Patchy, inside your AI agent.
Add Shippable once. Your agent scans the app it's building, reads the proof and applies the fix, before it tells you it's done. Free, runs on your machine. No account to scan your dev server; the full web report needs an email.
claude mcp add shippable -- npx -y shippable-dev mcp
Install
Pick your agent. Other MCP clients take the same JSON.
Plugin (MCP server plus a "check before shipping" skill), inside Claude Code:
Or just the MCP server:
Two tools
shippable_scanChecks the running app from the outside: open database tables, secret keys in the browser, exposed files, missing headers. Your dev server scans straight away; a live URL needs the ownership tag.
shippable_review_codeReads your project: database rules, functions that don't check who's calling, unsigned webhooks, every dependency. Then gives your agent a checklist for what patterns can't catch, like limits enforced only in the frontend or codes that work twice.
What to ask your agent
Make it a rule
Paste this into your AI tool. It writes the rule into AGENTS.md (and CLAUDE.md or Cursor rules if you use them), so your agent won't call it ready until Patchy agrees.
Questions
Is there a server URL?
No. The server runs on your own machine: your AI tool starts it with "npx -y shippable-dev mcp". That's what lets it read your project folder. In the official MCP Registry it's listed as io.github.Egarter/shippable; the npm package is shippable-dev.
Does my code leave my machine?
No. Code checks run locally. Package names and versions go to the public OSV vulnerability database, and each scan sends us an anonymous count (version, scan type, number of findings by severity; never URLs, code or findings). Turn that off with SHIPPABLE_TELEMETRY=0. Live scans talk to your app and its database, read-only.
Can my agent scan any website?
No. Your dev server on localhost scans straight away. A live URL first needs a one-line ownership tag that only the app's owner can deploy; the agent gets the tag and the prompt to add it.
Does it change my app or data?
Never. Every check only reads. When it proves a table is open, it reads at most a few rows as evidence.
What does it cost?
Nothing. The MCP server and the CLI are free and unlimited, including code review and your local dev server. Saving a live app to your Shippable account follows the web pricing: your first app is free, then $1 a month per extra app.
Which agents work?
Any agent that supports MCP servers over stdio: Claude Code, Cursor, Windsurf, VS Code, Cline, Zed and others. Use the JSON config for anything not listed above.
