Releases·Tool Release
Ship Safe CLI audits LLM coding agent security across repos, MCP configs, and PRs with evidence-based verdicts
A developer released Ship Safe, an MIT-licensed open-source CLI that investigates security risks at the boundary between untrusted repository content and LLM coding-agent capabilities. It records citations and capability paths across agent and MCP configuration, pull requests, dependencies, and application code, deriving verdicts only when evidence supports them. In a manual audit of four flagged application confirmations, only one held up despite green automated test suites.
1 engagement1 sourceFri, Sep 4, 2026, 10:04 AM
AI Overview
- Ship Safe, an MIT-licensed open-source CLI by asamassekou10, records citations and capability paths across agent and MCP configuration, PRs, dependencies, and application code
- Pattern matches are not auto-treated as exploits; verdicts derive only when evidence supports the conclusion
- In a manual audit of four application confirmations, only one held up while automated test suites stayed green
Entities
Related
Products·building
Ship Safe — open-source security agent for AI-written software
Ship Safe is an open-source security agent that reviews code written by AI. It combines deterministic checks with an LLM investigation layer that explains whether a finding is real, uncertain, or refuted. A recent change removed confidence scores and tightened fix verification so 'detector no longer reports it' is no longer treated as a confirmed fix.
Ship Safe is an open-source security agent that reviews code written by AI. It combines deterministic checks with an LLM investigation layer that explains whether a finding is real, uncertain, or refuted. A recent change removed confidence scores and tightened fix verification so 'detector no longer reports it' is no longer treated as a confirmed fix.
3 engagement1 sourceredditSat, Oct 17, 2026, 07:18 AM
Products·building
Ship Safe: local CLI security investigation layer for AI-assisted (vibe-coded) projects
Ship Safe is a local CLI for auditing security in AI-assisted development projects. It goes beyond detecting suspicious content by tracing evidence and capability paths (e.g., to credentials or side effects) before producing verdicts with human confirmation. It targets developers using LLM-generated code who need to verify that 'green' security results actually hold up.
Ship Safe is a local CLI for auditing security in AI-assisted development projects. It goes beyond detecting suspicious content by tracing evidence and capability paths (e.g., to credentials or side effects) before producing verdicts with human confirmation. It targets developers using LLM-generated code who need to verify that 'green' security results actually hold up.
1 engagement1 sourceredditFri, Sep 4, 2026, 09:51 AM
Social·Community
When the Agent Can Be Persuaded, Part 2: Threat Analysis of an AI Agent, from Start to Finish
A Medium article presents part 2 of an agent security threat analysis, walking through the GitHub MCP case step by step. It frames the analysis using OWASP Top 10 lists and MITRE ATLAS, offering practitioners a structured method for evaluating AI agent vulnerabilities.
A Medium article presents part 2 of an agent security threat analysis, walking through the GitHub MCP case step by step. It frames the analysis using OWASP Top 10 lists and MITRE ATLAS, offering practitioners a structured method for evaluating AI agent vulnerabilities.
0 engagement1 sourcerssSun, Oct 11, 2026, 09:20 PM
Products·launched
Ship Safe: Open-source security scanner for AI agents, MCP, secrets, and CI/CD
Ship Safe is an open-source security scanner that scans modern codebases for vulnerabilities across AI agents, MCP servers, prompts, tool permissions, RAG pipelines, CI workflows, and third-party AI dependencies. It detects issues like prompt injection, dangerous MCP configurations, hardcoded secrets, CI/CD misconfigurations, supply-chain risks, and auth/API vulnerabilities, helping developers secure their AI-integrated applications.
Ship Safe is an open-source security scanner that scans modern codebases for vulnerabilities across AI agents, MCP servers, prompts, tool permissions, RAG pipelines, CI workflows, and third-party AI dependencies. It detects issues like prompt injection, dangerous MCP configurations, hardcoded secrets, CI/CD misconfigurations, supply-chain risks, and auth/API vulnerabilities, helping developers secure their AI-integrated applications.
1 engagement1 sourceredditMon, Aug 24, 2026, 03:29 AM
Social·Community
How do you define a useful security verdict for an AI agent?
A Reddit post asks how to decide when an AI-agent security finding is strong enough to block a run. The author notes that a suspicious pattern in a pull request or tool description may merit investigation without proving the agent can reach a credential or cause a side effect. They are testing a workflow that keeps detection, evidence, verdict, and human confirmation as separate stages.
A Reddit post asks how to decide when an AI-agent security finding is strong enough to block a run. The author notes that a suspicious pattern in a pull request or tool description may merit investigation without proving the agent can reach a credential or cause a side effect. They are testing a workflow that keeps detection, evidence, verdict, and human confirmation as separate stages.
11 engagement1 sourceredditFri, Sep 4, 2026, 08:44 AM