ClearToShip

The 30-second pre-launch security clearance for AI-built apps — including the agent surface a runtime scanner cannot reach until after you have already deployed it.

Real output from a scan of this repository's deliberately vulnerable test fixture, trimmed to three findings.

AI coding assistants write code fast, but they optimise for "runs without errors", not "runs without leaks". The failure mode is almost never a dangerous line of code — it's an absent one: the session check that was never written, the RLS policy that was never enabled, the package name the model invented, the approval step the agent tool never had.

cleartoship is a static pre-flight check for exactly those gaps. No database connection, no account, no upload — it reads your repo and exits non-zero if you shouldn't deploy.

Where this is not like the other scanners

The serious LLM security tools are runtime: they probe a deployed endpoint and report how it answered. That is a real and different job, and this does not compete with it. What none of them does is read your source, before it ships, and tell you that the system prompt is compiled into the client bundle, that the model call has no token ceiling, that the agent tool which deletes rows has nothing asking a person first, or that an answer is being used as the access check.

Six first-party rules read that surface directly, mapped to the 2026 OWASP LLM Top 10 — and the coverage table below names the one category this refuses to fake. Everything else here is the ordinary web surface, which is table stakes: you still ship on the same day that a missing RLS policy would have leaked the table.

Those six, the RLS and Server Actions suites alongside them, and everything else on this page (dependencies, secrets, logging/exception handling) are free while ClearToShip is in beta — no account, no key. See What's free.

curl -fsSL https://cleartoship.app/cleartoship.mjs -o cleartoship.mjs
node cleartoship.mjs

Every check is free while ClearToShip is in beta — no account, no key. It runs on your machine and reports to your terminal; your code never leaves it.

That is one bundled file with zero dependencies: no package manager in the path and nothing for a registry to resolve. ClearToShip is not distributed through npm. There is no npx cleartoship, and a package by that name on the registry is not from this project — do not run it. The same file is attached to every GitHub release if you would rather not fetch it from this domain (https://github.com/murtazaozdemir/cleartoship/releases/latest/download/cleartoship.mjs), and https://cleartoship.app/SHA256SUMS lists its checksum.

This is the most robust way to run it, and deliberately so: npm 12 ships with allow-remote and allow-git set to none, so any install from a URL or a git ref now needs an explicit flag from the user. A file you fetch and hand to node needs nothing to cooperate.

Requires Node ^22.18 or >=24.11 — the range Babel 8 supports, mirrored exactly rather than approximated, since a looser >=22.18 would claim Node 23 and early 24 work when they do not.

None of these fetches ClearToShip itself from the npm registry. Ranked by how little has to work for them to work:

# 1. nothing but node. No package manager, no registry, no install step.
#    (The same file is at https://github.com/murtazaozdemir/cleartoship/releases/latest/download/cleartoship.mjs)
curl -fsSL https://cleartoship.app/cleartoship.mjs -o cleartoship.mjs
node cleartoship.mjs

# 2. the same bundle as an installable package. npm 12 defaults allow-remote to
#    "none", so it has to be told this is wanted.
npm i -D https://github.com/murtazaozdemir/cleartoship/releases/latest/download/cleartoship-standalone.tgz --allow-remote=all

# 3. from the repository, building on install. npm 12 defaults allow-git to
#    "none" too, and the build is a lifecycle script, so both need allowing.
npm i -D github:murtazaozdemir/cleartoship --allow-git=all --allow-scripts=cleartoship

1 and 2 are the same bundled file, and the test suite asserts it produces identical findings to the full package — a fallback that behaves differently from the tool you tested is not a fallback. 3 still resolves the five runtime dependencies from npm; what it removes is any need for this package to be published there.

The GitHub Action needs none of them: action.yml downloads the release bundle for the version its ref declares, verifies its build-provenance attestation before running it, and builds from its own checkout when that version has no verifiable release.

What's free

Everything on this page is free while ClearToShip is in beta: the dependency/supply-chain, secrets & client bundle and logging, error-handling & deserialization checks, the full vendored community ruleset, and the Row Level Security, Server Actions and LLM/agent suites. No account, no key, nothing to install beyond the one file above.

A paid tier may come later, once people are using the tool and it is clear what they would pay for. Nothing is for sale today, and no price is set. If it comes, what is free now stays free and MIT licensed: a paid tier would be new rules on top, announced first, never something taken out of the tier you already have.

The vendored community rules that overlap the first-party RLS, Server Actions and LLM/agent checks are switched off in their favour (see SUPERSEDED in src/scanners/community.ts): they were measurably noisier than the checks they were built to replace, and this project's whole premise is that a scanner which cries wolf gets ignored.

What it checks

Next.js server surface — Server Actions, Route Handlers, client boundary

This is the beginning of the README. Read the rest at the original. Read the full README ↗