Shipshape Mcp

io.github.hybridforgelab由 GitHub 帳號 hybridforgelab 發布v0.2.3更新於 Nov 6, 2026

Dockerfile and Kubernetes lint for AI agents: Pod Security Standards, A–F grade, a fix per finding.

已驗證STDIO僅桌面雲端與基礎設施開發者工具安全與監控

概覽

AI 產生的概覽

為 AI 代理檢查 Dockerfile 與 Kubernetes 清單，透過付費的 Shipshape API 回傳 A–F 評級及每項問題的修正建議。

可以做什麼
  • 檢查 Dockerfile 或 Kubernetes 清單，可傳入內容或檔案路徑，並自動辨識類型。
  • 回傳 A–F 評級、分數、是否通過，以及每項問題的行號、修正建議與參考依據。
  • 可設定失敗門檻與忽略清單，控制哪些問題會導致不通過。
  • 在市集端提供時顯示本月剩餘請求額度，並對金鑰被拒、額度用盡或輸入無法處理給出白話的錯誤說明。
適用情境
適合在編碼代理撰寫或修改 Dockerfile 與 Kubernetes 清單後、交付前進行檢查：找出最終階段以 root 執行、基礎映像檔未鎖定版本、curl 管線安裝、ENV 或 ARG 中的機密，以及 Pod Security Standards、資源與探針設定問題。
執行需求
透過 uvx 以 stdio 在本機執行（需 Python 3.10+，uv 會自動安裝）。需要 RapidAPI 或 api.market 的金鑰，以 RAPIDAPI_KEY 或 API_MARKET_KEY 提供；兩者都設定時用 HFL_MARKETPLACE 選擇市集。需要連線至 Shipshape API 的網路。沒有金鑰時伺服器仍會啟動，但第一次工具呼叫只會說明去哪裡取得金鑰。
安裝前請注意
Shipshape API 為付費服務，含免費方案；每次工具呼叫計為一次請求，免費 Basic 方案每月上限 15 次。透過路徑傳入的檔案內容會在該次請求中傳送給第三方 API。金鑰只會傳送給所選市集。檔案上限 512 KiB，Helm 範本需先渲染，且不檢查 NetworkPolicies、PodDisruptionBudgets 與 RBAC。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Shipshape Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Shipshape MCP server

[M8ven Score] [CI] [PyPI] [Python 3.10+] [License: MIT]

Let your coding agent lint a Dockerfile or Kubernetes manifest before handing it over: root in the final stage, unpinned base images, curl | sh, secrets in ENV/ARG, Pod Security Standards, resources and probes.

The server is open source (MIT). It calls the Shipshape API, which is paid, with a free plan.

  • You use your own key, from RapidAPI or api.market.
  • Every tool call is one request on your plan.
  • The free Basic plan has 15 requests a month, with a hard limit, so it never runs up a bill.

1. Get a key

marketplace
RapidAPIplans
api.marketstore

2. Add the server to your MCP client

The server runs locally over stdio with uv. Put your key in its environment.

JSON configuration (Claude Desktop, Cursor, VS Code and most clients):

json
{  "mcpServers": {    "shipshape": {      "command": "uvx",      "args": ["--from", "hybridforgelab-shipshape-mcp", "shipshape-mcp"],      "env": { "RAPIDAPI_KEY": "your-rapidapi-key" }    }  }}

Claude Code:

bash
claude mcp add shipshape --env RAPIDAPI_KEY=your-rapidapi-key -- uvx --from hybridforgelab-shipshape-mcp shipshape-mcp

Environment

variablemeaning
RAPIDAPI_KEYyour RapidAPI key
API_MARKET_KEYyour api.market key, used when RAPIDAPI_KEY is not set
HFL_MARKETPLACErapidapi or apimarket, when both keys are set

Without a key the server still starts. The first tool call then explains where to get one.

Also listed on Glama:

[shipshape-mcp on Glama]

3. Tools

toolwhat it does
lint(content=… | path=…, type="auto", fail_on="high", ignore=[…])lints one file and returns the A–F grade, score, passed and every finding with its line, fix and reference
  • With path, files named like Dockerfile, *.Dockerfile, Dockerfile.* or Containerfile are linted as Dockerfiles.
  • passed is false when a finding is at or above fail_on.

Every tool returns the API's JSON response.

  • When the marketplace reports it, quota_remaining is added: the requests left on your plan this month.
  • Errors are explained in plain words, with what to do next:
    • key refused, with the link to subscribe;
    • quota reached, with the plans;
    • input the API couldn't process, with the API's reason.

Privacy

  • Local files are read only when a tool is given their path. They are sent to the API for that one request.
  • The API processes inputs in memory and doesn't store them. See the privacy policy.
  • Your key is only sent to the marketplace you chose.

Limits

  • Files up to 512 KiB.
  • Helm templates must be rendered first (helm template).
  • NetworkPolicies, PodDisruptionBudgets and RBAC are not checked.
  • The server needs Python 3.10+ (uv installs it for you).

Development

bash
uv venv && uv pip install -e ".[dev]".venv/bin/pytest            # unit tests, no network; 100% coverage required.venv/bin/ruff check src tests scripts

scripts/e2e_stdio.py shipshape runs the server over stdio, as a client would, and calls its tools against the real API. It needs RAPIDAPI_KEY or API_MARKET_KEY.

Licence

MIT. Shipshape itself is a paid API with a free plan, run by Hybrid Forge Lab.

來源：README.md，提交 352c5c8

工具

0
SourceWeft 曾在隔離沙箱中以無憑證方式啟動該軟體包一次，以列出其工具，但未能完成：該軟體包類型無法在沙箱中執行。

版本歷史

3
  1. v0.2.3最新Nov 6, 2026
  2. v0.2.2Nov 3, 2026
  3. v0.2.0Nov 3, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分