---
title: "Remote MCP Server (Lovable, Base44, browser builders) | ShipSafe"
description: "Connect ShipSafe to Lovable, Base44, or any builder that supports remote MCP. One HTTPS endpoint, a Bearer token, and your agent can scan the code it writes — no install, no GitHub required."
doc_version: 2026-10-05
last_updated: 2026-10-05T09:27:48.583Z
canonical: https://ship-safe.co/docs/remote-mcp
---

# Remote MCP Server (Lovable, Base44, browser builders) | ShipSafe

# Remote MCP Server

ShipSafe runs as a remote [MCP](https://modelcontextprotocol.io) server at a single HTTPS endpoint. Any builder that can connect to a remote MCP server can use it — including browser-based ones like Lovable and Base44, where there is no terminal to install anything into.

If you are working locally in Cursor, Claude Code, or Claude Desktop, use the [local MCP server](https://ship-safe.co/docs/mcp) instead. It can read your files directly and includes tools this endpoint deliberately does not offer.

## Endpoint

TERMINAL

Copy

```bash
POST https://ship-safe.co/api/mcp
```

Stateless Streamable HTTP. Every call is one POST; there are no sessions and no server-initiated stream, so there is nothing to keep alive between requests.

## Authentication

Create a token in [your settings](https://ship-safe.co/settings), then send it as a Bearer token. It is the same token the CLI uses.

TERMINAL

Copy

```bash
Authorization: Bearer YOUR_SHIPSAFE_TOKEN
```

Treat it like a password: it can spend the AI scan quota on your account. If a builder asks you to paste it into a project file rather than a secret store, stop — put it in the secret store.

## Connect it to Lovable

Lovable supports custom MCP connectors. In your Lovable project, add a custom MCP server with the endpoint and header above. Then ask it, in the chat:

TERMINAL

Copy

```bash
Scan this project with ShipSafe and show me anything critical or high.
```

The agent sends your source files to `shipsafe_scan`, gets findings back, and can then call `shipsafe_fix_prompt` to produce a fix it applies in the same chat. You never need a GitHub repository for any of this.

## Tools

- `shipsafe_scan` — send source files, get findings back, ordered by severity.
- `shipsafe_status` — the plan and remaining AI scan quota on the token.
- `shipsafe_fix_prompt` — turn findings into one prompt to paste into your builder.
- `shipsafe_report_false_positive` — mark a finding wrong so it stops counting against you.

## Limits

- 200 files per scan, 500KB per file, 5MB total. Send application source only — no dependencies or build output.
- Scans draw on your monthly AI scan quota, same as any other scan.
- Every scan analyses everything you send. There is no incremental re-scan on this endpoint yet, so a re-scan costs the same as the first one — send the files you want reviewed, not the whole project every time.

## What this endpoint will not do

The remote server exposes a deliberately smaller set of tools than the local one, and two categories are missing on purpose.

**It never probes a live site.** ShipSafe's active checks — the ones that send real traffic at a running app — only run from your own machine, on a target you have confirmed you control. Running them from our servers would mean ShipSafe sending traffic at a host chosen by whoever holds a token, and we will not build that. See [Live App Probing](https://ship-safe.co/docs/dast-scanning), which is local-only for the same reason.

**It cannot read your git history.** [Committed-secret scanning](https://ship-safe.co/docs/git-history-scanning) walks past commits on disk, so it needs the repository itself. Use the CLI or local MCP server for that.

## Verify it works

TERMINAL

Copy

```bash
curl -X POST https://ship-safe.co/api/mcp \
  -H "Authorization: Bearer YOUR_SHIPSAFE_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```

A list of tools means you are connected. A `401` means the token is missing or wrong.

[← PreviousMCP Server](https://ship-safe.co/docs/mcp)[Next →Live URL Scan](https://ship-safe.co/docs/live-url-scanning)

## Sitemap

Every page of this site, in markdown: [https://ship-safe.co/sitemap.md](https://ship-safe.co/sitemap.md)