Skip to content

SHIP

by letsship.ai · remote · no sign-in to list tools · v0.24.0 · published by ai.letsship

Assign Linear, Jira or GitHub issues to an AI coding agent team that plans, builds, reviews, tests.

Deletes · 21Final · 1Changes · 182 high findings
CompareRegistry entry

72 tools: 21 can delete or cancel things, 1 do something that can't be undone, 18 change things and 32 only read.

Scanned Oct 21, 2026

22 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ship https://mcp.letsship.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

2 high4 warn16 info
  • Highlist_mcp_servers

    The description refers to ".mcp.json".

    Matched text

    description: "...'s repository declares in its MCP file (.mcp.json by default), each with its binding: ena..."

    What this check looks for
  • Highset_mcp_config_path

    The description refers to ".cursor/mcp.json", ".vscode/mcp.json" and ".mcp.json".

    Matched text

    description: "...ile that declares its MCP servers, e.g. .cursor/mcp.json or .vscode/mcp.json. null restores the..."

    What this check looks for
  • Warnarchive_mission

    The server marks "archive_mission" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_mission" says "archive": a word for removing or ending something.

    What this check looks for
  • Warnunarchive_mission

    The server marks "unarchive_mission" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "show": a word for reading.

    What this check looks for
  • Warnlist_scheduled_task_runs

    The server marks "list_scheduled_task_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_scheduled_task_runs" says "list": a word for reading.

    What this check looks for
  • Warnwatch_agent_run

    The server marks "watch_agent_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "watch_agent_run" says "run": a word for a change.

    What this check looks for
Show 16 more findings

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

72 tools

Deletes or cancels 21Claude Code: deny
  • archive_missionHide a finished mission from list_missions and the board.1 finding

    Why it is in this group

    • The name "archive_mission" says "archive": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "archive_mission" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_mission" says "archive": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Hide a finished mission from list_missions and the board. Nothing else changes: unarchive_mission shows it again. Requires the missions:write scope and the config:write capability (an owner or admin).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Archive a mission
  • bind_mcp_serverCreate or update the binding for a server the repository declares.4 findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...the command runs inside the sandbox, no credential). Omit transport and remoteUrl on an up..."

      What this check looks for
    • Info

      The input schema at properties.transport.description mentions "credential".

      Matched text

      inputSchema.properties.transport.description: "...the command inside the sandbox with no credential. Omit it on an update to keep the serve..."

      What this check looks for
    • Info

      The input schema at properties.credential.oneOf[2].properties.allowedHosts.description mentions "credential".

      Matched text

      inputSchema.properties.credential.oneOf[2].properties.allowedHosts.description: "...ames the isolated server may reach; the credential can go nowhere else."

      What this check looks for
    • Info

      The input schema at properties.credential.description mentions "credential".

      Matched text

      inputSchema.properties.credential.description: "Write-only credential the gateway attaches; agents never rece..."

      What this check looks for
    Description, as the server wrote it
    Create or update the binding for a server the repository declares. roles is the full set of pipeline roles that may use it (reviewer and qa only ever receive read-only tools, and cannot use a server that runs inside the sandbox). transport: 'remote' (the gateway proxies to the server's URL), 'isolate' (the gateway runs the server's npm package in isolation, for a command that needs a secret) or 'local' (the command runs inside the sandbox, no credential). Omit transport and remoteUrl on an update to keep the server the binding is pinned to, with its credential (a roles, tools or credential edit); set them only to bind or re-point the server. Requires the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Bind an MCP server
  • clear_agents_overrideDelete the per-issue agents/baseBranch override — the mission resolves from ship.yml again.No findings

    Why it is in this group

    • The description's first verb is "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete the per-issue agents/baseBranch override — the mission resolves from ship.yml again.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Clear a mission's agents-override
  • decline_missionClose the mission's open pull request on GitHub without merging it; the mission becomes declined, and no call here reopens it.No findings

    Why it is in this group

    • The description's first verb is "close": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Close the mission's open pull request on GitHub without merging it; the mission becomes declined, and no call here reopens it. Requires the missions:write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Decline a mission's pull request
  • delete_sandbox_registryDelete the stored credential of a private registry (an id from list_sandbox_registries).4 findings

    Why it is in this group

    • The name "delete_sandbox_registry" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The title mentions "credential".

      Matched text

      title: "Remove a private registry credential"

      What this check looks for
    • Info

      The annotations title mentions "credential".

      Matched text

      annotations.title: "Remove a private registry credential"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Delete the stored credential of a private registry (an id from list_..."

      What this check looks for
    • Info

      The input schema at properties.registryId.description mentions "credential".

      Matched text

      inputSchema.properties.registryId.description: "Registry credential id, from list_sandbox_registries"

      What this check looks for
    Description, as the server wrote it
    Delete the stored credential of a private registry (an id from list_sandbox_registries). A sandbox build that installs from that host then gets no credential. Requires the connectors:write scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Remove a private registry credential
  • delete_sandbox_templateDelete a sandbox with all its versions and builds.No findings

    Why it is in this group

    • The name "delete_sandbox_template" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a sandbox with all its versions and builds. Answers 409 while an agent or a project's default sandbox uses it: point those at another sandbox first (update_project with defaultSandboxTemplateId). Missions that run in it now finish. Requires the agents:write scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Delete a sandbox
  • delete_scheduled_taskDelete a scheduled task and its run history, which no call can bring back.No findings

    Why it is in this group

    • The name "delete_scheduled_task" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a scheduled task and its run history, which no call can bring back. Missions it already started continue. Setting enabled to false stops new runs and keeps the task and its history. Requires the scheduled-tasks:write scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Delete a scheduled task
  • destroy_environmentRequest teardown of a preview environment (its deployed Worker(s) + every provisioned datastore).No findings

    Why it is in this group

    • The name "destroy_environment" says "destroy": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Request teardown of a preview environment (its deployed Worker(s) + every provisioned datastore). Enqueues to the orchestrator; requires project write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Destroy a preview environment
  • merge_missionMerge the mission's open pull request on GitHub with the repository's own merge method; the mission then becomes done, and the merge cannot be undone from here.No findings

    Why it is in this group

    • The name "merge_mission" says "merge": a word for a change that another call does not undo.
    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Merge the mission's open pull request on GitHub with the repository's own merge method; the mission then becomes done, and the merge cannot be undone from here. When the branch is out of date with its base, answers 202 with status 'updating_branch' and a message: SHIP updates the branch and merges once CI passes, with no further call. Answers 409 with the reason for any other blocker (missing reviews, failing checks, another branch protection). On a merge conflict SHIP starts the builder to fix it and merges once the mission is ready again, with no further call. Requires the missions:write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Merge a mission's pull request
  • refresh_mcp_server_toolsSnapshot the bound server's current tools (with their readOnlyHint / destructiveHint annotations) for approval.No findings

    Why it is in this group

    • The description's first verb is "snapshot": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Snapshot the bound server's current tools (with their readOnlyHint / destructiveHint annotations) for approval. Approvals of tools that no longer exist are dropped. The binding must be ready; a server inside the sandbox has no gateway tool list. Requires config:write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Refresh an MCP server's tool list
  • save_sandbox_registryStore (or replace) the credential for a registry host.4 findings

    Why it is in this group

    • The name "save_sandbox_registry" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The title mentions "credential".

      Matched text

      title: "Store a private registry credential"

      What this check looks for
    • Info

      The annotations title mentions "credential".

      Matched text

      annotations.title: "Store a private registry credential"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Store (or replace) the credential for a registry host. The platform attac..."

      What this check looks for
    • Info

      The input schema at properties.scheme.description mentions "credential".

      Matched text

      inputSchema.properties.scheme.description: "How the registry takes the credential: 'bearer' sends secret as a token, 'bas..."

      What this check looks for
    Description, as the server wrote it
    Store (or replace) the credential for a registry host. The platform attaches it to sandbox requests for that host only; it never enters a sandbox and is never returned.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Store a private registry credential
  • set_agents_overridePatch one role's harness/model/effort/prompt for a single mission, layered over ship.yml per-field (a role or field this call omits keeps resolving from ship.yml — SHIP-337).No findings

    Why it is in this group

    • The name "set_agents_override" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Patch one role's harness/model/effort/prompt for a single mission, layered over ship.yml per-field (a role or field this call omits keeps resolving from ship.yml — SHIP-337). Use promptContent or promptPath(+promptRef) to run an ephemeral prompt experiment (spec D9) without committing to the target repo. Read-modify-write: this call is merged onto the previously stored override record (via get_agents_override), so a prior set for a DIFFERENT role — or a different field on this same role, e.g. an earlier harness pin — survives; the underlying PUT is a full-record replace and would otherwise silently drop it. This tool calls the SHIP API, documented at https://letsship.ai/docs/api.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Set a per-issue agents-override for one role
  • set_mission_auto_mergeSet whether SHIP merges this mission's pull request by itself once the checks, the review and the test pass.No findings

    Why it is in this group

    • The name "set_mission_auto_merge" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set whether SHIP merges this mission's pull request by itself once the checks, the review and the test pass. The setting is for this mission only and replaces the project's auto-merge for it; get_project shows the project's. While it is on, SHIP merges without asking again. Requires the missions:write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Turn auto-merge on or off for one mission
  • set_mission_dispositionRecord a person's reason for how a mission ended, which the delivery statistics use: product (real work, judged on its merits), probe (a test on purpose), superseded (another missi…No findings

    Why it is in this group

    • The name "set_mission_disposition" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Record a person's reason for how a mission ended, which the delivery statistics use: product (real work, judged on its merits), probe (a test on purpose), superseded (another mission replaced it: give supersededBy) or takeover (a person finished the work outside SHIP); null clears it. Set it only with the person's answer, never from your own guess. Requires the missions:write scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Record why a mission ended
  • start_credit_checkoutOpens a payment page and returns its URL.No findings

    Why it is in this group

    • The name "start_credit_checkout" says "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Opens a payment page and returns its URL. Nothing is charged until the buyer pays on that page. It sells one credit pack, a monthly plan (offer team, with teamPlan starter or scale, a subscription that renews until cancelled), or extra credits for a workspace already on a plan (offer team_credits, for quantity credits at that plan's own price per credit, paid once, expiring with the plan month). Only a workspace on a plan can use team_credits. Only owners and admins can open a page. The server refuses the request while startNow is false, and the same idempotencyKey returns the same page.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
    • title: Start buying credits or a monthly plan
  • stop_agent_runStop the agent in one run before it finishes.No findings

    Why it is in this group

    • The name "stop_agent_run" says "stop": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop the agent in one run before it finishes. Its work in progress is lost, and the run's status becomes stopped a few seconds later. Needs an org admin and the sandboxes:stop scope. This stops one agent run, not the mission: to stop the whole mission, use POST /v1/missions/{issueId}/stop.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Stop an agent run
  • stop_missionHard-stop a mission: every agent run of it stops and its work in progress is lost.No findings

    Why it is in this group

    • The name "stop_mission" says "stop": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Hard-stop a mission: every agent run of it stops and its work in progress is lost. The pull request stays open, and start_mission starts the mission again. To stop one agent run only, use stop_agent_run. Requires the missions:write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Stop a mission
  • unbind_mcp_serverDelete a binding and its stored credential: no role receives the server from its next run.1 finding

    Why it is in this group

    • The description's first verb is "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "Delete a binding and its stored credential: no role receives the server from its n..."

      What this check looks for
    Description, as the server wrote it
    Delete a binding and its stored credential: no role receives the server from its next run. The repository's MCP file is not changed, so the server can be bound again. Requires config:write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Remove an MCP server binding
  • update_projectChange the settings of one project; a field you leave out keeps its value.No findings

    Why it is in this group

    • The name "update_project" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change the settings of one project; a field you leave out keeps its value. status paused or archived stops new missions in the project, and active starts them again. autoMerge sets whether SHIP merges a ready pull request by itself. defaultSandboxTemplateId sets the sandbox the agents start in (null for the platform base). repoFullName and linearTeamKey connect the project to another repository or Linear team through the organization's existing connections. Change only what a person asked for. Answers the project as it now stands. Requires the projects:admin scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Change a project's settings
  • update_scheduled_taskPatch a scheduled task's name, prompt, schedule, skip-guard, or enabled state — only the fields passed are changed.No findings

    Why it is in this group

    • The name "update_scheduled_task" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Patch a scheduled task's name, prompt, schedule, skip-guard, or enabled state — only the fields passed are changed. To change the schedule, set interval/time/timezone together (plus weekday or dayOfMonth as the interval requires). This tool calls the SHIP API, documented at https://letsship.ai/docs/api. Requires the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Update a scheduled task
  • update_team_subscriptionChange the workspace's monthly plan subscription: plan switches between starter and scale from the next renewal on (nothing is charged or refunded for the current month; passing th…No findings

    Why it is in this group

    • The name "update_team_subscription" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change the workspace's monthly plan subscription: plan switches between starter and scale from the next renewal on (nothing is charged or refunded for the current month; passing the current plan drops a waiting switch), or cancelAtPeriodEnd true ends it when the month already paid for ends, false resumes it before then. Pass at least one. Owners and admins only. The answer is the subscription as it now stands, with any waiting switch under nextPlan.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • title: Change the monthly plan subscription
Can't be undone 1Claude Code: ask
  • send_mission_instructionTell a mission what to change.No findings

    Why it is in this group

    • The name "send_mission_instruction" says "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Tell a mission what to change. Use kind='follow_up' (the default) to ask for a change: the instruction reaches the agents AND dispatches the builder against the mission's open pull request, overriding cached review and QA verdicts. Use kind='note' to record context for whatever runs next without starting any work. A restart is a different thing: it re-evaluates an unchanged pull request against its cached verdicts, and so changes nothing. Returns a receipt saying what was recorded and what it will cause. This tool calls the SHIP API, documented at https://letsship.ai/docs/api. Requires the missions:write token scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Send a follow-up instruction to a mission
Changes things 18Claude Code: ask
  • activate_sandbox_template_versionMake a version the one missions use from their next dispatch.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Make a version the one missions use from their next dispatch. It is rebuilt only if its snapshot is gone; the response says which.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Roll a sandbox back (or forward) to a version
  • approve_mission_ceilingA mission that reached its credit limit pauses until a member lets it continue.No findings

    Why it is in this group

    • The name "approve_mission_ceiling" says "approve": a word for a change.
    Description, as the server wrote it
    A mission that reached its credit limit pauses until a member lets it continue. This raises the mission's limit by one step and runs the stage that stopped again, so it spends credits: ask the person first. Returns the new limit. Answers 409 when the mission is not at its limit. Requires the missions:run scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Let a mission continue past its credit limit
  • build_sandbox_templateBuild the sandbox's active version, or return the build already running for it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Build the sandbox's active version, or return the build already running for it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • title: Build a sandbox now
  • create_missionCreate the tracker issue AND start the run in one call, for work that has no issue yet.No findings

    Why it is in this group

    • The name "create_mission" says "create": a word for a change.
    Description, as the server wrote it
    Create the tracker issue AND start the run in one call, for work that has no issue yet. Pass entryStartAt='builder' with an entryPlan to hand over a plan you already wrote; pass entryStartAt='reviewer'/'qa' with entryPrNumber to hand over an existing build — in which case title may be omitted and the pull request's own title names the mission. This tool calls the SHIP API, documented at https://letsship.ai/docs/api. Requires the missions:run token scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Create a mission
  • create_scheduled_taskCreate a recurring agent mission.No findings

    Why it is in this group

    • The name "create_scheduled_task" says "create": a word for a change.
    Description, as the server wrote it
    Create a recurring agent mission. Firing it — on schedule, or immediately via run_scheduled_task — creates an ordinary tracker issue assigned to the agent, which drives a normal pipeline run: a scheduled task is a stored mission request, not a new execution mode. This tool calls the SHIP API, documented at https://letsship.ai/docs/api. Requires the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • title: Create a scheduled task
  • dismiss_noticeClose a notice for the person this token acts for, as the console's close button does.No findings

    Why it is in this group

    • The name "dismiss_notice" says "dismiss": a word for a change.
    Description, as the server wrote it
    Close a notice for the person this token acts for, as the console's close button does. Only a notice with dismissible: true can be closed (a low balance). It stays closed while its id lasts: a low balance that a top-up ends and a later spend brings back has a new id and shows again. Critical notices cannot be closed.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Dismiss a workspace notice
  • list_scheduled_task_runsRun history for one scheduled task, each row's status (dispatching/dispatched/skipped/failed) and, once its issue exists, the joined mission progress/cost.1 finding

    Why it is in this group

    • The name "list_scheduled_task_runs" says "list": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_scheduled_task_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_scheduled_task_runs" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run history for one scheduled task, each row's status (dispatching/dispatched/skipped/failed) and, once its issue exists, the joined mission progress/cost. A 'dispatched' status means the issue was created and the mission started — never that the work succeeded; read the joined mission state for that. Newest first; when older runs exist, pass nextCursor back as cursor for the next page.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List a scheduled task's run history
  • mark_setup_stepMark a step of the setup checklist completed or skipped for the person this token acts for, as the console's Mark as complete and Skip controls do; open removes the mark.No findings

    Why it is in this group

    • The name "mark_setup_step" says "mark": a word for a change.
    Description, as the server wrote it
    Mark a step of the setup checklist completed or skipped for the person this token acts for, as the console's Mark as complete and Skip controls do; open removes the mark. Give step for one milestone, or group to mark every open step of that group (the console's Skip all). A marked step counts as done on that person's checklist and its status says how; reached stays false until SHIP sees the step done. Returns the checklist as it now stands. A token that acts for no person is refused.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Mark a setup step
  • pause_missionHold a mission before its next stage.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Hold a mission before its next stage. The stage that runs now finishes; no agent is stopped. Use resume_mission to continue. Requires the missions:write scope and a role that can control missions.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Pause a mission
  • request_more_creditsAsk for more credits for the workspace, saying what they are for.No findings

    Why it is in this group

    • The name "request_more_credits" says "request": a word for a change.
    Description, as the server wrote it
    Ask for more credits for the workspace, saying what they are for. Any member may ask. The answer says who has the request: SHIP for a sponsored or Enterprise workspace, its owners and admins otherwise. A message sent while a request is open joins it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Ask for more credits
  • resume_missionContinue a paused mission.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Continue a paused mission. When a checkpoint holds it (get_mission shows pauseSource 'checkpoint:<role>'), this approves that stage's result and starts the next stage. To ask for changes to the result instead, use send_mission_instruction. Requires the missions:write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Resume a mission
  • run_scheduled_taskFire a scheduled task immediately, bypassing both its schedule and the skip-if-previous-open guard — an explicit run always creates a new issue even while a prior fire's mission is…No findings

    Why it is in this group

    • The name "run_scheduled_task" says "run": a word for a change.
    Description, as the server wrote it
    Fire a scheduled task immediately, bypassing both its schedule and the skip-if-previous-open guard — an explicit run always creates a new issue even while a prior fire's mission is still open. Requires the pipeline:control capability and, for a token caller, the missions:run scope — the same authorization starting a mission by hand requires, because it is the same act.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Run a scheduled task now
  • save_sandbox_templateCreate a sandbox (omit templateId) or change one.No findings

    Why it is in this group

    • The name "save_sandbox_template" says "save": a word for a change.
    Description, as the server wrote it
    Create a sandbox (omit templateId) or change one. A definition is Dockerfile steps on the platform base (RUN, ENV, ARG, WORKDIR, USER; no FROM). A changed definition or size becomes a new version and is built at once; the response carries that build. Refusals name the line or the size bound.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • title: Create or update a sandbox
  • set_mcp_config_pathPoint the project at the repository file that declares its MCP servers, e.g.1 finding

    Why it is in this group

    • The name "set_mcp_config_path" says "set": a word for a change.

    Findings

    • High

      The description refers to ".cursor/mcp.json", ".vscode/mcp.json" and ".mcp.json".

      Matched text

      description: "...ile that declares its MCP servers, e.g. .cursor/mcp.json or .vscode/mcp.json. null restores the..."

      What this check looks for
    Description, as the server wrote it
    Point the project at the repository file that declares its MCP servers, e.g. .cursor/mcp.json or .vscode/mcp.json. null restores the default (.mcp.json). The file is read, never edited. When the repository's ship.yml sets mcp.config, that wins and this call is refused (409); list_mcp_servers reports which one applies as configPathSource. Requires the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Set a project's MCP file path
  • start_mcp_server_oauthBegin the OAuth consent for a server bound as remote.1 finding

    Why it is in this group

    • The name "start_mcp_server_oauth" says "start": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...eturns to the console, which stores the credential. The link is single-use and expires (ex..."

      What this check looks for
    Description, as the server wrote it
    Begin the OAuth consent for a server bound as remote. Returns an authorizeUrl that a HUMAN must open in a browser signed in to the SHIP console as the same user this token acts for; the provider returns to the console, which stores the credential. The link is single-use and expires (expiresAt). An agent cannot complete the consent itself. Requires config:write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Start OAuth for a remote MCP server
  • start_missionHand a mission off to the AI agent team.No findings

    Why it is in this group

    • The name "start_mission" says "start": a word for a change.
    Description, as the server wrote it
    Hand a mission off to the AI agent team. Omit startAt for the default full run (planner first); pass startAt='builder' with a plan to skip straight to coding; pass startAt='reviewer' or startAt='qa' with an existing prNumber to hand off an existing build. Requires the missions:run token scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Start a mission
  • unarchive_missionShow an archived mission in list_missions and on the board again.1 finding

    Why it is in this group

    • The description's first verb is "show": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "unarchive_mission" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "show": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Show an archived mission in list_missions and on the board again. Requires the missions:write scope and the config:write capability.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Unarchive a mission
  • watch_agent_runWait on one agent run and follow what its agent does, instead of polling get_agent_run.1 finding

    Why it is in this group

    • The name "watch_agent_run" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "watch_agent_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "watch_agent_run" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Wait on one agent run and follow what its agent does, instead of polling get_agent_run. The call returns when the run ends, when its mission moves to another stage, or after maxSeconds. While it waits, each agent event (a thought, a tool call, a plan update, an error) is sent as a progress notification when the request has a progress token. The result has the status of the run, the stage of its mission, ended, the reason it returned, the last 20 events and a cursor. When the run is still running, call it again with since set to the cursor. A run that already ended returns at once. If your client ends a call after 60 seconds, set maxSeconds below that.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Watch an agent run
Only reads 32Claude Code: allow
  • get_agent_runFetch one agent run: its run record, metric series (CPU/mem/disk over time), and the agent session summaries (role, outcome, cost, sessionId).No findings

    Why it is in this group

    • The name "get_agent_run" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one agent run: its run record, metric series (CPU/mem/disk over time), and the agent session summaries (role, outcome, cost, sessionId). sessions lists every session of the run's role on the mission; runSessionId names this run's own, so read its log and cost from that one.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get agent run detail
  • get_agent_run_logsFetch a session's log content from one agent run.No findings

    Why it is in this group

    • The name "get_agent_run_logs" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a session's log content from one agent run. part=session is the agent stream-json (reasoning + tool calls); part=system is the container/runner stdout (clone, dependency install, validation gate, git, callback); part=prompt is the assembled input prompt. The role and sessionId are fields of the agent run's own record. A log longer than 40,000 characters returns its end, from a whole line, with a note.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get agent run logs
  • get_agents_overrideRead the per-issue agents/baseBranch override record for one mission, or null when unset.No findings

    Why it is in this group

    • The name "get_agents_override" says "get": a word for reading.
    Description, as the server wrote it
    Read the per-issue agents/baseBranch override record for one mission, or null when unset.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Read a mission's agents-override
  • get_artifactFetch one artifact's metadata + a long-lived signed serving url (open it to view the screenshot/video).No findings

    Why it is in this group

    • The name "get_artifact" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one artifact's metadata + a long-lived signed serving url (open it to view the screenshot/video).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get artifact
  • get_billingRead the workspace's credit balance by source and expiry, whether a new mission would start now, the per-mission credit ceiling, the project allowance and recent usage.No findings

    Why it is in this group

    • The name "get_billing" says "get": a word for reading.
    Description, as the server wrote it
    Read the workspace's credit balance by source and expiry, whether a new mission would start now, the per-mission credit ceiling, the project allowance and recent usage. Check it before dispatching work.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get workspace credits
  • get_environmentFetch one preview environment's registry row (status, worker name, timestamps).No findings

    Why it is in this group

    • The name "get_environment" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one preview environment's registry row (status, worker name, timestamps).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get preview environment detail
  • get_missionFetch one mission.No findings

    Why it is in this group

    • The name "get_mission" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one mission. view='summary' (the default, small enough to poll) returns its summary (activity, stage, review/check/test state, PR, paused and pauseSource, cost), its agent runs (sandboxId, role, status, harness, model, cost) and proofRunSandboxId (pass it to list_artifacts as sandboxId for the proof). view='full' adds its stages, events, stats and the plan/review/QA outcomes. pauseSource 'checkpoint:<role>' means a checkpoint holds it: resume_mission approves that stage. Requires the missions:read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get mission detail
  • get_noticesRead what needs attention in the workspace, critical first: a tracker connection its vendor no longer accepts (missions cannot start or report back until someone reconnects it), or…No findings

    Why it is in this group

    • The name "get_notices" says "get": a word for reading.
    Description, as the server wrote it
    Read what needs attention in the workspace, critical first: a tracker connection its vendor no longer accepts (missions cannot start or report back until someone reconnects it), or credits running out. Each notice has a stable id and kind, a message and, when the caller can act, an action URL to hand to a person. A notice the caller dismissed is left out. Check it before dispatching work.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get workspace notices
  • get_projectFetch a single project by its UUID.No findings

    Why it is in this group

    • The name "get_project" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single project by its UUID. Returns 404 if the project is not in the caller's org.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get project
  • get_sandbox_build_logA page of a build's log after sequence number `after`.No findings

    Why it is in this group

    • The name "get_sandbox_build_log" says "get": a word for reading.
    Description, as the server wrote it
    A page of a build's log after sequence number `after`. Call again with after = nextAfter until done is true.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Read a sandbox build's log
  • get_sandbox_capacityHow many agents the org's missions are running at once against its limit (null while the org is unclassified), which missions wait for an agent slot and why, and whether every slot…No findings

    Why it is in this group

    • The name "get_sandbox_capacity" says "get": a word for reading.
    Description, as the server wrote it
    How many agents the org's missions are running at once against its limit (null while the org is unclassified), which missions wait for an agent slot and why, and whether every slot on the platform is taken. Read from the platform's once-a-minute capacity check.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Read how many agents are running
  • get_scheduled_taskFetch one scheduled task by id: its project, name, prompt, triggers (schedule), labels, template key, skip-if-previous-open setting, enabled state, and next/last run times.No findings

    Why it is in this group

    • The name "get_scheduled_task" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one scheduled task by id: its project, name, prompt, triggers (schedule), labels, template key, skip-if-previous-open setting, enabled state, and next/last run times. An id outside the caller's accessible projects returns not found. For what each fire produced, use list_scheduled_task_runs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get scheduled task
  • get_setup_progressRead what the workspace has set up with SHIP so far, as the console's setup checklist shows it: up to 13 milestones in three groups, taken in order (get started, make it yours, mak…No findings

    Why it is in this group

    • The name "get_setup_progress" says "get": a word for reading.
    Description, as the server wrote it
    Read what the workspace has set up with SHIP so far, as the console's setup checklist shows it: up to 13 milestones in three groups, taken in order (get started, make it yours, make it autonomous). `activeGroup` names the group to work on now, and each group carries its own count. Each milestone says whether it is reached and, when a console page takes it and the caller's role can, the page that does it. `next` names the first milestone not reached yet. Use it to suggest the next step to a person.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get setup progress
  • healthzReturns the upstream API status, environment, and version.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns the upstream API status, environment, and version.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: API health probe
  • inspect_missionFetch the typed platform-inspection report for a mission, by its issue id.No findings

    Why it is in this group

    • The name "inspect_mission" says "inspect": a word for reading.
    Description, as the server wrote it
    Fetch the typed platform-inspection report for a mission, by its issue id. Returns per-section KV/D1/R2 state: task state, retry reason, dispatch error, latest review + QA verdicts, run index, per-attempt provenance, running sandboxes, and session-log heads. Requires the inspect:read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Inspect mission
  • list_agent_runsList the agent runs, live and finished, in the caller's accessible projects, newest first.No findings

    Why it is in this group

    • The name "list_agent_runs" says "list": a word for reading.
    Description, as the server wrote it
    List the agent runs, live and finished, in the caller's accessible projects, newest first. Each run is one agent in its own sandbox. Returns id (the run's sandbox id), issueId, role, harness, status, instance type, and latest CPU/memory/disk metrics. When more runs match, nextCursor is set: pass it back as cursor, with the same filters, for the next page.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List agent runs
  • list_artifactsList proof-of-work artifacts (QA screenshots/video/traces) for the caller's accessible projects.No findings

    Why it is in this group

    • The name "list_artifacts" says "list": a word for reading.
    Description, as the server wrote it
    List proof-of-work artifacts (QA screenshots/video/traces) for the caller's accessible projects. Each row carries kind, content type, caption, the acceptance criterion it proves, the sandboxId of the agent run that produced it, and a long-lived signed serving url. Filter by issueId to get one ticket's evidence: the artifacts of every run, superseded QA attempts included, up to limit; a note says when more exist. For the mission's proof of work specifically, read proofRunSandboxId from GET /v1/missions/{id} and pass it as sandboxId.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List artifacts
  • list_billing_ledgerList where the workspace's credits went, newest first: one entry per mission (its start, each further 3 agent-hours, and messages charged before messages became free), per grant, p…No findings

    Why it is in this group

    • The name "list_billing_ledger" says "list": a word for reading.
    Description, as the server wrote it
    List where the workspace's credits went, newest first: one entry per mission (its start, each further 3 agent-hours, and messages charged before messages became free), per grant, per adjustment and per expiry. Pass nextCursor back as cursor for the next page. Owners and admins only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List workspace credit ledger
  • list_credit_offersList what SHIP sells: the credit packs (credits, the price in US dollars before tax, which checkout adds for the buyer's location, and the price per credit), the monthly plans unde…No findings

    Why it is in this group

    • The name "list_credit_offers" says "list": a word for reading.
    Description, as the server wrote it
    List what SHIP sells: the credit packs (credits, the price in US dollars before tax, which checkout adds for the buyer's location, and the price per credit), the monthly plans under `team.plans` (Starter and Scale: each its credits a month, monthly price, price per credit, which credits added on top also cost, and agents at once), the range of credits a workspace on a plan can add at once, Enterprise under `enterprise` (the minimum yearly credit commitment, the highest and lowest price per credit, and the agents at once at the minimum; contracts are sold by SHIP, not through checkout), what Free and the packs allow (`limits`), plus the trial size. The same catalog the pricing page shows.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List credit packs, the monthly plans and Enterprise
  • list_environmentsList per-mission preview environments for the caller's accessible projects.No findings

    Why it is in this group

    • The name "list_environments" says "list": a word for reading.
    Description, as the server wrote it
    List per-mission preview environments for the caller's accessible projects. Returns id, issueId, projectId, prNumber, workerName, and lifecycle status.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List preview environments
  • list_mcp_bindingsEvery MCP server binding across the projects you can see in your org: project, server, transport, status, enabled roles, how it authenticates, and the NAMES of the credential field…1 finding

    Why it is in this group

    • The name "list_mcp_bindings" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...it authenticates, and the NAMES of the credential fields set (never values). Use it to fi..."

      What this check looks for
    Description, as the server wrote it
    Every MCP server binding across the projects you can see in your org: project, server, transport, status, enabled roles, how it authenticates, and the NAMES of the credential fields set (never values). Use it to find where a credential is used; use list_mcp_servers for one project's full detail.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List the org's MCP bindings
  • list_mcp_serversThe MCP servers a project's repository declares in its MCP file (.mcp.json by default), each with its binding: enabled roles, transport, status, approved tools, per-role effective …2 findings

    Why it is in this group

    • The name "list_mcp_servers" says "list": a word for reading.

    Findings

    • High

      The description refers to ".mcp.json".

      Matched text

      description: "...'s repository declares in its MCP file (.mcp.json by default), each with its binding: ena..."

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "...tool it exposes), and the NAMES of the credential fields set (never values). Also reports..."

      What this check looks for
    Description, as the server wrote it
    The MCP servers a project's repository declares in its MCP file (.mcp.json by default), each with its binding: enabled roles, transport, status, approved tools, per-role effective tool counts (null when the server runs inside the sandbox and the role gets every tool it exposes), and the NAMES of the credential fields set (never values). Also reports whether the file could be read (configStatus).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List a project's MCP servers
  • list_missionsList missions in the caller's accessible projects, newest activity first, with total for paging.No findings

    Why it is in this group

    • The name "list_missions" says "list": a word for reading.
    Description, as the server wrote it
    List missions in the caller's accessible projects, newest activity first, with total for paging. Each has issueId, title, activity (what it does now), pipelineProgress, review/check/test state, PR, cost and paused. Archived missions are left out. Requires the missions:read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List missions
  • list_orgsList every organization on the platform with its owner email, member count, and pending invite status.No findings

    Why it is in this group

    • The name "list_orgs" says "list": a word for reading.
    Description, as the server wrote it
    List every organization on the platform with its owner email, member count, and pending invite status. Requires platform-admin (cross_org) access. Cursor-paginated (default page size 50) — feed the response's nextCursor back as the cursor input to reach the next page; a null nextCursor means there are no more pages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List every org (cross-tenant)
  • list_projectsList the projects accessible to the calling principal.No findings

    Why it is in this group

    • The name "list_projects" says "list": a word for reading.
    Description, as the server wrote it
    List the projects accessible to the calling principal. Returns id, slug, name, status, createdAt for each.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List projects
  • list_sandbox_registriesThe org's private package registries sandboxes install from: host, auth scheme, username.No findings

    Why it is in this group

    • The name "list_sandbox_registries" says "list": a word for reading.
    Description, as the server wrote it
    The org's private package registries sandboxes install from: host, auth scheme, username. Never the secret.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List private registries
  • list_sandbox_startersReady-made sandbox definitions (Python, Java, Go, Rust, Ruby) to create a sandbox from.No findings

    Why it is in this group

    • The name "list_sandbox_starters" says "list": a word for reading.
    Description, as the server wrote it
    Ready-made sandbox definitions (Python, Java, Go, Rust, Ruby) to create a sandbox from.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List sandbox starters
  • list_sandbox_template_versionsEvery saved version of a sandbox, newest first, with the active one marked and each one's latest build.No findings

    Why it is in this group

    • The name "list_sandbox_template_versions" says "list": a word for reading.
    Description, as the server wrote it
    Every saved version of a sandbox, newest first, with the active one marked and each one's latest build.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List a sandbox's versions
  • list_sandbox_templatesList the org's sandboxes (definitions agents start in), with each one's active version, size and latest build status.No findings

    Why it is in this group

    • The name "list_sandbox_templates" says "list": a word for reading.
    Description, as the server wrote it
    List the org's sandboxes (definitions agents start in), with each one's active version, size and latest build status.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List custom sandboxes
  • list_scheduled_task_templatesRead-only gallery of curated scheduled task templates — a prepared prompt plus a suggested cadence.No findings

    Why it is in this group

    • The name "list_scheduled_task_templates" says "list": a word for reading.
    Description, as the server wrote it
    Read-only gallery of curated scheduled task templates — a prepared prompt plus a suggested cadence. A template is content, not a code path: pass its key as templateKey on create_scheduled_task for attribution, or copy its prompt/schedule into a hand-written scheduled task.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List scheduled task templates
  • list_scheduled_tasksList recurring agent missions (scheduled tasks) across the caller's accessible projects — schedule, enabled state, and next/last fire time for each.No findings

    Why it is in this group

    • The name "list_scheduled_tasks" says "list": a word for reading.
    Description, as the server wrote it
    List recurring agent missions (scheduled tasks) across the caller's accessible projects — schedule, enabled state, and next/last fire time for each. Pass projectId for the tasks of one project.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: List scheduled tasks
  • whoamiReturns the caller's identity, org, role, role-derived RBAC capabilities, and token scopes.No findings

    Why it is in this group

    • The name "whoami" says "whoami": a word for reading.
    Description, as the server wrote it
    Returns the caller's identity, org, role, role-derived RBAC capabilities, and token scopes. Use this to check whether the current token may perform an action (e.g. config:write) before attempting it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Identify the calling principal

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.24.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ship https://mcp.letsship.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ship__healthz",
      "mcp__ship__whoami",
      "mcp__ship__get_setup_progress",
      "mcp__ship__get_billing",
      "mcp__ship__list_billing_ledger",
      "mcp__ship__list_credit_offers",
      "mcp__ship__get_notices",
      "mcp__ship__list_projects",
      "mcp__ship__get_project",
      "mcp__ship__get_agents_override",
      "mcp__ship__list_missions",
      "mcp__ship__get_mission",
      "mcp__ship__list_scheduled_tasks",
      "mcp__ship__list_scheduled_task_templates",
      "mcp__ship__get_scheduled_task",
      "mcp__ship__list_mcp_servers",
      "mcp__ship__list_mcp_bindings",
      "mcp__ship__list_agent_runs",
      "mcp__ship__get_agent_run",
      "mcp__ship__get_agent_run_logs",
      "mcp__ship__list_sandbox_templates",
      "mcp__ship__get_sandbox_capacity",
      "mcp__ship__list_sandbox_starters",
      "mcp__ship__list_sandbox_template_versions",
      "mcp__ship__get_sandbox_build_log",
      "mcp__ship__list_sandbox_registries",
      "mcp__ship__list_environments",
      "mcp__ship__get_environment",
      "mcp__ship__list_artifacts",
      "mcp__ship__get_artifact",
      "mcp__ship__inspect_mission",
      "mcp__ship__list_orgs"
    ],
    "ask": [
      "mcp__ship__request_more_credits",
      "mcp__ship__dismiss_notice",
      "mcp__ship__mark_setup_step",
      "mcp__ship__start_mission",
      "mcp__ship__create_mission",
      "mcp__ship__send_mission_instruction",
      "mcp__ship__pause_mission",
      "mcp__ship__resume_mission",
      "mcp__ship__approve_mission_ceiling",
      "mcp__ship__unarchive_mission",
      "mcp__ship__create_scheduled_task",
      "mcp__ship__run_scheduled_task",
      "mcp__ship__list_scheduled_task_runs",
      "mcp__ship__set_mcp_config_path",
      "mcp__ship__start_mcp_server_oauth",
      "mcp__ship__watch_agent_run",
      "mcp__ship__save_sandbox_template",
      "mcp__ship__activate_sandbox_template_version",
      "mcp__ship__build_sandbox_template"
    ],
    "deny": [
      "mcp__ship__start_credit_checkout",
      "mcp__ship__update_team_subscription",
      "mcp__ship__update_project",
      "mcp__ship__set_agents_override",
      "mcp__ship__clear_agents_override",
      "mcp__ship__stop_mission",
      "mcp__ship__merge_mission",
      "mcp__ship__decline_mission",
      "mcp__ship__set_mission_auto_merge",
      "mcp__ship__archive_mission",
      "mcp__ship__set_mission_disposition",
      "mcp__ship__update_scheduled_task",
      "mcp__ship__delete_scheduled_task",
      "mcp__ship__bind_mcp_server",
      "mcp__ship__unbind_mcp_server",
      "mcp__ship__refresh_mcp_server_tools",
      "mcp__ship__stop_agent_run",
      "mcp__ship__save_sandbox_registry",
      "mcp__ship__delete_sandbox_template",
      "mcp__ship__delete_sandbox_registry",
      "mcp__ship__destroy_environment"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ship. Review it before you use it.