ShipSafe — Independent security verification

ShipSafe — Independent security verification is a remote MCP server: there is nothing to install. Its endpoint is https://ship-safe.co/api/mcp, served over Streamable HTTP. In an assistant that accepts remote MCP servers (often under a setting named connectors, integrations or tools), add a new server and give it this URL; in a client configured by file, add it as a remote (HTTP) server with the same URL.

The registry entry declares an HTTP header for the connection: Authorization (required, secret). A secret header usually carries an API key or token issued by the service; clients that accept custom headers set it with the server's URL.

It can also run locally from a Node.js package published to the npm registry: @ship-safe/mcp version 0.6.4. It speaks MCP over stdio, so the client starts it as a program and talks to it through standard input and output. It needs Node.js; clients usually start it with npx — the usual command is npx -y @ship-safe/mcp@0.6.4.

In the mcpServers JSON format that many desktop and editor MCP clients read, the entry looks like this (placeholders in angle brackets):

{
  "mcpServers": {
    "scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@ship-safe/mcp@0.6.4"
      ]
    }
  }
}

Derived from the registry entry, not tested here. What the server does, and on what terms, is set by its publisher; check its repository or website before giving it access to your accounts or files. How to add an MCP server to an assistant · Before you connect