Build on evidence.

One scanner for your terminal, app and agent.

Command line

JSON · SARIF · CI exit codes

Check a lockfile without running its dependencies. Live scans send names and versions to OSV.

Terminal

npx @heysalad/shiptested-cli@0.1.0 scan package-lock.json --json

# Export evidence for code-scanning tools
npx @heysalad/shiptested-cli@0.1.0 scan package-lock.json \
  --sarif report.sarif

Nonzero exits include Blocked, Review required and Incomplete. Reports are not security guarantees.

TypeScript library

@heysalad/shiptested

Use the same deterministic checks inside your own workflow.

Install

npm install @heysalad/shiptested@0.1.0

scan.mjs

import { readFile } from 'node:fs/promises';
import { scan } from '@heysalad/shiptested';

const report = await scan({
  filename: 'package-lock.json',
  lockfile: await readFile('package-lock.json', 'utf8'),
});

for (const finding of report.findings) {
  console.log(finding.severity, finding.title);
}
console.log(report.status);

Connect your agent

Model Context Protocol

The local MCP server reads its working directory. The remote endpoint accepts file content.

Local stdio server

npx @heysalad/shiptested-mcp@0.1.0

Remote HTTPhttps://mcp.shiptested.com/mcp

Setup guides for Claude Code, Codex, Cursor and Gemini CLI

Start from a small example.

Inspect a lockfile offline

Read exact versions. No network or credentials.

Scan from Node.js

Get a live report from a supplied lockfile.

Add a CI check

A source-build workflow with explicit exit handling.

The verdict is a contract.

Blocked: A high-severity finding requires attention.
Incomplete: Some checks could not establish coverage.
Review required: Findings remain for a person to assess.
Checks passed: No findings within the completed, documented checks.

Source-code exploitability, Git history and unsupported dependency formats are not established. AI enrichment never overrides the deterministic verdict.

Preview may be ahead of published 0.1.0 packages. Build from source for current changes.