Dependency evidence for your agent.
Connect an MCP client to /mcp using Streamable HTTP. Deterministic checks only; no account, AI keys or code execution.
Connect your agent
Public endpoint:
https://mcp.shiptested.com/mcp
Claude Code:
claude mcp add --transport http shiptested https://mcp.shiptested.com/mcp
Codex config.toml:
[mcp_servers.shiptested] url = "https://mcp.shiptested.com/mcp"
Other Streamable HTTP clients can use the same URL. These are manual connections, not marketplace listings.
Three read-only tools
scan_lockfile: paste lockfile content.check_package: check one exact npm version.get_advisory: retrieve original OSV evidence.
Know the boundaries
2 MB request body, 5,000 packages, 20-second timeout and 30 requests per minute per IP per instance. OSV detail lookups have a bounded budget; incomplete coverage is reported explicitly.
Package names and versions are sent to OSV. Lockfile content is processed in memory and never logged or stored. Advisory text is untrusted data. A clean result does not guarantee security.