Shipshape Mcp

io.github.Bytestay由 GitHub 账号 Bytestay 发布v0.2.4更新于 Nov 6, 2026

Dockerfile and Kubernetes lint for AI agents: Pod Security Standards, A–F grade, a fix per finding.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

为 AI 编程助手检查 Dockerfile 与 Kubernetes 清单，返回 A–F 评级、分数以及每条问题的修复建议。

可以做什么
  • 对单个 Dockerfile 或 Kubernetes 清单做检查，可传入内容或文件路径，并自动识别类型
  • 返回 A–F 评级、数值分数、是否通过，以及每条问题所在行、修复建议和参考依据
  • 检查容器加固问题，如最终阶段以 root 运行、基础镜像未固定版本、curl 管道执行脚本、ENV 或 ARG 中的密钥
  • 检查 Kubernetes Pod Security Standards、资源设置与探针
  • 在市场支持时显示本月剩余请求额度，并对密钥被拒、额度用尽或输入无法处理给出通俗的错误说明
适用场景
适合在编程助手编写或修改 Dockerfile、Kubernetes 清单后、交付前做一次检查，也适合在不安装本地检查工具的情况下快速做面向安全的容器配置审查。
运行要求
通过 uvx 从 PyPI 包 bytestay-shipshape-mcp 以 stdio 在本地运行，需要 Python 3.10+（uv 会自动安装）。需要来自 RapidAPI 或 api.market 的付费 Shipshape API 密钥，通过 RAPIDAPI_KEY 或 API_MARKET_KEY 设置；两者都设置时用 HFL_MARKETPLACE 选择市场。需要访问该 API 的网络连接。
安装前请注意
每次工具调用都会在你的套餐上计一次请求；免费 Basic 套餐每月上限 15 次。文件内容或按路径读取的文件会为该次请求发送给第三方 Shipshape API。API 密钥属于机密，会发送给所选市场。Helm 模板需先渲染，且不检查 NetworkPolicy、PodDisruptionBudget 与 RBAC。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Shipshape Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Shipshape MCP server

[M8ven Score] [CI] [PyPI] [Python 3.10+] [License: MIT]

Let your coding agent lint a Dockerfile or Kubernetes manifest before handing it over: root in the final stage, unpinned base images, curl | sh, secrets in ENV/ARG, Pod Security Standards, resources and probes.

The server is open source (MIT). It calls the Shipshape API, which is paid, with a free plan.

  • You use your own key, from RapidAPI or api.market.
  • Every tool call is one request on your plan.
  • The free Basic plan has 15 requests a month, with a hard limit, so it never runs up a bill.

1. Get a key

marketplace
RapidAPIplans
api.marketstore

2. Add the server to your MCP client

The server runs locally over stdio with uv. Put your key in its environment.

JSON configuration (Claude Desktop, Cursor, VS Code and most clients):

json
{  "mcpServers": {    "shipshape": {      "command": "uvx",      "args": ["--from", "bytestay-shipshape-mcp", "shipshape-mcp"],      "env": { "RAPIDAPI_KEY": "your-rapidapi-key" }    }  }}

Claude Code:

bash
claude mcp add shipshape --env RAPIDAPI_KEY=your-rapidapi-key -- uvx --from bytestay-shipshape-mcp shipshape-mcp

Environment

variablemeaning
RAPIDAPI_KEYyour RapidAPI key
API_MARKET_KEYyour api.market key, used when RAPIDAPI_KEY is not set
HFL_MARKETPLACErapidapi or apimarket, when both keys are set

Without a key the server still starts. The first tool call then explains where to get one.

Also listed on Glama:

[shipshape-mcp on Glama]

3. Tools

toolwhat it does
lint(content=… | path=…, type="auto", fail_on="high", ignore=[…])lints one file and returns the A–F grade, score, passed and every finding with its line, fix and reference
  • With path, files named like Dockerfile, *.Dockerfile, Dockerfile.* or Containerfile are linted as Dockerfiles.
  • passed is false when a finding is at or above fail_on.

Every tool returns the API's JSON response.

  • When the marketplace reports it, quota_remaining is added: the requests left on your plan this month.
  • Errors are explained in plain words, with what to do next:
    • key refused, with the link to subscribe;
    • quota reached, with the plans;
    • input the API couldn't process, with the API's reason.

Privacy

  • Local files are read only when a tool is given their path. They are sent to the API for that one request.
  • The API processes inputs in memory and doesn't store them. See the privacy policy.
  • Your key is only sent to the marketplace you chose.

Limits

  • Files up to 512 KiB.
  • Helm templates must be rendered first (helm template).
  • NetworkPolicies, PodDisruptionBudgets and RBAC are not checked.
  • The server needs Python 3.10+ (uv installs it for you).

Development

bash
uv venv && uv pip install -e ".[dev]".venv/bin/pytest            # unit tests, no network; 100% coverage required.venv/bin/ruff check src tests scripts

scripts/e2e_stdio.py shipshape runs the server over stdio, as a client would, and calls its tools against the real API. It needs RAPIDAPI_KEY or API_MARKET_KEY.

Licence

MIT. Shipshape itself is a paid API with a free plan, run by ByteStay.

来源：README.md，提交 fa9b80c

工具

0
SourceWeft 曾在隔离沙箱中以无凭据方式启动该软件包一次，以列出其工具，但未能完成：该软件包类型无法在沙箱中运行。

版本历史

1
  1. v0.2.4最新Nov 6, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分