Ship Safe

Ship Safe is an AI-powered application security platform for developers that runs 18 specialized security agents in parallel against your codebase with a single command. It covers 80+ attack classes including secrets detection, injection vulnerabilities, auth bypass, SSRF, supply chain attacks, LLM/agentic AI security, MCP server misuse, RAG poisoning, PII compliance, and CI/CD pipeline poisoning. The tool provides OWASP 2025 scoring with EPSS exploit probability, compliance mapping to SOC 2, ISO 27001, and NIST AI RMF, and integrates directly into CI/CD pipelines with GitHub PR comments, threshold gating, and SARIF output.

• 18 Security Agents — Run in parallel covering injection, auth bypass, SSRF, supply chain, config auditing, Supabase RLS, LLM/MCP/agentic AI, RAG, PII, vibe coding, CI/CD, API fuzzing, and more.
• Full Audit Command — Run npx ship-safe audit . for a complete scan including secrets, agents, dependency CVEs, scoring, and an interactive HTML remediation report.
• OWASP 2025 Scoring — 8-category weighted scoring system (0-100, A-F grades) aligned with OWASP Top 10 2025 risk rankings with per-finding EPSS exploit probability.
• LLM-Powered Deep Analysis — Use --deep flag with Anthropic, OpenAI, Google, Groq, Ollama, or any OpenAI-compatible provider to verify exploitability of critical findings.
• Secrets Verification — Probes provider APIs (GitHub, Stripe, OpenAI, etc.) with --verify to check if leaked keys are still active.
• CI/CD Integration — Dedicated npx ship-safe ci . command with compact output, exit codes, threshold gating, SARIF export, and GitHub PR comment posting.
• MCP Server Scanning — npx ship-safe scan-mcp vets tool manifests for prompt injection and credential harvesting before connecting.
• Claude Code Hooks — Install real-time hooks via npx ship-safe hooks install to block secrets before they touch disk and inject advisory findings into Claude's context.
• Baseline Management — Accept current findings as a baseline and only report regressions on subsequent scans.
• Incremental Scanning — Caches file hashes and findings for ~40% faster repeated scans; only changed files are re-scanned.
• Policy-as-Code — Enforce team-wide security standards via .ship-safe.policy.json with minimum score, severity thresholds, and CVE age limits.
• Compliance Mapping — Maps findings to SOC 2 Type II, ISO 27001:2022, and NIST AI Risk Management Framework controls.