OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Ship Safe

Ship Safe is a local JavaScript command-line security tool for software repositories. Its deterministic scanner checks application code and project configuration, including AI-agent and MCP settings, prompts, dependencies and secrets. An investigation layer traces findings and presents supporting evidence; the CLI also produces JSON and SARIF reports.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Ship Safe — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Ship Safe during local review of AI-written code or agent and MCP configuration, before opening an unfamiliar project with an agent, or in CI when you want findings exported and gated.

Who it is for

  • Developers reviewing AI-written software and repository configuration.
  • Teams adding security checks for agents, MCP setups or prompts to repository workflows.
  • Maintainers who want findings investigated and exported for CI or code-scanning workflows.

Documented uses

  • Scan a local repository for code, configuration, dependency and secret-related issues.
  • Investigate findings by tracing data flows and checking for controls across project files.
  • Inspect what may run when opening an unfamiliar folder with an agent, or what a repository agent can reach.
  • Create severity- or verdict-based CI gates and export findings as JSON or SARIF.
  • Compare pull-request findings with a trusted base scan to identify changes.
Before you choose

Requirements & limits

The CLI requires Node.js 22.13+ on the 22.x line, or Node.js 24+. The repository specifies an MIT license. Core scanning does not require an API key; provider-backed modes use a configured provider when available.

  • Core checks run locally and offline; --no-ai is documented for fully local scans.
  • Some provider-backed classification, deep analysis and red-team modes send bounded context to the selected provider after best-effort credential masking.
  • Investigation can trace a value to a sink, search for controls across files and build attack chains across configuration.
  • SARIF is supported, but compatibility with a particular downstream scanning product is not demonstrated.
  • The CLI requires a current Node.js release: 22.13+ on the 22.x line or 24+.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Export repository findings as SARIF in CI mode

Run Ship Safe's CI command and write a SARIF report for a compatible code-scanning workflow.

Before you start

  • Node.js 22.13+ on the 22.x line, or Node.js 24+
  • A local repository to scan
  • A code-scanning workflow that accepts SARIF, if you intend to consume the report there

Steps

  1. Run the command below from the repository.

    Documented command
    npx ship-safe ci . --sarif results.sarif

  2. Use the generated results.sarif as input to a compatible code-scanning workflow.

Expected outcome

Ship Safe writes security findings in SARIF format; a compatible workflow can surface them alongside other scan results.

Guide limitations

  • No specific downstream code-scanning product or compatibility is demonstrated.
  • CI mode can be configured to fail on findings; the documented default example fails on critical findings.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
12 October 2026
Original website title
asamassekou10/ship-safe · Official homepage title · retained in its source language
How we review sourcesSuggest a correction