Skip to content
Agentmart
Submit a tool

ShipLatch

Free passive security scan for AI-built apps: leaked API keys, public.env files, security headers

Connector by shiplatch.comOfficial · Domain verified by the MCP Registry

IndexedLicense unknownRemote (HTTP)
Write a review

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/shiplatch-com-scanner

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://shiplatch.com/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
3 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 3

From the running server's own tool list (tools/list) on Oct 25, 2026.

Read 3 · Look things up without changing anything.

  • get_scan
  • list_checks
  • scan_url

Network hosts it talks to 1

  • shiplatch.com · found in remote endpoint, install command

Tools (3)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • get_scanGet a scan resultread-only

    Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.

  • list_checksList what ShipLatch checksread-only

    List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.

  • scan_urlScan a web app (free, passive)read-only

    Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.

Signals

Last release
Oct 22, 2026 (6 days ago)

Details

Registry name
com.shiplatch/scanner
Version
1.0.0
Auth
Auth not stated
License
License unknown
Website
shiplatch.com/mcp
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registry
Cite this page

ShipLatch MCP server. Agent Mart. https://agentmart.dev/connectors/shiplatch-com-scanner (last updated 2026-10-24)