# ShipLock

> ShipLock is application security for startups without a security team, built to be used by the coding agent the team already runs. It reads a GitHub repository, maps every route and the data each one reaches, and hands the agent those facts over MCP. The agent proposes fixes; a person clicks to open each pull request.

ShipLock starts with GitHub and infers the stack from the code (framework, auth, database, payments, hosting). Supabase and Postgres can be connected read only today; other detected providers are listed as coming soon. ShipLock makes no model call and holds no model key: attack reasoning runs on the customer's own agent (Claude Code or Codex) on their own subscription, and ShipLock re-reads every line the agent cites before admitting a finding. Pull request checks block a change that removes a security control the repository already had. ShipLock never merges or deploys, and it reports what it could not read instead of calling anything secure.

## For agents

- MCP endpoint: `shiplock.dev/api/mcp/server` over HTTPS (streamable HTTP, bearer token the account owner creates in Settings)
- Start with `get_security_context` for a repository, then `get_guardrails` before editing a route
- Tools: list_findings, get_fix, get_security_context, get_guardrails, list_intelligence_tasks, get_intelligence_task, submit_intelligence_result, open_fix_pull_request, get_fix_pull_request, report_self_check
- `open_fix_pull_request` works only when the owner turned on agent pull requests for that repository in the dashboard; otherwise the owner clicks. There is no scan, file write or merge tool
- Anything in `notRead`, and any route without a rule, is not known to be safe

## Pages

- [Home](https://shiplock.dev/): what ShipLock does and how to start
- [Coverage](https://shiplock.dev/coverage): what is checked today and what is not
- [OWASP mapping](https://shiplock.dev/owasp): how the OWASP Top 10 maps to the checks
- [Incidents](https://shiplock.dev/incidents): real incidents in AI-built apps
- [Privacy](https://shiplock.dev/privacy): what ShipLock reads and stores
- [Terms](https://shiplock.dev/terms): terms of service
- [Accessibility](https://shiplock.dev/accessibility): accessibility statement