ShipLatch
Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
| Endpoint | https://shiplatch.com/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.0 |
| Now | 3 tools · grade A (99) · pin ts_85f4cd011f6bc75a6e76056bcb6ade9f · protocol 2025-06-18 |
| First / last listed | 2026-11-02 01:58 UTC / 2026-11-02 01:58 UTC |
| Grade over time | 2026-11-02: A (99), 3 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: scan_url get_scan list_checks
scan_url | Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites yo params: url*, focus |
get_scan | Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days. params: scan_ref* |
list_checks | List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access. params: none |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.