AI agent security scanner that finds risky code, secrets, and MCP issues before they merge.
ShipSafe (shipsafe.sh) is an AI agent security scanner for developers that audits the agents, MCP servers, and AI-generated code your app actually runs. It ships 29 security agents mapped to the OWASP Agentic AI Top 10, catching exposed secrets, vulnerable dependencies, risky MCP tool boundaries, prompt-injection paths, and CI gaps. It runs locally in one command via npx, is MIT licensed, and plugs into release gates so risky code is found before it merges.
| Pricing | Open Source |
|---|---|
| Category | Security |
| Platforms | web, windows, macos, linux |
| Company | ShipSafe |
| Official website | shipsafe.sh |
Security tools protect accounts, devices and data, so the first question is what exactly is being protected — passwords, browsing, files, identity or a whole network — and against which threats. Prefer tools from established vendors with transparent practices: independent audits, clear data policies and a record of fixing vulnerabilities quickly matter more than long feature lists. Check how the tool balances protection with friction; security you disable because it annoys you protects nothing. For password and identity tools, strong encryption and zero-knowledge design are the standards to look for. Finally, remember that no tool replaces basic hygiene — unique passwords, two-factor authentication and regular updates do most of the protective work, and a good tool makes all three easier.
ShipSafe (shipsafe.sh) is an AI agent security scanner for developers that audits the agents, MCP servers, and AI-generated code your app actually runs. It ships 29 security agents mapped to the OWASP Agentic AI Top 10, catching exposed secrets, vulnerable dependencies, risky MCP tool boundaries, prompt-injection paths, and CI gaps. It runs locally in one command via npx, is MIT licensed, and plugs into release gates so risky code is found before it merges.
ShipSafe offers 29 security agents mapped to OWASP Agentic AI Top 10, Secrets and credentials scanning, Dependency and supply-chain checks, MCP transport and tool-boundary review, Prompt-injection risk tracing, CI and release gate integration and Local one-command scanning via npx.
ShipSafe is open source, so the software itself is free to download, use and self-host. Your only costs are the infrastructure you run it on and any paid services you connect to it.
by HOL
Local, open-source policy layer that reviews a coding agent's commands, file reads, package installs and MCP calls before they run — allowing, asking or blocking each action.
Best for: Developers running coding agents who want a human checkpoint before an agent touches files, packages or credentials
Pricing: Open Source
Limitation: Review prompts add friction by design — every flagged action waits on you
by CVEngine
Free, self-hosted attack-surface platform that discovers everything a domain exposes, matches exploited CVEs against what it actually runs, and triages each finding with AI plus read-only validation.
Best for: Security teams and owners who want to find and prioritise their own internet-exposed weaknesses
Pricing: Open Source
Limitation: Only for systems you own or are authorised to test
by BotGauge
Red-teaming platform for AI agents — it attacks your agent with 200+ adversarial strategies, traces the exact prompts, tool calls and execution path behind each failure, and turns findings into evals for every future release.
Best for: Teams shipping AI agents who need adversarial testing before release
Pricing: Freemium
Limitation: Pay-per-test pricing means heavy red-teaming runs add up
by Plango
Native macOS security suite for developers running AI coding agents: restricts agent access to sensitive files and secrets, watches network activity, scans skills and projects, all judged by a local AI security model
Best for: Developers running AI coding agents on a Mac who want agent access under control
Pricing: Freemium
Limitation: Mac only — Apple silicon, macOS 15 or newer, and at least 16 GB of memory
by Tumeryk
Enterprise platform that scores and governs AI agents, copilots, and models in real time.
Best for: Tumeryk delivers enterprise-grade trust and security for agentic and conversational AI.
Pricing: Paid
Limitation: Enterprise-only focus; no self-serve free tier
by Varonis
AI-powered data security platform discovering, classifying, and protecting sensitive data everywhere.
Best for: Security
Pricing: Paid
Limitation: Pricing not published
