Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
Connect Remote server
claude mcp add --transport http scanner https://shiplatch.com/mcp
{
"mcpServers": {
"scanner": {
"url": "https://shiplatch.com/mcp"
}
}
}
{
"servers": {
"scanner": {
"type": "http",
"url": "https://shiplatch.com/mcp"
}
}
}
Settings > Connectors > Add custom connector
URL: https://shiplatch.com/mcp
Tools 3 found in our last check
scan_urlRun ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and t…
get_scanGet the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.
list_checksList the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.
Details
| Endpoint | https://shiplatch.com/mcp (Streamable HTTP) |
| First published | 22 Oct 2026 |
| Last updated | 22 Oct 2026 |
| Registry name | com.shiplatch/scanner |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
