pr         # fix on a branch + open a PR

# Undo the last fix
npx ship-safe undo

# CI/CD mode
npx ship-safe ci . --threshold 80 --sarif results.sarif

1. Scan locally - Ship Safe inspects your repo with targeted agents and skips checks that do not apply.
2. Review findings - Findings include severity, file location, evidence, and recommended remediation.
3. Fix with control - The agent proposes a plan and diff, asks before writing, verifies the result, and keeps changes reversible.
4. Gate in CI - Use ship-safe ci to fail risky builds and upload SARIF into GitHub code scanning.

• Built for AI-native apps: catches risks in agents, MCP servers, prompts, RAG flows, managed-agent configs, and AI-powered CI.
• Fast local feedback: run it before a PR, during review, or inside CI without sending code to a hosted scanner.
• Fixes are reviewable: every suggested change is shown as a diff before it touches your files.
• Works with your stack: JavaScript, TypeScript, Python, config files, infrastructure files, GitHub Actions, and more.
• Open source core: MIT-licensed CLI with docs, examples, and a growing agent system.

The open-source CLI is the fastest way to scan any repo locally. Upgrade when you need a hosted workflow around the same scanner:

Compare plans at shipsafecli.com/pricing.

All agents run in parallel. Each skips irrelevant projects automatically.

Post-processors: ScoringEngine · VerifierAgent (secrets liveness) · DeepAnalyzer (LLM taint analysis)

$ ship-safe

  ███████╗██╗  ██╗██╗██████╗     ███████╗ █████╗ ███████╗███████╗
  ...

  v9.4.1  ·  DeepSeek  ·  ~/my-project

  /scan to find issues  ·  /agent to fix them  ·  /help for more

shipsafe ›

Anything not starting with / is sent to the LLM as a free-form question, with your latest scan results as context.

# .github/workflows/security.yml
name: Security Audit
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Security gate
        run: npx ship-safe ci . --threshold 75 --sarif results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

Works with any provider — auto-detected from environment variables. Use --provider <name> to override.

Anthropic · OpenAI · Google · DeepSeek · Groq · Together · Mistral · xAI · Perplexity · Ollama · LM Studio · any OpenAI-compatible endpoint

No API key required for scanning. AI is optional.

password = get_password()  # ship-safe-ignore

# .ship-safeignore
tests/fixtures/
docs/

[![Ship Safe](https://img.shields.io/badge/Ship_Safe-A+-22c55e)](https://shipsafecli.com)

1. Fork · add your pattern, agent, or config · open a PR
2. See CONTRIBUTING.md

Ship Safe is MIT-licensed and free forever.

Ship fast. Ship safe. — shipsafecli.com