Breaking

Open-source CLI scanner Ship Safe targets AI agent security risks

July 9, 2026 at 01:56 EDT

AI Agents
Security
Open Source

Ship Safe (ship-safe), an open-source CLI security scanner aimed at codebases in the age of AI agents, has been released and is drawing attention among developers. Built by Alhassane Samassekou and published on GitHub under the MIT license, it can be used instantly by running npx ship-safe, with an official site at shipsafecli.com.

Open Source · MIT License · v9.3.2

Ship Safe: A Security Scanner Built for the Age of AI Agents

An open-source CLI that runs 23 security agents in parallel to inspect a codebase from every angle — one command, local-first, no account required. Run it instantly with npx ship-safe.

security agents
running in parallel

80+

attack classes
detected

0–100

score, graded A–F
wired into CI gates

Fewer false positives, by design

A context-aware design excludes test files and comments — cutting false positives by up to 70%.

100%

naive scan

~30%

context-aware

Relative false-positive volume after filtering test files & comments

Two threat surfaces, one scan

Traditional flaws

SQL / NoSQL injection · XSS · hardcoded secrets · auth bypass · supply chain · CI/CD misconfig

AI / LLM-specific risks

Prompt injection · tool poisoning · memory poisoning · agent hijacking · excessive agency · MCP risks

Includes explicit coverage of the OWASP Agentic AI Top 10.

How it fits your workflow

audit .

full scan

→

agent .

interactive fix

→

ci .

gate via exit code

Core scanning runs offline, no API key needed. Optional AI works with any provider — Anthropic, OpenAI, Google, DeepSeek, Groq or Ollama. Outputs JSON, SARIF, CSV, Markdown, HTML & PDF; SARIF plugs into GitHub Code Scanning.

739

GitHub stars

forks

Node 18+

only requirement

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.