ShipScanner MCP Server

Code quality scanning for AI agents. Gives Claude Code, Cursor, Windsurf, and any MCP-compatible agent the ability to scan GitHub repos for security, secrets, dependencies, and code quality.

Score range: 300-850. 7 scanners. One score.

Setup

Claude Code

claude mcp add shipscanner -- npx shipscanner-mcp

Or with an API key for higher rate limits:

claude mcp add shipscanner -e SHIPSCANNER_API_KEY=sk_your_key -- npx shipscanner-mcp

Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "shipscanner": {
      "command": "npx",
      "args": ["shipscanner-mcp"],
      "env": {
        "SHIPSCANNER_API_KEY": "sk_your_key"
      }
    }
  }
}

Windsurf

Add to your MCP config:

{
  "mcpServers": {
    "shipscanner": {
      "command": "npx",
      "args": ["shipscanner-mcp"]
    }
  }
}

Tools

scan_repository

Scan a GitHub repository for code quality issues.

Parameters:

• repo_url (required) — GitHub URL or owner/repo shorthand
• branch (optional) — Branch to scan

Returns: Score (300-850), grade, category breakdown, top findings, and link to full report.

get_scan_report

Get the full detailed report for a completed scan.

Parameters:

• scan_id (required) — Scan ID returned by scan_repository

Returns: Complete JSON report with all findings, categories, and metadata.

Environment Variables

| Variable | Description | Default | |----------|-------------|---------| | SHIPSCANNER_API_KEY | API key for higher rate limits and private repos | None (anonymous) | | SHIPSCANNER_API_URL | API endpoint | https://shipscanner.dev |

Example Usage

Once configured, just ask your AI agent:

"Scan this repo for code quality issues"

"What's the ShipScanner score for owner/repo?"

"Check if there are any security vulnerabilities in this codebase"

The agent will automatically call the scan_repository tool and show you the results.

Links

• ShipScanner
• CLI
• GitHub Action

License

MIT