ShipTested

Quickstart

On this page

Website

Visit ShipTested to review the recorded synthetic scan. The public demo does not accept live credentials or execute live repair operations.

CLI

Requires Node 20.19 or newer; Node 22 recommended. Run in your project's directory:

npx @heysalad/shiptested-cli@0.1.0 scan package-lock.json --json

Only supplied input text is read; repository code is not executed. A Blocked result exits with code 1, so a nonzero exit can be an expected security result.

Local MCP

Configure your MCP client to launch:

npx -y @heysalad/shiptested-mcp@0.1.0

Its stdout is reserved for JSON-RPC. Launch with the target project as its working directory for local path scans, or pass lockfile content. Remote endpoint: https://mcp.shiptested.com/mcp.

Library

npm install @heysalad/shiptested@0.1.0

Import scan from @heysalad/shiptested in your ESM application. Optional AI is a separate BYOK import.

Build from source

In a checked-out ShipTested repository, use Node 22:

npm ci
npm run build:packages
node examples/inspect-lockfile.mjs

This first example only parses a synthetic lockfile. It makes no network requests and does not install the fixture's dependencies. To scan an existing project lockfile against live OSV data:

node examples/scan-lockfile.mjs /path/to/package-lock.json

Exit codes distinguish findings from incomplete coverage: 0 passed, 1 blocked, 2 review required and 3 incomplete. A report is not proof of application-level exploitability.

The source branch may include changes beyond published 0.1.0. See the repository's examples/ directory for a Node integration and a CI template, and CONTRIBUTING.md for the verification workflow.

Library types · Agent configuration

Introduction

Previous Page

CLI reference

Next Page