Asamassekou10 Releases Ship Safe to Secure AI Coding Agents
The open-source CLI scanner targets 'agentic' vulnerabilities like MCP tool injection and permissive configurations.
Developer Asamassekou10 has released Ship Safe, an open-source CLI security scanner designed to protect software during the rise of AI-driven development. The tool specifically targets vulnerabilities introduced by autonomous coding agents, filling a gap where traditional static analysis often fails.
Ship Safe identifies AI-specific risks, including Model Context Protocol (MCP) tool injection, agent permission risks, and dependencies flagged under the DMCA. To help developers quantify their risk, the tool provides a security health score ranging from 0 to 100 (graded A-F) and a "vibe-check" emoji grade for repository security. For those seeking more aggressive testing, the scanner includes a "red-team" mode featuring over 80 attack classes and a "GPT-Red" scenario generator for adversarial testing of AI agents. Additionally, the tool utilizes Kimi K3-powered adversarial analysis to probe agent boundaries and tool calls using long-context behavior.
The Rise of Agentic Risk
As AI coding assistants—such as Cursor, GitHub Copilot, and custom MCP-based agents—gain increased autonomy and deeper system access, they create new attack vectors. Traditional security tools are generally designed to find bugs in human-written code, but they often overlook "agentic" vulnerabilities. These include prompt injections that can lead to unauthorized tool execution or overly permissive configurations that grant AI agents more system power than necessary.
Securing the DevSecOps Pipeline
By treating AI agents as a distinct attack surface, Ship Safe integrates these specialized checks into the DevSecOps pipeline. This allows developers to secure the integration of autonomous agents into CI/CD workflows, preventing potential exploits that could lead to the execution of malicious code or the leaking of sensitive secrets.
To maintain privacy, Ship Safe employs a "local-first" architecture. Core scans, report generation, and 29 built-in agents run directly on the user's machine without requiring an API key. While the CLI is licensed under MIT, a Pro plan is available for $9 per month, which adds hosted history, support for private repositories, and "PR Guardian" for inline fix guidance.
What to Watch
As the industry moves toward more autonomous "agentic" workflows, the focus is shifting from simple code completion to full-scale agent orchestration. The success of tools like Ship Safe will likely depend on how quickly the developer community adopts standardized security protocols for MCP and agent permissions. For now, the tool provides a necessary first line of defense for teams integrating AI agents into their production environments.