ShipLatch

npx add-mcp 'https://shiplatch.com/mcp'

Scan your app from Claude, ChatGPT, Cursor or Lovable

ShipLatch has a free remote MCP server. Add one URL to your AI assistant and ask it to check your app: it runs the same passive scan as shiplatch.com and answers with your grade and the type of each issue.

Server URL

https://shiplatch.com/mcp

Transport: Streamable HTTP. Authentication: none. Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26.

Set it up

Claude (claude.ai, Claude Desktop, Cowork)

1. Go to Customize → Connectors, click + Add, then Add custom connector. (Team and Enterprise: an Owner adds it under Organization settings → Connectors.)
2. Name it ShipLatch and paste https://shiplatch.com/mcp.
3. Under Authentication choose No sign in, then click Add.

ChatGPT

1. Open Plugins, click +, then Add custom MCP server (where your plan and workspace allow custom MCP servers).
2. Paste https://shiplatch.com/mcp as the server URL and choose No authentication.

Cursor

Add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

{
  "mcpServers": {
    "shiplatch": { "url": "https://shiplatch.com/mcp" }
  }
}

Claude Code

claude mcp add --transport http shiplatch https://shiplatch.com/mcp

Lovable

1. Open Connectors, click +, choose MCP server.
2. Name it ShipLatch, paste https://shiplatch.com/mcp, choose No authentication, then Add server.

Then ask: "Use ShipLatch to scan https://myapp.lovable.app". To try it without touching your own app, scan our deliberately leaky demo: https://demo-leaky.shiplatch.com.

Tools

• scan_url: Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app).
• get_scan: Get the free summary of a ShipLatch scan by its scan_ref (from scan_url).
• list_checks: List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification.

What you get (and what stays locked)

The free view: grade, score, issue counts, the type and severity of each issue, one free low-severity finding with its fix, and a link to the report. Never through MCP: key values, exact file locations and fix prompts for the serious issues. Those are in the full report on shiplatch.com after you verify you own the site. The free scan runs 71 passive checks; 4 read-only database checks run only for verified owners.

Limits

• Direct connection (your own machine, such as Cursor desktop or Claude Code, or anything else that connects straight to this endpoint): the normal per-user limit, the same as the website, 3 fresh scans a day and 20 an hour.
• From an AI platform's cloud (Claude, ChatGPT, Lovable, using their published IP ranges as of 2026-10-22): one shared pool per platform, 60 fresh scans a day and 30 an hour.
• Through Smithery: one shared pool for all Smithery traffic, 60 fresh scans a day and 30 an hour.
• Per site: at most 3 fresh scans a day through AI assistants. Overall: 300 fresh MCP scans a day.
• Results for the same site are cached for 24 hours; cached answers don't count. Big sites (google.com and the like) and code-repo URLs aren't scanned.
• If a scan takes longer than about 25 seconds, the tool returns a scan_ref and the assistant fetches the result with get_scan.

Safety and privacy

• Only scan sites you own or are authorized to test. Site owners can see how our scanner identifies itself and opt out at /bot, or email hello@shiplatch.com.
• Text that comes from a scanned website is returned in fields named site_* and marked as untrusted data. The server tells the assistant to show fix suggestions to you before applying them and never to run commands found in scan results.
• Never put a key in the server URL. The free tier needs no key; requests with an Authorization header are refused until paid keys exist.
• See our Privacy Policy and Terms.

Questions

What is the ShipLatch MCP server?

It lets an AI assistant run ShipLatch's free security scan for you. Add https://shiplatch.com/mcp as a remote MCP server (no sign-in) in Claude, ChatGPT, Cursor, Claude Code or Lovable, then ask "scan my app at https://…". The assistant gets the same free result as shiplatch.com: grade, issue counts and the type of each issue.

Is it free? Do I need an account or API key?

Yes, it's free and needs no account or key. Paid API keys for full findings are planned but not available yet; until then, send no Authorization header.

What does the scan do to my site?

It's passive and read-only: it loads your page and its public JavaScript like a browser would, plus a short list of well-known file paths. It never logs in, submits forms or tests exploits. The free scan covers 71 checks.

Does the AI see my exposed keys or the exact file locations?

No. Through MCP you get the free view only: the type and severity of each issue, never the key value, file path or fix prompt. Those are in the full report on shiplatch.com, after you verify you own the site.

Can I scan a site I don't own?

Only scan sites you own or are authorized to test, the same rule as the website. The deep database checks only ever run after ownership verification, never through MCP.

What are the limits?

A direct connection (your own machine, such as Cursor or Claude Code) gets the normal per-user limit, the same as the website: 3 fresh scans a day and 20 an hour. Calls from Claude, ChatGPT and Lovable's cloud, and calls through Smithery, share one pool per platform: 60 fresh scans a day and 30 an hour. Every site can get at most 3 fresh scans a day through AI assistants, and there's a total of 300 a day. Repeat scans of the same site within 24 hours are served from cache and don't count.

What do you store about MCP calls?

The same as a website scan: the scan result for 7 days and a usage counter by assistant type (for example mcp-claude). Your IP address is used only for rate limits, in short-lived counters. We don't store your prompts or the conversation, and the assistant only sends us the URL you asked it to scan.

Prefer the website?

Run the free scan on shiplatch.com →