Skip to content Home / Servers / ShipLatch ShipLatch MCP Server Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
ShipLatch scores 52 (Fair), with no SPDX license recorded. It can be reached as a remote MCP endpoint. It does not declare tools yet. Filed under File systems, Security. Install configs are generated for 10 clients. Being listed in the registry is not the same as being vendor-official.
0 1 Trust score 52 of 100, Fair Fair trust 52 of 100 from six public signals. Nobody can buy a point.
How we score trust Where the 52 comes from 22 + 20 + 0 + 0 + 7 + 3 = 52. Each factor is capped, so no single signal can carry a listing.
Active in the official MCP registry, plus a known vendor namespace.
Registry: 22 of 30 points. How recently the repository saw a commit or release.
Maintenance: 20 of 20 points. Install Pick your client, copy the config, paste it in.
~/Library/Application Support/Claude/claude_desktop_config.json Copy { "mcpServers" : { "shiplatch-scanner" : { "url" : "https://shiplatch.com/mcp" } } } Claude Desktop Claude Code Cursor VS Code Windsurf Zed Cline ChatGPT 0 / 20
GitHub stars and weekly downloads, on a log scale.
Popularity: 0 of 20 points.
A clear, OSI-style open-source license.
License: 0 of 10 points. Not archived, a secure install path, a pinned version.
Security: 7 of 10 points. A real summary, a README with depth, listed tools.
Docs: 3 of 10 points.
Environment variables This server does not declare environment variables.
Tools show up when the registry metadata or the repository README lists them. GitHub enrichment fills this in when a token is configured.
About Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
FAQ
? What is ShipLatch?Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
? How do I install ShipLatch?Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.
? Is ShipLatch official?No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.
? How is the trust score calculated?This listing scores 52 (Fair). The formula is published on the methodology page. Reviews No reviews yet. Used it? Tell the next person how it went.
Sign in to review this server.
Categories Tags No tags yet.
weekly downloads
73 Trust score 73 of 100, Good
Code graph and project memory for coding agents, cited to exact files and lines, on your machine.
FO 71 Trust score 71 of 100, Good
AI agent tools for Open Security Controls Assessment Language (OSCAL)
Br 70 Trust score 70 of 100, Good
Publish HTML, Markdown, sites, KV, JSON and files on BrewPage; keep the returned owner token.
68 Trust score 68 of 100, Good
Safe, self-hosted ZAP operator for guided AI security scans and reports.
Se 68 Trust score 68 of 100, Good
MCP server for Hostkey .com (InvAPI): servers, power, order, DNS, S3, billing
