배송 전에 AI 생성 코드 보호

AI coding tools are getting good enough that a lot of code now goes from prompt to pull request very quickly.

I started building this after repeatedly seeing AI-generated code that looked clean in review, but shipped with risky defaults.
That speed is useful, but it also changes what we need to check before shipping.

The risky parts are not always obvious. It might be:

• a permissive CORS config
• a leaked token in a generated example
• an unsafe GitHub Actions workflow
• an MCP server config with too much access
• an AI agent that can call tools without enough boundaries
• a package install script that does more than it should

I built Ship Safe to help catch those issues locally and in CI.

It is an open-source CLI security scanner focused on modern AI-assisted development workflows.

Try It Locally

npx ship-safe scan .

Enter fullscreen mode Exit fullscreen mode

Use It In CI

npx ship-safe ci . --sarif results.sarif

Enter fullscreen mode Exit fullscreen mode

Ship Safe checks application code, secrets, dependencies, CI/CD workflows, MCP configs, AI agent patterns, and supply-chain risks.

The goal is not to replace a full security program. It is to give developers a fast local check before risky code lands in a repo, especially when that code was generated or heavily modified by AI.

Links

Repo: https://github.com/asamassekou10/ship-safe

I’d love feedback from developers using AI coding tools, MCP, agents, or security automation in their workflow.