asamassekou10/ship-safe

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

What it solves

Ship Safe is an AI-powered security scanner designed to find vulnerabilities in modern software projects, with a specific focus on risks introduced by AI agents, LLM integrations, and AI-assisted coding. It identifies issues across application code, AI agent configurations, prompts, dependencies, and CI/CD pipelines to prevent risky code from being shipped.

How it works

The tool operates as a CLI that scans repositories locally. It uses a system of specialized security agents (e.g., LLMRedTeam, RAGSecurityAgent, SupplyChainAudit) that run in parallel to detect specific categories of threats. While core scanning is offline and local, users can optionally connect an LLM provider for deep analysis and red-teaming scenarios. The tool provides a REPL for interactive scanning and fixing, and can be integrated into CI/CD pipelines to fail builds on critical findings.

Who it’s for

It is built for software developers and security teams working on AI-native applications, those using AI coding agents (like Cursor or Windsurf), and teams needing to integrate security gates into their GitHub or GitLab workflows.

Highlights

  • AI-Native Security: Detects prompt injection, agent hijacking, RAG poisoning, and memory poisoning.
  • Agent-Assisted Remediation: Proposes fix plans and diffs that users can review and approve before applying.
  • Broad Coverage: Scans for traditional vulnerabilities (SQLi, XSS) alongside AI-specific risks (MCP server misuse, hallucinated package imports).
  • CI/CD Integration: Supports SARIF output for GitHub code scanning and inline PR comments for critical findings.
  • Local-First: Core checks run locally without requiring an API key or signup.

Related

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using multi-engine analysis.

  • Project
    NVIDIA/SkillSpector

    A security scanner for AI agent skills that detects vulnerabilities and malicious patterns using static analysis and LLM-based semantic evaluation.

  • Project
    AISecurityLab/hackagent

    A security red-teaming toolkit for AI agents that automates the discovery of vulnerabilities like prompt injection and jailbreaking using research-backed attack techniques.

  • Project
    snyk/agent-scan

    A CLI security scanner that discovers AI agents (Claude, Cursor, etc.), their MCP servers, and skills on your machine, and checks them for prompt injection, malicious code, and other vulnerabilities.

  • Project
    openai/codex-security

    A CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code using LLM-powered scanning.