ShipLatch

com.shiplatch/scannerVersion 1.0.0

Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers

Status

Responds210 msNov 14, 2026, 14:15 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:15 UTC
Latency: 210 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://shiplatch.com/mcpResponds210 msNov 14, 2026, 14:15 UTC

No sign-in

Claude Code

claude mcp add --transport http scanner https://shiplatch.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: scanner
Remote MCP server URL: https://shiplatch.com/mcp

Cursor

{
  "mcpServers": {
    "scanner": {
      "url": "https://shiplatch.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"scanner","type":"http","url":"https://shiplatch.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

3 tools

Tools of ShipLatch
	Description		Read-only	Idempotent	Open world
`get_scan`Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.	Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.	No	Yes	Yes	No
`list_checks`List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.	List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.	No	Yes	Yes	No
`scan_url`Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.	Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Oct 22, 2026
Updated: Oct 22, 2026
Website: https://shiplatch.com/mcp⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing