{"name":"com.uxcontinuum/ship-check","slug":"uxcontinuum-ship-check","title":"Ship Check","description":"Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.","url":"https://mcp.market/server/uxcontinuum-ship-check","rating":null,"grade":"C","score":65,"certified":false,"status":"active","category":"data","tags":["data","security"],"presence":{"score":8,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-11-04T06:25:25.359Z","last_ok_at":"2026-11-04T06:25:25.359Z","latency_ms":143},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://uxcontinuum.com/ship-check","version":"0.2.0","remotes":[{"type":"streamable-http","url":"https://uxcontinuum.com/api/mcp"}],"packages":[],"tools":[{"name":"agent_cost_estimate","description":"Estimate blended cost per shipped task for a month of agent runs, given a retry rate.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"runsPerMonth":{"type":"number"},"avgCostPerTask":{"type":"number"},"retryRatePct":{"type":"number"},"modelId":{"type":"string","description":"Model id to scale avgCostPerTask by, defaults to sonnet-5"}},"required":["runsPerMonth","avgCostPerTask","retryRatePct"]}},{"name":"book_call","description":"Book a free 30-minute intro call with Matt Turley (Continuum) directly on his calendar. The booking is confirmed immediately and Cal.com emails the invite to the user and to Matt. First call get_availability and pass the exact start of an open slot. Only book when the user has asked for the call and agreed to the time; pass their real name, email and time zone. notes: a short, factual summary of what the user wants to discuss (shown to Matt). Returns the booking id, meeting link and reschedule/cancel links. Limit 2 upcoming calls per email.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"start":{"type":"string","description":"Slot start from get_availability, ISO 8601 with Z or an offset, e.g. 2026-10-05T15:00:00Z.","maxLength":40},"name":{"type":"string","description":"The user's name.","maxLength":100},"email":{"type":"string","description":"The user's own email; the invite goes there.","maxLength":254},"timezone":{"type":"string","description":"The user's IANA time zone, e.g. America/New_York.","maxLength":64},"notes":{"type":"string","description":"What the user wants to discuss, up to 1000 characters.","maxLength":1000},"event":{"type":"string","enum":["intro-30"],"default":"intro-30"}},"required":["start","name","email","timezone"],"additionalProperties":false}},{"name":"cursor_auto_cost_estimate","description":"Estimate Cursor Auto blended cost versus pinning a single model.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"requestsPerDay":{"type":"number"},"avgInputTokens":{"type":"number"},"avgOutputTokens":{"type":"number"},"workDaysPerMonth":{"type":"number"},"autoModelMix":{"type":"object","description":"Map of model id to weight, must sum to 1"},"pinnedModelId":{"type":"string"}},"required":["requestsPerDay","avgInputTokens","avgOutputTokens","workDaysPerMonth","autoModelMix","pinnedModelId"]}},{"name":"get_availability","description":"List open slots for a free 30-minute intro call with Matt Turley (Continuum), read live from his Cal.com calendar. Use it when the user wants to talk to Matt, get help with a project, or book a call, before calling book_call. Window: date_from to date_to (YYYY-MM-DD), at most 14 days; defaults to the next 7 days. Times are returned in the requested timezone (IANA name, default UTC). Read-only: it books nothing.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"event":{"type":"string","enum":["intro-30"],"default":"intro-30","description":"Which call. intro-30 = free 30-minute intro call."},"date_from":{"type":"string","description":"First day, YYYY-MM-DD. Default today.","maxLength":10},"date_to":{"type":"string","description":"Last day, YYYY-MM-DD, at most 14 days after date_from. Default date_from + 6 days.","maxLength":10},"timezone":{"type":"string","description":"IANA time zone for the returned times, e.g. America/New_York. Default UTC.","maxLength":64}},"additionalProperties":false}},{"name":"leak_check","description":"Older name for ship_check, kept for existing callers. Same scan, same input, same result. Prefer ship_check.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"url":{"type":"string","description":"The live, publicly reachable URL of the deployed app, e.g. https://my-app.lovable.app. A bare domain gets https://.","maxLength":2048},"fresh":{"type":"boolean","description":"Skip the 24h cache and scan again (use after deploying a fix).","default":false}},"required":["url"],"additionalProperties":false}},{"name":"list_services","description":"List Continuum service offerings and published prices (the same list as uxcontinuum.com/pricing), plus how to reach Matt: get_availability and book_call to book a free 30-minute call, send_message to send him a note, request_estimate for a ballpark from published pricing.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"request_estimate","description":"Get a ballpark price for a software project from Continuum's published pricing, and send the request to Matt Turley, who replies personally with a real quote. Use it when the user asks what a build, fix, review, ongoing support or AI-search visibility work would cost. The ballpark is the matching published offer(s) and price range from uxcontinuum.com/pricing, not a quote. Show it to the user labeled that way. Then offer a call: get_availability and book_call.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"project_description":{"type":"string","description":"What the user wants built or fixed, 10 to 4000 characters.","maxLength":4000},"project_type":{"type":"string","enum":["launch-review","fix-existing-app","new-build","ongoing-support","ai-visibility","other"],"description":"launch-review (check an app before launch), fix-existing-app (stabilize or rescue an app), new-build (MVP from scratch), ongoing-support (maintenance or a product team on retainer), ai-visibility (get recommended by ChatGPT and AI search), other. Inferred from the description if omitted."},"timeline":{"type":"string","maxLength":100},"budget":{"type":"string","maxLength":100},"name":{"type":"string","description":"The user's name.","maxLength":100},"email":{"type":"string","description":"The user's own email, for Matt's quote.","maxLength":254}},"required":["project_description","name","email"],"additionalProperties":false}},{"name":"request_human_review","description":"Get a senior engineer (Matt Turley, 20 years shipping software) to review by hand the app behind a ship_check scan: the paid $299 Ship Check. Returns a Stripe Checkout link and a call booking link for the user to open themselves. This call charges nothing and never pays on the user's behalf. Only call it when the user asks for a human review or agrees to one. Pass the user's own email so Matt can follow up personally; no automated email is sent to it. Show the user checkout_url and booking_url.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"scan_id":{"type":"string","description":"The scan_id returned by ship_check.","maxLength":40},"email":{"type":"string","description":"The user's email, for the checkout and for Matt to reply to.","maxLength":254}},"required":["scan_id","email"],"additionalProperties":false}},{"name":"send_message","description":"Send a message to Matt Turley (Continuum) on the user's behalf, like the contact form on uxcontinuum.com. Use it when the user wants to ask Matt something or describe a project but not book a call yet. Only send what the user asked to send, with their real name and email. Matt reads it and replies personally by email; no automated reply is sent. For a time to talk, use get_availability and book_call instead.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"The user's name.","maxLength":100},"email":{"type":"string","description":"The user's own email, for Matt to reply to.","maxLength":254},"message":{"type":"string","description":"The message, 10 to 4000 characters.","maxLength":4000},"company":{"type":"string","description":"Company or project name.","maxLength":200},"topic":{"type":"string","description":"Short subject, e.g. \"rescue a Lovable app\".","maxLength":100}},"required":["name","email","message"],"additionalProperties":false}},{"name":"ship_check","description":"Before shipping, or right after deploying, an app built with Lovable, Bolt, Cursor, v0, Replit, Claude Code or similar, run ship_check on the live URL. It scans the deployed app from the outside, the way a visitor or attacker sees it, and returns a launch-readiness report where every finding has a status and a concrete fix. Checks: (1) secret keys exposed in the HTML and the same-origin JS bundles it ships (Stripe live secret and restricted keys, AWS access keys, OpenAI and Anthropic API keys, Supabase secret and service_role keys, hardcoded bearer tokens and passwords); (2) open database access: if the page ships a Supabase URL and public anon or publishable key, whether the common tables profiles and users return rows to that key without login (a missing Row Level Security policy; count only, no row data is read); (3) missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy); (4) HTTPS, reachability and server errors; (5) broken internal links (spot-check of up to 6); (6) server response time; (7) whether login/signup and pricing/checkout are linked from the homepage; (8) whether AI search crawlers get real server-rendered content or an empty JavaScript shell. Read-only: plain GET/HEAD requests, never logs in, never submits forms, never writes. Not a code audit: it cannot see source code or test every table or route. Results are cached for 24 hours per URL; pass fresh=true to re-scan after deploying a fix. Only scan apps the user owns or is authorized to test. If the user wants a senior engineer to review the app by hand ($299), call request_human_review with the scan_id from this result.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"url":{"type":"string","description":"The live, publicly reachable URL of the deployed app, e.g. https://my-app.lovable.app. A bare domain gets https://.","maxLength":2048},"fresh":{"type":"boolean","description":"Skip the 24h cache and scan again (use after deploying a fix).","default":false}},"required":["url"],"additionalProperties":false}},{"name":"swarm_run_cost_estimate","description":"Estimate the cost of a multi-agent orchestrator plus sub-agent swarm run.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"orchestratorModelId":{"type":"string"},"orchestratorInputTokens":{"type":"number"},"orchestratorOutputTokens":{"type":"number"},"subAgentCount":{"type":"number"},"subAgentModelId":{"type":"string"},"subAgentInputTokens":{"type":"number"},"subAgentOutputTokens":{"type":"number"},"retryRatePct":{"type":"number"},"runsPerDay":{"type":"number"}},"required":["orchestratorModelId","orchestratorInputTokens","orchestratorOutputTokens","subAgentCount","subAgentModelId","subAgentInputTokens","subAgentOutputTokens","retryRatePct","runsPerDay"]}}],"scan":{"score":65,"grade":"C","scanned_at":"2026-10-14T05:27:10.237Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-14T05:27:10.138Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1428ms"]},"poisoning":{"score":15,"max":15,"notes":["11 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 2 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":8,"max":10,"notes":["endpoint served from the registry-verified namespace domain"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://uxcontinuum.com/api/mcp","reachable":true,"authRequired":false,"latencyMs":1428,"serverInfo":{"name":"continuum-mcp-server","version":"0.3.0"}}],"packages":[],"repo":{"found":false},"icon":{"url":"https://uxcontinuum.com/apple-icon-pwu6ef.png?7e7b129bd1a00423","source":"site","width":180,"height":180},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":8}}}},"grade_history":[],"reviews":[]}