Shipshape Mcp

io.github.hybridforgelab由 GitHub 账号 hybridforgelab 发布v0.2.3更新于 Nov 6, 2026

Dockerfile and Kubernetes lint for AI agents: Pod Security Standards, A–F grade, a fix per finding.

已验证STDIO仅桌面云端与基础设施开发者工具安全与监控

概览

AI 生成的概览

为 AI 代理检查 Dockerfile 与 Kubernetes 清单，通过付费的 Shipshape API 返回 A–F 评级及每条问题的修复建议。

可以做什么
  • 检查 Dockerfile 或 Kubernetes 清单，可传入内容或文件路径，并自动识别类型。
  • 返回 A–F 评级、分数、是否通过，以及每条问题的行号、修复建议和参考依据。
  • 可设置失败阈值和忽略列表，控制哪些问题会导致不通过。
  • 在市场方提供时显示本月剩余请求额度，并对密钥被拒、额度用尽或输入无法处理给出通俗的错误说明。
适用场景
适合在编码代理编写或修改 Dockerfile 和 Kubernetes 清单后、交付前做检查：发现最终阶段以 root 运行、基础镜像未固定版本、curl 管道安装、ENV 或 ARG 中的密钥，以及 Pod Security Standards、资源和探针配置问题。
运行要求
通过 uvx 以 stdio 在本地运行（需 Python 3.10+，uv 会自动安装）。需要 RapidAPI 或 api.market 的密钥，以 RAPIDAPI_KEY 或 API_MARKET_KEY 提供；两者都设置时用 HFL_MARKETPLACE 选择市场。需要访问 Shipshape API 的网络。没有密钥时服务器仍会启动，但首次工具调用只会说明去哪里获取密钥。
安装前请注意
Shipshape API 为付费服务，含免费套餐；每次工具调用计为一次请求，免费 Basic 套餐每月上限 15 次。通过路径传入的文件内容会在该次请求中发送给第三方 API。密钥只会发送给所选市场。文件上限 512 KiB，Helm 模板需先渲染，且不检查 NetworkPolicies、PodDisruptionBudgets 和 RBAC。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Shipshape Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Shipshape MCP server

[M8ven Score] [CI] [PyPI] [Python 3.10+] [License: MIT]

Let your coding agent lint a Dockerfile or Kubernetes manifest before handing it over: root in the final stage, unpinned base images, curl | sh, secrets in ENV/ARG, Pod Security Standards, resources and probes.

The server is open source (MIT). It calls the Shipshape API, which is paid, with a free plan.

  • You use your own key, from RapidAPI or api.market.
  • Every tool call is one request on your plan.
  • The free Basic plan has 15 requests a month, with a hard limit, so it never runs up a bill.

1. Get a key

marketplace
RapidAPIplans
api.marketstore

2. Add the server to your MCP client

The server runs locally over stdio with uv. Put your key in its environment.

JSON configuration (Claude Desktop, Cursor, VS Code and most clients):

json
{  "mcpServers": {    "shipshape": {      "command": "uvx",      "args": ["--from", "hybridforgelab-shipshape-mcp", "shipshape-mcp"],      "env": { "RAPIDAPI_KEY": "your-rapidapi-key" }    }  }}

Claude Code:

bash
claude mcp add shipshape --env RAPIDAPI_KEY=your-rapidapi-key -- uvx --from hybridforgelab-shipshape-mcp shipshape-mcp

Environment

variablemeaning
RAPIDAPI_KEYyour RapidAPI key
API_MARKET_KEYyour api.market key, used when RAPIDAPI_KEY is not set
HFL_MARKETPLACErapidapi or apimarket, when both keys are set

Without a key the server still starts. The first tool call then explains where to get one.

Also listed on Glama:

[shipshape-mcp on Glama]

3. Tools

toolwhat it does
lint(content=… | path=…, type="auto", fail_on="high", ignore=[…])lints one file and returns the A–F grade, score, passed and every finding with its line, fix and reference
  • With path, files named like Dockerfile, *.Dockerfile, Dockerfile.* or Containerfile are linted as Dockerfiles.
  • passed is false when a finding is at or above fail_on.

Every tool returns the API's JSON response.

  • When the marketplace reports it, quota_remaining is added: the requests left on your plan this month.
  • Errors are explained in plain words, with what to do next:
    • key refused, with the link to subscribe;
    • quota reached, with the plans;
    • input the API couldn't process, with the API's reason.

Privacy

  • Local files are read only when a tool is given their path. They are sent to the API for that one request.
  • The API processes inputs in memory and doesn't store them. See the privacy policy.
  • Your key is only sent to the marketplace you chose.

Limits

  • Files up to 512 KiB.
  • Helm templates must be rendered first (helm template).
  • NetworkPolicies, PodDisruptionBudgets and RBAC are not checked.
  • The server needs Python 3.10+ (uv installs it for you).

Development

bash
uv venv && uv pip install -e ".[dev]".venv/bin/pytest            # unit tests, no network; 100% coverage required.venv/bin/ruff check src tests scripts

scripts/e2e_stdio.py shipshape runs the server over stdio, as a client would, and calls its tools against the real API. It needs RAPIDAPI_KEY or API_MARKET_KEY.

Licence

MIT. Shipshape itself is a paid API with a free plan, run by Hybrid Forge Lab.

来源：README.md，提交 352c5c8

工具

0
SourceWeft 曾在隔离沙箱中以无凭据方式启动该软件包一次，以列出其工具，但未能完成：该软件包类型无法在沙箱中运行。

版本历史

3
  1. v0.2.3最新Nov 6, 2026
  2. v0.2.2Nov 3, 2026
  3. v0.2.0Nov 3, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分