ShipLatch

Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers

Install

Remote server: your requests and data go to shiplatch.com. Claude Code: claude mcp add --transport http shiplatch https://shiplatch.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

• scan_url — Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetche
• get_scan — Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept f
• list_checks — List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ponytail-audit 190,451 ★
  Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
• ponytail-debt 190,451 ★
  Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
• security-and-hardening 117,221 ★
  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
• deal-with-security-advisory 113,505 ★
  Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, pr
• html-ppt-knowledge-arch-blueprint