Security for teams that ship with agents

A security engineer your coding agent can call.

ShipLock reads your repository, live stack and traffic, and hands your agent the facts over MCP, including what it could not read. Your agent proposes the fix. You click to open the pull request.

Get started Connect your agent

Free in preview · read only until you click

claude · ~/acme-appexample

check this repo with ShipLock, fix the worst one

shiplock · get_security_context

41 routes read · 1 critical · 2 files not read

shiplock · list_findings

CRITICAL GET /api/invoices/[id]any signed-in user reads another workspace's invoices

Read app/api/invoices/[id]/route.ts

14 .from("invoices").select("*").eq("id", id)no workspace filter on this query

shiplock · get_fix

add .eq("workspace_id", session.workspaceId) · mechanical

Proposed. Open the pull request in ShipLock: one click, one receipt.

How it works

One loop. Three hands on it.

Read
ShipLock
Every deterministic check. Unread stays unread.
Attack
Your agent
Proposes attacks, checked against the quoted lines.
Map
ShipLock
Wrong routes and what they reach.
Fix
You
A pull request on your click, with a receipt. ShipLock never merges or deploys.
Watch
ShipLock
PR checks, rechecks, live config and traffic.

For your agent

Built to be read by machines.

Your agent does the thinking, on your subscription. ShipLock gives it typed facts with sources and re-reads every line it cites.

Hosted MCPshiplock.dev/api/mcp/server
Read only toolsNo scan, write or merge tool
Plain text/llms.txt

Terminal

claude mcp add --transport http shiplock https://shiplock.dev/api/mcp/server --header "Authorization: Bearer $SHIPLOCK_TOKEN"

Token from Settings after sign in

list_findings
get_fix
get_security_context
get_guardrails
list_intelligence_tasks
get_intelligence_task
submit_intelligence_result
open_fix_pull_request
get_fix_pull_request
report_self_check

Why code alone is not enough

Code is half the picture.

A route can look correct and still leak. Row policies live in your database, not your repository. Your live site can call addresses your repository does not have. A small hole matters when it is hit 2,000 times a minute. Connect them, read only, and ShipLock reads them together.

Example

Codeyour repository

GET /api/invoices/export · any signed-in user

Databaseread only connection

invoices · no row policy

Trafficthe traffic snippet

2,000 requests a minute · one account

Together. One account is exporting every row of invoices. No single layer says that alone.

Why access control