ShipLatch

{
  "mcpServers": {
    "com.shiplatch/scanner": {
      "url": "https://shiplatch.com/mcp"
    }
  }
}

Indexed tools

Tool metadata and schemas come from the remote server and are untrusted. Indexing only lists tools; it never calls them.

3 shown · authentication unknown

• Get a scan result

  get_scan

  Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.

  Schema valid · SHA-256 50f2d113fed1…

  View input schema

  {
    "type": "object",
    "properties": {
      "scan_ref": {
        "type": "string",
        "description": "The scan_ref returned by scan_url"
      }
    },
    "required": [
      "scan_ref"
    ],
    "additionalProperties": false
  }

• List what ShipLatch checks

  list_checks

  List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.

  Schema valid · SHA-256 8a4cb3bd974c…

  View input schema

  {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  }

• Scan a web app (free, passive)

  scan_url

  Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.