SIGSHIPAI agents

A real test for "done".

AI agents say they are finished when the code runs. SIGSHIP gives them a stricter finish line: no leaked keys, no open database, no fake payments. The agent keeps fixing until SIGSHIP says GO.

Set it up in a minute Read the docs

How it works

1. Your agent writes code

Same as today, in Claude Code, Cursor or any agent you like.

2. It runs SIGSHIP

Before saying it's done, it checks the project on your machine. Nothing is uploaded.

3. It fixes and repeats

It fixes each problem in order and runs the check again until the answer is GO.

Set it up in a minute.

Run this once in your terminal. Claude Code can now check your project any time.

Terminal

claude mcp add sigship -- npx -y sigship mcp

Add this to .cursor/mcp.json in your project, then reload Cursor.

.cursor/mcp.json

{
  "mcpServers": {
    "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] }
  }
}

Most apps that support MCP use this same setup. Find "MCP servers" in your app's settings and add:

MCP server config

{
  "mcpServers": {
    "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] }
  }
}

Any AI tool can run commands for you. Paste this prompt and it will loop until your app is GO.

Prompt

Run npx sigship in this project. Fix every SEV-1 and SEV-2 it reports, in order, changing only what each fix needs. Run it again and keep going until it exits 0 (GO). If a fix needs a key rotated or a dashboard changed, stop and tell me what to do.

Make it a habit for every agent. npx sigship init adds this rule to your project's AGENTS.md, which most coding agents read, plus a pull request check.

AGENTS.md

## Definition of done

Before saying work is finished, run `npx sigship`.
If it exits 1, fix what it reports and run it again. Only say the work is done after it exits 0.

What your agent gets For developers

The technical details for the curious. The MCP server runs locally over stdio, has no dependencies, never changes your files and makes no network calls without a licence key.

sigship_check

Read a project folder and return a GO or NO-GO verdict with each production problem, where it is, and how to fix it. Runs locally and changes no files.

pathstring: Absolute path of the project folder to check.
strictboolean · optional: Also block on SEV-3 findings.

sigship_explain

Explain one SIGSHIP check: what goes wrong and how to fix it.

idstring: The check id, for example rls-missing.

The server also tells the agent: don't say it's done while the verdict is NO-GO.

Questions

Does my agent upload my code anywhere?

No. SIGSHIP runs on your machine and reads files there. The free tool makes no network calls at all.

Can SIGSHIP change my code?

No. It only reads. Your AI agent makes the fixes, using SIGSHIP's instructions.

What if a fix needs something outside the code?

Some fixes need a key rotated or a dashboard setting changed. The prompt tells your agent to stop and ask you for those.

Does a GO mean my app is safe?

No. GO means these checks found nothing that blocks launch. SIGSHIP uses pattern checks, so it can miss real problems and flag safe code.

Check your app before your users do.

Free, open source, and nothing leaves your machine.

$ npx sigship

Read the docs See pricing Join the waitlist