asamassekou10/ship-safe

AI编写软件的独立安全代理。它发现问题，调查其真实性，并向你展示证据。 网站 ·文档 ·安全与数据流 ·基准测试 ·定价 ·博客 ·贡献

船只安全 CLI

Ship Safe 在你的仓库本地运行，分两层运行。

一个确定性引擎会发现应用代码、AI代理、MCP配置、提示、依赖、CI/CD、密钥以及云端相关配置中的问题。快速、可重复且经过基准测试——这就是传感器层。

然后，调查层决定这些发现的价值。它追踪到达汇的值，搜索项目中规则显示缺失的控制，构建无单一文件的配置攻击链，并在你要求时，对泄露密钥进行探查其提供者。每个结论都带有到达它的通行证和所读的行数：

船安全对OWASP NodeGoat进行真实输出调查。受污染的值会在路由文件中被解构，并传递到三个目录外的DAO。

从一个命令开始：

无需注册。扫描不需要API密钥。核心检查离线可行。

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute

Ship Safe CLI

Ship Safe runs locally in your repo and works in two layers.

A deterministic engine finds issues across application code, AI agents, MCP configs, prompts, dependencies, CI/CD, secrets, and cloud-adjacent configuration. Fast, repeatable, and benchmarked — this is the sensor layer.

An investigation layer then decides what the findings are worth. It traces the value that reaches a sink, searches the project for controls a rule says are missing, builds attack chains across configuration no single file contains, and — when you ask it to — probes a leaked key against its provider. Every conclusion carries the pass that reached it and the lines it read:

CONFIRMED — traced end to end (10)

    NoSQL Injection via $where [high]
    app/data/allocations-dao.js:78  NOSQL_INJECTION_WHERE
    why: threshold is assigned from the HTTP request and reaches the sink without validation on that path.
    decided by: dataflow
      1. value reaches NOSQL_INJECTION_WHERE here  app/data/allocations-dao.js:78
      2. getByUserIdAndThreshold is called here with threshold  app/routes/allocations.js:23
      3. threshold is assigned here  app/routes/allocations.js:20
    fix: Replace $where with standard MongoDB operators ($eq, $gt, $regex, etc.)