Securing AI-Generated Code Before It Ships

#ai #cybersecurity #opensource #devtools

AI coding tools are getting good enough that a lot of code now goes from prompt to pull request very quickly.

I started building this after repeatedly seeing AI-generated code that looked clean in review, but shipped with risky defaults.
That speed is useful, but it also changes what we need to check before shipping.

The risky parts are not always obvious. It might be:

a permissive CORS config
a leaked token in a generated example
an unsafe GitHub Actions workflow
an MCP server config with too much access
an AI agent that can call tools without enough boundaries
a package install script that does more than it should

I built Ship Safe to help catch those issues locally and in CI.

It is an open-source CLI security scanner focused on modern AI-assisted development workflows.

Try It Locally

npx ship-safe scan .

Use It In CI

npx ship-safe ci . --sarif results.sarif

Ship Safe checks application code, secrets, dependencies, CI/CD workflows, MCP configs, AI agent patterns, and supply-chain risks.

The goal is not to replace a full security program. It is to give developers a fast local check before risky code lands in a repo, especially when that code was generated or heavily modified by AI.