Build with ShipTested.

The same checks in your terminal, your application and your agent. Install the published packages or connect directly to the public MCP.

Library: npm install @heysalad/shiptested@0.1.0. Node 20.19+; Node 22 recommended.

Terminal CLI

Published · 0.1.0

Scan a lockfile, follow real stages and export evidence as JSON or SARIF.

npx @heysalad/shiptested-cli@0.1.0 scan package-lock.json --json

Read the reference

Local MCP

Published · 0.1.0

Let your agent use the same checks. Local paths stay inside its working directory.

npx @heysalad/shiptested-mcp@0.1.0

Read the reference

Remote MCP

Public service · no account needed

Send lockfile content over Streamable HTTP. Deterministic checks only; no code execution.

https://mcp.shiptested.com/mcp

Read the reference

Core library

Published · 0.1.0

Import the deterministic scanner. Keep your application’s findings and verdict tied to evidence.

import { scan } from '@heysalad/shiptested';

Read the reference

Connect the agent you already use.

Manual MCP setup guides cover Claude Code, Codex, Cursor and Gemini CLI. ChatGPT requires a reachable remote endpoint and a plan/workspace that permits custom connections. These are configuration guides, not marketplace approvals.

Choose your agent →

Availability, checked now.

Checking endpoint and npm registry…

Reachability is not an audit or uptime guarantee. A protected preview is not publicly connectable.

Try a lockfile.

This sends the supplied content to the remote MCP service. Nothing you paste is stored. Exact package names and versions are sent to OSV.

package-lock.json content

2 MB request · 5,000 packages · 20-second endpoint timeout. If the public service is not active, use the local CLI or MCP instead.