AI agent security scanner that finds risky code, secrets, and MCP issues before they merge.
ShipSafe (shipsafe.sh) is an AI agent security scanner for developers that audits the agents, MCP servers, and AI-generated code your app actually runs. It ships 29 security agents mapped to the OWASP Agentic AI Top 10, catching exposed secrets, vulnerable dependencies, risky MCP tool boundaries, prompt-injection paths, and CI gaps. It runs locally in one command via npx, is MIT licensed, and plugs into release gates so risky code is found before it merges.
| Pricing | Open Source |
|---|---|
| Category | Security |
| Platforms | web, windows, macos, linux |
| Company | ShipSafe |
| Official website | shipsafe.sh |
Security tools protect accounts, devices and data, so the first question is what exactly is being protected — passwords, browsing, files, identity or a whole network — and against which threats. Prefer tools from established vendors with transparent practices: independent audits, clear data policies and a record of fixing vulnerabilities quickly matter more than long feature lists. Check how the tool balances protection with friction; security you disable because it annoys you protects nothing. For password and identity tools, strong encryption and zero-knowledge design are the standards to look for. Finally, remember that no tool replaces basic hygiene — unique passwords, two-factor authentication and regular updates do most of the protective work, and a good tool makes all three easier.
ShipSafe (shipsafe.sh) is an AI agent security scanner for developers that audits the agents, MCP servers, and AI-generated code your app actually runs. It ships 29 security agents mapped to the OWASP Agentic AI Top 10, catching exposed secrets, vulnerable dependencies, risky MCP tool boundaries, prompt-injection paths, and CI gaps. It runs locally in one command via npx, is MIT licensed, and plugs into release gates so risky code is found before it merges.
ShipSafe offers 29 security agents mapped to OWASP Agentic AI Top 10, Secrets and credentials scanning, Dependency and supply-chain checks, MCP transport and tool-boundary review, Prompt-injection risk tracing, CI and release gate integration and Local one-command scanning via npx.
ShipSafe is open source, so the software itself is free to download, use and self-host. Your only costs are the infrastructure you run it on and any paid services you connect to it.
by Plango
Native macOS security suite for developers running AI coding agents: restricts agent access to sensitive files and secrets, watches network activity, scans skills and projects, all judged by a local AI security model
Best for: Developers running AI coding agents on a Mac who want agent access under control
Pricing: Freemium
Limitation: Mac only — Apple silicon, macOS 15 or newer, and at least 16 GB of memory
by Tumeryk
Enterprise platform that scores and governs AI agents, copilots, and models in real time.
Best for: Tumeryk delivers enterprise-grade trust and security for agentic and conversational AI.
Pricing: Paid
Limitation: Enterprise-only focus; no self-serve free tier
by Varonis
AI-powered data security platform discovering, classifying, and protecting sensitive data everywhere.
Best for: Security
Pricing: Paid
Limitation: Pricing not published
by Vectra AI
AI-driven network detection and response with Attack Signal Intelligence across network, cloud, and identity.
Best for: Security
Pricing: Paid
Limitation: Network-centric; needs traffic visibility to deliver value
by Verisoul
AI fraud prevention and identity verification for online platforms.
Best for: Security
Pricing: Freemium
Limitation: Usage-based pricing can add up at scale
by VibeScan
Security scanning platform built specifically for AI-generated ('vibe-coded') apps.
Best for: Security
Pricing: Paid
Limitation: New tool; long-term track record still forming
