ShipLatch has a free remote MCP server. Add one URL to your AI assistant and ask it to check your app: it runs the same passive scan as shiplatch.com and answers with your grade and the type of each issue.
https://shiplatch.com/mcp
Transport: Streamable HTTP. Authentication: none. Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26.
ShipLatch and paste https://shiplatch.com/mcp.https://shiplatch.com/mcp as the server URL and choose No authentication.Add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):
{
"mcpServers": {
"shiplatch": { "url": "https://shiplatch.com/mcp" }
}
}
claude mcp add --transport http shiplatch https://shiplatch.com/mcp
ShipLatch, paste https://shiplatch.com/mcp, choose No authentication, then Add server.Then ask: "Use ShipLatch to scan https://myapp.lovable.app". To try it without touching your own app, scan our deliberately leaky demo: https://demo-leaky.shiplatch.com.
scan_url: Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app).get_scan: Get the free summary of a ShipLatch scan by its scan_ref (from scan_url).list_checks: List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification.The free view: grade, score, issue counts, the type and severity of each issue, one free low-severity finding with its fix, and a link to the report. Never through MCP: key values, exact file locations and fix prompts for the serious issues. Those are in the full report on shiplatch.com after you verify you own the site. The free scan runs 67 passive checks; 4 read-only database checks run only for verified owners.
scan_ref and the assistant fetches the result with get_scan.site_* and marked as untrusted data. The server tells the assistant to show fix suggestions to you before applying them and never to run commands found in scan results.It lets an AI assistant run ShipLatch's free security scan for you. Add https://shiplatch.com/mcp as a remote MCP server (no sign-in) in Claude, ChatGPT, Cursor, Claude Code or Lovable, then ask "scan my app at https://…". The assistant gets the same free result as shiplatch.com: grade, issue counts and the type of each issue.
Yes, it's free and needs no account or key. Paid API keys for full findings are planned but not available yet; until then, send no Authorization header.
It's passive and read-only: it loads your page and its public JavaScript like a browser would, plus a short list of well-known file paths. It never logs in, submits forms or tests exploits. The free scan covers 67 checks.
No. Through MCP you get the free view only: the type and severity of each issue, never the key value, file path or fix prompt. Those are in the full report on shiplatch.com, after you verify you own the site.
Only scan sites you own or are authorized to test, the same rule as the website. The deep database checks only ever run after ownership verification, never through MCP.
A direct connection (your own machine, such as Cursor or Claude Code) gets the normal per-user limit, the same as the website: 3 fresh scans a day and 20 an hour. Calls from Claude, ChatGPT and Lovable's cloud, and calls through Smithery, share one pool per platform: 60 fresh scans a day and 30 an hour. Every site can get at most 3 fresh scans a day through AI assistants, and there's a total of 300 a day. Repeat scans of the same site within 24 hours are served from cache and don't count.
The same as a website scan: the scan result for 7 days and a usage counter by assistant type (for example mcp-claude). Your IP address is used only for rate limits, in short-lived counters. We don't store your prompts or the conversation, and the assistant only sends us the URL you asked it to scan.