Ship Safe是一款MIT许可证的开源命令行工具，用于扫描现代软件项目中的代码风险、AI代理漏洞和供应链问题[1]。该工具支持JavaScript、TypeScript、Python、配置文件、基础设施文件和GitHub Actions的扫描[1]，并可在无需API密钥的情况下进行核心扫描任务，支持完全离线运行[1]。
该扫描器集成了多个AI服务提供商，包括Anthropic、OpenAI、Google、DeepSeek和Kimi K3等[1]，用户可根据需求选择不同的AI引擎进行交互式修复建议[1]。在降低误报率方面，v9.6.3版本在四个项目中将关键发现数量从1031个大幅降低至1个[1]。开发团队计划在v10.0版本中提升Hermes Agent的覆盖范围，将其从v0.13.0升级至v0.20.0[1]。
Ship Safe is an open source security scanning tool designed to identify code vulnerabilities, AI agent weaknesses, and supply chain risks in modern software projects [1]. Released under the MIT license, the tool operates as a command-line interface that can run locally and perform offline scans without requiring API keys for core functionality [1].
The scanner supports a broad range of programming languages and file types, including JavaScript, TypeScript, Python, configuration files, infrastructure code, and GitHub Actions workflows [1]. It integrates with multiple AI providers—including Anthropic, OpenAI, Google, DeepSeek, and Kimi K3—to power its analysis and provide interactive remediation recommendations [1].
Recent improvements have significantly enhanced the tool's accuracy. Version 9.6.3 reduced critical findings across four projects from 1,031 to just 1, substantially lowering false positives [1]. Looking ahead, version 10.0 plans to expand Hermes Agent coverage by upgrading from version 0.13.0 to 0.20.0 [1].