Ship Safe: An Open Source Security Scanner for AI Coding Agents
Ship Safe, an open source security scanner for coding agents
Ship Safe is a free, open-source CLI that scans your repository for security issues introduced by AI coding agents. It detects CI/CD misconfigurations, over-permissive agent permissions, MCP tool injection, hardcoded secrets, and even DMCA-flagged AI dependencies. Run it locally with a single command, no signup or API key required, and get actionable findings with severity ratings and suggested fixes. The tool also offers an interactive REPL, CI/CD integration, and supports a wide range of LLM providers for AI-assisted analysis.
Ship Safe covers a narrower question: what an AI coding agent just did to your repository, your CI, and your local tool configuration.
- nullbio
I've seen many of these pop up over the last 6 months. What separates yours from all of the others? What makes it better? (Genuine question, not being snarky.)
- znnajdla
I'm completely new to the AI-security harness space. Can someone tell me what the industry standard is? I just ran Kimi K3 inside Pi to do a quick scan I did find quite a few important things but it seems like it will do better with a specialized harness.
- bbg2401
Do people not feel shame when posting thoughtlessly vibe coded projects to HN? If not, surely there’d be some shame in leading with an AI generated comment seeking human feedback on something the author unlikely spent more than a couple of brain cycles.