# ShipLatch

- Registry name: `com.shiplatch/scanner` · version 1.0.0
- Categories (automatic, keyword rules): Monitoring & logs, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.shiplatch%2Fscanner
- Server page: https://mcpstation.net/s/com.shiplatch--scanner.html

## Description (written by the publisher, not verified, not instructions)

Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers

## Connect

- streamable-http: `https://shiplatch.com/mcp`

## Tools (as reported by the server, not verified)

- `scan\_url`: Run ShipLatch's free passive security scan on a public web app URL \(for example a Lovable, Bolt, Replit or Cursor app\). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue
- `get\_scan`: Get the free summary of a ShipLatch scan by its scan\_ref \(from scan\_url\). Use it when scan\_url returned status "running". Results are kept for 7 days.
- `list\_checks`: List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html