sigship/sigship

SIGSHIP reads your repo on your own machine and lists what will break in production: leaked keys, open databases, unverified webhooks, AI routes with no spending brake. It exits 0 only when it finds nothing serious, which gives you and your coding agent a real test for done.
bash
npx sigship
No signup, no telemetry, no runtime dependencies. The free tool never touches the network.
## Contents
What you get
Quick start
Commands
Pull requests
Coding agents (MCP)
What it checks
Privacy
Plans and licence keys
Limits
Contributing and security
## What you get
text
SIGSHIP read 6 files in 22 ms, ran 17 checks
Postmortem, written before the outage. Worst first.
SEV-1 Your Stripe webhook accepts anything
src/api/stripe-webhook.ts:3 Handles Stripe events with no signature check in this file.
Someone posts a fake "payment succeeded" event to your endpoint and
gets your paid plan for free.
SEV-2 Your AI route has no spending brake
src/api/chat.ts:2 This route calls a paid AI API and the project has no rate limiter.
One script loops on this endpoint overnight and you wake up to the invoice.
NO-GO 1 SEV-1, 1 SEV-2, 0 SEV-3. Exit 1.
Paste the fixes into your AI tool: npx sigship --prompt
| Exit code | Meaning |
| 0 | GO. No SEV-1 or SEV-2 findings. |
| 1 | NO-GO. Something blocks launch. |
| 2 | SIGSHIP could not run, for example the folder does not exist. |
A GO means these checks found nothing that blocks launch. It does not prove the app is safe.
## Quick start
Requires Node.js 22 or later.
bash
npx sigship # check the current folder
npx sigship path/to/app # check another folder
npx sigship --prompt # turn every fix into one prompt for Lovable, Cursor, Bolt or Claude Code
npx sigship ui # open the same results as a dashboard in your browser
## Commands
| Command | What it does |
| npx sigship [folder] | Check a project and print the postmortem. |
| npx sigship ui [folder] | Open a local dashboard: verdict, findings, a copy-the-fix-prompt button and re-run. |
| npx sigship init [folder] | Add a pull request check and a definition of done to AGENTS.md. |
| npx sigship mcp | Start the MCP server for coding agents. |
| Option | What it does |
| --prompt | Print the fixes as one prompt for your AI tool. |
| --json | Print the result as JSON. |
| --markdown | Print the result as Markdown, for pull request comments. |
| --strict | Also block on SEV-3 findings. |
| --report | Also write sigship-report.html for a client. Needs a licence key. |
| --no-open | With ui, print the dashboard link without opening a browser. |
| --version, --help | Print the version or the help. |
The dashboard listens on 127.0.0.1 only, answers only the private link it prints, and serves findings, never file contents. Press Ctrl+C to stop it.
## Pull requests
bash
npx sigship init
Adds .github/workflows/sigship.yml, which fails a pull request that brings back a SEV-1 or SEV-2 problem, and a definition of done in AGENTS.md that tells coding agents to run SIGSHIP before saying they are finished. It never overwrites an existing file.
## Coding agents (MCP)
Claude Code:
bash
claude mcp add sigship -- npx -y sigship mcp
Cursor, in .cursor/mcp.json:
json
{ "mcpServers": { "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] } } }