Introduction

On this page

ShipTested gives developers and agents the same evidence-led dependency checks. The library, CLI and MCP share a deterministic engine.

The voyageCopy Anchor Link

Resolve exact dependencies → check supported credential patterns → query OSV → review evidence → decide.

A finding is a reason to investigate, not proof that an application is exploitable. A published fixed version is a candidate to test, not an automatically verified repair.

What is builtCopy Anchor Link

The source packages include a library, terminal CLI and local MCP server. The remote MCP app accepts content only. Version 0.1.0 is published to npm; clean registry installations and the public custom-domain MCP have been verified.

Start locally, connect an agent, or inspect an actual captured scan.

What is outside scopeCopy Anchor Link

No penetration testing, reachable-code analysis, full secret inventory, compliance certification, repository execution or guaranteed vulnerability coverage. No automatic merge or deployment.