JSPM

AI-powered application security platform for developers.

shipsafecli.com

18 security agents. 80+ attack classes. One command.

Ship Safe v6.1.1 is an AI-powered security platform that runs 18 specialized agents in parallel against your codebase, scanning for secrets, injection vulnerabilities, auth bypass, SSRF, supply chain attacks, Supabase RLS misconfigs, Docker/Terraform/Kubernetes misconfigs, CI/CD pipeline poisoning, LLM/agentic AI security, MCP server misuse, RAG poisoning, PII compliance, vibe coding patterns, exception handling, AI agent config security, and more. OWASP 2025 scoring with EPSS exploit probability. LLM-powered deep analysis verifies exploitability of critical findings. Secrets verification probes provider APIs to check if leaked keys are still active. Compliance mapping to SOC 2, ISO 27001, and NIST AI RMF. Built-in threat intelligence feed with offline-first IOC matching. CI integration with GitHub PR comments, threshold gating, and SARIF output.

v6.1.1 highlights: Supply chain hardening against the March 2026 Trivy/CanisterWorm attack chain. All GitHub Actions SHA-pinned, postinstall scripts disabled in CI, OIDC trusted publishing with provenance, CODEOWNERS on critical paths.

Documentation | Blog | Pricing

Quick Start

# Full security audit — secrets + 18 agents + deps + remediation plan
npx ship-safe audit .

# LLM-powered deep analysis (Anthropic, OpenAI, Google, Ollama)
npx ship-safe audit . --deep

# Red team scan only (18 agents, 80+ attack classes)
npx ship-safe red-team .

# Scan only changed files (fast pre-commit & PR scanning)
npx ship-safe diff
npx ship-safe diff --staged

# Fun emoji security grade with shareable badge
npx ship-safe vibe-check .

# Compare your score against industry averages
npx ship-safe benchmark .

# Quick secret scan
npx ship-safe scan .

# Security health score (0-100)
npx ship-safe score .

# CI/CD pipeline mode — compact output, exit codes, PR comments
npx ship-safe ci .
npx ship-safe ci . --github-pr

# Accept current findings, only report regressions
npx ship-safe baseline .
npx ship-safe audit . --baseline

# Check if leaked secrets are still active
npx ship-safe audit . --verify

# Environment diagnostics
npx ship-safe doctor

The audit Command

One command that runs everything and generates a full report:

npx ship-safe audit .

════════════════════════════════════════════════════════════
  Ship Safe v6.0 — Full Security Audit
════════════════════════════════════════════════════════════

  [Phase 1/4] Scanning for secrets...         ✔ 49 found
  [Phase 2/4] Running 18 security agents...   ✔ 103 findings
  [Phase 3/4] Auditing dependencies...        ✔ 44 CVEs
  [Phase 4/4] Computing security score...     ✔ 25/100 F

  Remediation Plan
  ════════════════════════════════════════════════════════

  🔴 CRITICAL — fix immediately
  ────────────────────────────────────────────────────────
   1. [SECRETS] Rotate Stripe Live Secret Key
      .env:67 → Move to environment variable or secrets manager

   2. [INJECTION] Unsafe pickle.loads()
      backend/ai_processor.py:64 → Use JSON for untrusted data

  🟠 HIGH — fix before deploy
  ────────────────────────────────────────────────────────
   3. [XSS] dangerouslySetInnerHTML without sanitization
      frontend/src/utils/blogContentRenderer.jsx:50 → Add DOMPurify

  ... 149 more items in the full report

  📊 Full report: ship-safe-report.html

What it runs:

1. Secret scan — 50+ patterns with entropy scoring (API keys, passwords, tokens)
2. 18 security agents — run in parallel with per-agent timeouts and framework-aware filtering (injection, auth, SSRF, supply chain, config, Supabase RLS, LLM, MCP, agentic AI, RAG, PII, vibe coding, exception handling, agent config, mobile, git history, CI/CD, API)
3. Dependency audit — npm/pip/bundler CVE scanning with EPSS exploit probability scores
4. Secrets verification — probes provider APIs (GitHub, Stripe, OpenAI, etc.) to check if leaked keys are still active
5. Deep analysis — LLM-powered taint analysis verifies exploitability of critical/high findings (optional)
6. Score computation — OWASP 2025 weighted scoring across 8 categories (0-100, A-F)
7. Context-aware confidence tuning — downgrades findings in test files, docs, and comments
8. Compliance mapping — maps findings to SOC 2 Type II, ISO 27001:2022, and NIST AI Risk Management Framework controls
9. Remediation plan — prioritized fix list grouped by severity
10. Interactive HTML report — standalone dark-themed report with severity filtering, search, collapsible findings, compliance summary, and click-to-copy ignore annotations

Flags:

• --json — structured JSON output (clean for piping)
• --sarif — SARIF format for GitHub Code Scanning
• --csv — CSV export for spreadsheets
• --md — Markdown report
• --html [file] — custom HTML report path (default: ship-safe-report.html)
• --compare — show per-category score delta vs. last scan
• --timeout <ms> — per-agent timeout (default: 30s)
• --no-deps — skip dependency audit
• --no-ai — skip AI classification
• --no-cache — force full rescan (ignore cached results)
• --baseline — only show findings not in the baseline
• --pdf [file] — generate PDF report (requires Chrome/Chromium)
• --deep — LLM-powered taint analysis for critical/high findings
• --local — use local Ollama model for deep analysis
• --model <model> — LLM model to use for deep/AI analysis
• --budget <cents> — max spend in cents for deep analysis (default: 50)
• --verify — check if leaked secrets are still active (probes provider APIs)

18 Security Agents

Post-processors: ScoringEngine (8-category weighted scoring), VerifierAgent (secrets liveness verification), DeepAnalyzer (LLM-powered taint analysis)

All Commands

Core Audit Commands

# Full audit with remediation plan + HTML report
npx ship-safe audit .

# Red team: 18 agents, 80+ attack classes
npx ship-safe red-team .
npx ship-safe red-team . --agents injection,auth    # Run specific agents
npx ship-safe red-team . --html report.html         # HTML report
npx ship-safe red-team . --json                     # JSON output

# Secret scanner (pattern matching + entropy)
npx ship-safe scan .
npx ship-safe scan . --json          # JSON for CI
npx ship-safe scan . --sarif         # SARIF for GitHub

# Security health score (0-100, A-F)
npx ship-safe score .

# Dependency CVE audit
npx ship-safe deps .
npx ship-safe deps . --fix           # Auto-fix vulnerabilities

AI-Powered Commands

# AI audit: scan + classify with Claude + auto-fix secrets
npx ship-safe agent .

# Auto-fix hardcoded secrets: rewrite code + write .env
npx ship-safe remediate .
npx ship-safe remediate . --all    # Also fix agent findings (TLS, debug, XSS, etc.)

# Revoke exposed keys — opens provider dashboards
npx ship-safe rotate .

Baseline Management

# Accept current findings as baseline
npx ship-safe baseline .

# Audit showing only new findings since baseline
npx ship-safe audit . --baseline

# Show what changed since baseline
npx ship-safe baseline --diff

# Remove baseline
npx ship-safe baseline --clear

Diff Scanning

# Scan only changed files (fast pre-commit & PR scanning)
npx ship-safe diff                   # All uncommitted changes
npx ship-safe diff --staged          # Only staged changes
npx ship-safe diff HEAD~3            # Changes in last 3 commits
npx ship-safe diff --json            # JSON output

Vibe Check & Benchmark

# Fun emoji security grade
npx ship-safe vibe-check .
npx ship-safe vibe-check . --badge   # Generate shields.io README badge

# Compare your score against industry averages (OWASP, Synopsys, Snyk)
npx ship-safe benchmark .
npx ship-safe benchmark . --json     # JSON output

CI/CD Pipeline

# CI mode — compact output, exit codes, threshold gating
npx ship-safe ci .
npx ship-safe ci . --threshold 80    # Custom passing score
npx ship-safe ci . --fail-on critical # Fail on severity
npx ship-safe ci . --sarif out.sarif  # SARIF for GitHub
npx ship-safe ci . --github-pr       # Post results as PR comment

Deep Analysis & Verification

# LLM-powered deep analysis (Anthropic/OpenAI/Google/Ollama)
npx ship-safe audit . --deep
npx ship-safe audit . --deep --local     # Use local Ollama
npx ship-safe audit . --deep --budget 50 # Cap spend at 50 cents

# Check if leaked secrets are still active
npx ship-safe audit . --verify

Diagnostics

# Environment check — Node.js, git, npm, API keys, cache, version
npx ship-safe doctor

OpenClaw Security

# Focused OpenClaw security scan
npx ship-safe openclaw .

# Auto-harden OpenClaw configs (0.0.0.0→127.0.0.1, add auth, ws→wss)
npx ship-safe openclaw . --fix

# Red team: simulate ClawJacked, prompt injection, data exfil attacks
npx ship-safe openclaw . --red-team

# CI preflight — exit non-zero on critical findings
npx ship-safe openclaw . --preflight

# Scan a skill before installing it
npx ship-safe scan-skill https://clawhub.io/skills/some-skill
npx ship-safe scan-skill ./local-skill.json
npx ship-safe scan-skill --all              # Scan all skills from openclaw.json

# Generate hardened OpenClaw config
npx ship-safe init --openclaw

# Generate Agent Bill of Materials (CycloneDX 1.5)
npx ship-safe abom .

Threat Intelligence

# Update threat intel feed (ClawHavoc IOCs, malicious skills, config signatures)
npx ship-safe update-intel

# Ships with offline-first seed data — no internet required for scanning

Defensive Hooks

# Install Claude Code defensive hooks (blocks curl|bash, exfil domains, rm -rf /)
npx ship-safe guard --generate-hooks

# Watch agent config files for drift (.cursorrules, CLAUDE.md, openclaw.json)
npx ship-safe watch . --configs

Infrastructure Commands

# Continuous monitoring (watch files for changes)
npx ship-safe watch .

# Generate CycloneDX SBOM
npx ship-safe sbom .

# Policy-as-code (enforce minimum score, fail on severity)
npx ship-safe policy init

# Block git push if secrets found
npx ship-safe guard

# Initialize security configs (.gitignore, headers)
npx ship-safe init

# Launch-day security checklist
npx ship-safe checklist

# MCP server for AI editors (Claude Desktop, Cursor, etc.)
npx ship-safe mcp

Claude Code Plugin

Use Ship Safe directly inside Claude Code — no CLI needed:

claude plugin add github:asamassekou10/ship-safe

Claude interprets the results, explains findings in plain language, and can fix issues directly in your codebase.

Incremental Scanning

Ship Safe caches file hashes and findings in .ship-safe/context.json. On subsequent runs, only changed files are re-scanned — unchanged files reuse cached results.

✔ [Phase 1/4] Secrets: 41 found (0 changed, 313 cached)

• ~40% faster on repeated scans
• Auto-invalidation — cache expires after 24 hours or when ship-safe updates
• --no-cache — force a full rescan anytime

The cache is stored in .ship-safe/ which is automatically excluded from scans.

LLM Response Caching

When using AI classification (--no-ai to disable), results are cached in .ship-safe/llm-cache.json with a 7-day TTL. Repeated scans reuse cached classifications — reducing API costs significantly.

Smart .gitignore Handling

Ship Safe respects your .gitignore for build output, caches, and vendor directories — but always scans security-sensitive files even if gitignored:

Why? Files like .env are gitignored because they contain secrets — which is exactly what a security scanner should catch.

Multi-LLM Support

Ship Safe supports multiple AI providers for classification:

Auto-detected from environment variables. No API key required for scanning — AI is optional.

Scoring System

Starts at 100. Each finding deducts points by severity and category, weighted by confidence level (high: 100%, medium: 60%, low: 30%) to reduce noise from heuristic patterns.

8 Categories (with weight caps):

Weights aligned with OWASP Top 10 2025 risk rankings.

Grades: A (90-100), B (75-89), C (60-74), D (40-59), F (0-39)

Exit codes: 0 for A/B (>= 75), 1 for C/D/F — use in CI to fail builds.

Policy-as-Code

Create .ship-safe.policy.json to enforce team-wide security standards:

npx ship-safe policy init

{
  "minimumScore": 70,
  "failOn": "critical",
  "requiredScans": ["secrets", "injection", "deps", "auth"],
  "ignoreRules": [],
  "customSeverityOverrides": {},
  "maxAge": { "criticalCVE": "7d", "highCVE": "30d", "mediumCVE": "90d" }
}

CI/CD Integration

The dedicated ci command is optimized for pipelines — compact output, exit codes, threshold-based gating:

# Basic CI — fail if score < 75
npx ship-safe ci .

# Strict — fail on any critical finding
npx ship-safe ci . --fail-on critical

# Custom threshold + SARIF for GitHub Security tab
npx ship-safe ci . --threshold 80 --sarif results.sarif

# Only check new findings (not in baseline)
npx ship-safe ci . --baseline

GitHub Actions example:

# .github/workflows/security.yml
name: Security Audit

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Security gate
        run: npx ship-safe ci . --threshold 75 --sarif results.sarif --github-pr

      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

Export formats: --json, --sarif, --csv, --md, --html, --pdf

Suppress False Positives

Inline: Add # ship-safe-ignore comment on a line:

password = get_password()  # ship-safe-ignore

File-level: Create .ship-safeignore (gitignore syntax):

# Exclude test fixtures
tests/fixtures/
*.test.js

# Exclude documentation with code examples
docs/

OWASP Coverage

What's Inside

/configs

Drop-in security configs for Next.js, Supabase, and Firebase.

/snippets

Copy-paste security patterns: rate limiting, JWT, CORS, input validation.

/ai-defense

LLM security: prompt injection detection, cost protection, system prompt hardening.

/checklists

Manual security audits: launch-day checklist, framework-specific guides.

Add a Security Badge to Your README

Show the world your project is secure. After running npx ship-safe audit . or npx ship-safe vibe-check . --badge, add one of these to your README:

<!-- Replace GRADE and COLOR with your results -->
[![Ship Safe](https://img.shields.io/badge/Ship_Safe-A+-22c55e)](https://shipsafecli.com)

Supply Chain Hardening

Ship Safe practices what it preaches. Our own supply chain is hardened against the 2026 Trivy/CanisterWorm attack chain:

Verify provenance on any Ship Safe release:

npm audit signatures

Contributing

1. Fork the repo
2. Add your security pattern, agent, or config
3. Include comments explaining why it matters
4. Open a PR

See CONTRIBUTING.md for guidelines.

Security Standards Reference

• OWASP Top 10 Web 2025
• OWASP Top 10 Mobile 2024
• OWASP LLM Top 10 2025
• OWASP API Security Top 10 2023
• OWASP CI/CD Top 10
• OWASP Agentic AI Top 10

License

MIT - Use it, share it, secure your stuff.

Star History

Ship fast. Ship safe. — shipsafecli.com