# Ship Safe CLI

A local security-scanning agent for AI-written software that finds issues across code, agent configuration and secrets, then investigates whether each one is real before reporting it as evidence.

Ship Safe runs locally in a repository and works in two layers: a deterministic engine that finds issues across application code, AI agents, MCP configuration, prompts, dependencies, CI/CD and secrets, and an investigation layer that traces whether a finding's tainted value actually reaches a dangerous sink, checks whether a compensating control already exists, and can probe a leaked key against its provider when asked. Each conclusion is reported with the specific lines of code and reasoning pass that produced it.

It runs with npx ship-safe, needs no signup or API key for its core offline scan, and an AI-backed mode can be disabled entirely with --no-ai for a fully local scan. For pull requests, it can compare a baseline scan on the trusted base revision against the head revision, classifying findings as introduced, resolved, unchanged or uncertain without storing the raw matched secret.

Website: https://shipsafe.sh