ship safe

Abstract

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

The Problem

Development teams building with AI agents face uncoordinated security risks: hardcoded secrets, agent permission overreach, prompt injection, and CI/CD misconfigurations that go undetected until after deployment. Existing tools scan for individual issues but don't integrate agentic AI security patterns, supply-chain risk, and runtime credential exposure into a single workflow.

What This Does

Ship Safe is a CLI security scanner built for the agentic era, comprising 7 self-contained projects under one organization. The core cli (85 files, 84 code files) runs 22 specialized agents against codebases, detecting secrets, injection vulnerabilities, auth bypass, SSRF, supply-chain attacks, memory poisoning, and more. The webapp (218 files) provides a dashboard for findings, agent studio, and team orchestration. The ai-defense module contains prompt-injection patterns, LLM security checklists, and system-prompt armor. The vps/orchestrator/index.js runs the VPS deployment workflow but contains a HIGH-severity eval() over a runtime value. The vscode-extension provides editor integration. The claude-code-plugin adds skills for Claude Code integration. The snippets and configs directories hold reusable patterns and configurations.

How It Is Wired

Execution starts at cli/index.js (entry point referenced in package.json). The main function in cli/hooks/post-tool-use.js:33 reaches 10 functions and is called from 1 place. The buildOrchestratorAsync in cli/agents/index.js:114 reaches 5 functions, called from 3 places. The allocatePort in vps/orchestrator/index.js:67 reaches 3 functions. The internal call graph shows 646 resolved call edges; readFile is called from 26 places, header from 25, createFinding from 19. The cli/utils/output.js defines header, success, warning, error and is called from 19 other files — a hub with blast radius across the audit pipeline. The cli/commands/audit.js performs cryptographic operations and file reads/writes, defining auditCommand, runAuditInner, buildRemediationPlan, printReport, outputJSON. Import cycles exist in webapp/lib/guardian/pipeline.ts, analyze.ts, diagnose.ts — six modules mutually reachable, requiring extraction of shared types or deferred imports to break. The cli/agents/base-agent.js is imported by 28 modules; cli/utils/patterns.js by 18 — both high-instability hubs where volatile logic should be decomposed.

How To Use It

Setup: npx ship-safe audit . invokes the CLI scanner. The package uses npm (package.json at repo root, webapp/package.json, vscode-extension/package.json).

Configuration: No .env is committed; webapp/.env.example documents required vars. Environment keys for LLM providers (Anthropic, OpenAI, Google, Ollama) must be available if --deep analysis is requested.

Running it:

# Full security audit — secrets + 22 agents + deps + remediation plan
npx ship-safe audit .

# LLM-powered deep analysis
npx ship-safe audit . --deep

# Red team scan (22 agents, 80+ attack classes)
npx ship-safe red-team .

# Scan only changed files (fast pre-commit & PR scanning)
npx ship-safe diff
npx ship-safe diff --staged

Real-World Use

A security engineer integrates npx ship-safe audit . into a pre-commit hook or CI pipeline. The scan runs 22 agents in parallel, surfaces hardcoded secrets, checks CI/CD configs for over-permissive tokens, and generates a remediation plan. The --agentic flag triggers an auto-fix loop: scan, annotate, re-scan until a target score is met. Findings flow to the web dashboard via the cli/commands/audit.js output pipeline, where the team can triage, assign, and create GitHub issues with one click.

Code Health & Issues

HIGH - Remove eval over a runtime value: vps/orchestrator/index.js uses exec() over a computed value, enabling arbitrary code execution if the input is compromised. Fix: parse with json.loads or ast.literal_eval.
MEDIUM - Enable Dependabot or Renovate: 4 manifests have no update bot configured; advisories remain unpatched without manual audit.
MEDIUM - Set persist-credentials: false on checkout: .github/workflows/ci.yml keeps the git token across all later steps, allowing malicious postinstall scripts to read pushable credentials.
LOW - Set timeout-minutes on workflow jobs: 2 CI jobs have no timeout, risking overlap behind the two-hourly schedule.
LOW - Add repository convention files: missing .editorconfig, .gitattributes, and formatter config cause cross-contributor formatting inconsistencies.

The Bottom Line

Ship Safe is a functionally complete AI security platform with 22 agents, deep analysis, and a web operations dashboard. The codebase shows measurable quality issues — one eval() risk, missing dependency automation, and credential-handling hygiene in CI — but the scanning capability and agentic loop are practical for teams deploying AI agents. It's best suited for organizations running agentic workflows that need coordinated secret detection, CI/CD risk assessment, and LLM-facing vulnerability coverage in a single run.