Skip to main content
ShipSafe
Sign In

Remote MCP Server

ShipSafe runs as a remote MCP server at a single HTTPS endpoint. Any builder that can connect to a remote MCP server can use it — including browser-based ones like Lovable and Base44, where there is no terminal to install anything into.

If you are working locally in Cursor, Claude Code, or Claude Desktop, use the local MCP server instead. It can read your files directly and includes tools this endpoint deliberately does not offer.

Endpoint

TERMINAL
POST https://ship-safe.co/api/mcp

Stateless Streamable HTTP. Every call is one POST; there are no sessions and no server-initiated stream, so there is nothing to keep alive between requests.

Authentication

Create a token in your settings, then send it as a Bearer token. It is the same token the CLI uses.

TERMINAL
Authorization: Bearer YOUR_SHIPSAFE_TOKEN

Treat it like a password: it can spend the AI scan quota on your account. If a builder asks you to paste it into a project file rather than a secret store, stop — put it in the secret store.

Connect it to Lovable

Lovable supports custom MCP connectors. In your Lovable project, add a custom MCP server with the endpoint and header above. Then ask it, in the chat:

TERMINAL
Scan this project with ShipSafe and show me anything critical or high.

The agent sends your source files to shipsafe_scan, gets findings back, and can then call shipsafe_fix_prompt to produce a fix it applies in the same chat. You never need a GitHub repository for any of this.

Tools

  • shipsafe_scan — send source files, get findings back, ordered by severity.
  • shipsafe_status — the plan and remaining AI scan quota on the token.
  • shipsafe_fix_prompt — turn findings into one prompt to paste into your builder.
  • shipsafe_report_false_positive — mark a finding wrong so it stops counting against you.

Limits

  • 200 files per scan, 500KB per file, 5MB total. Send application source only — no dependencies or build output.
  • Scans draw on your monthly AI scan quota, same as any other scan.
  • Every scan analyses everything you send. There is no incremental re-scan on this endpoint yet, so a re-scan costs the same as the first one — send the files you want reviewed, not the whole project every time.

What this endpoint will not do

The remote server exposes a deliberately smaller set of tools than the local one, and two categories are missing on purpose.

It never probes a live site.ShipSafe's active checks — the ones that send real traffic at a running app — only run from your own machine, on a target you have confirmed you control. Running them from our servers would mean ShipSafe sending traffic at a host chosen by whoever holds a token, and we will not build that. See Live App Probing, which is local-only for the same reason.

It cannot read your git history. Committed-secret scanning walks past commits on disk, so it needs the repository itself. Use the CLI or local MCP server for that.

Verify it works

TERMINAL
curl -X POST https://ship-safe.co/api/mcp \
  -H "Authorization: Bearer YOUR_SHIPSAFE_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

A list of tools means you are connected. A 401 means the token is missing or wrong.

← PreviousMCP ServerNext →Live URL Scan