Skip to content

Coding agents

Works with the coding agent you already use.

Your agent gets the rules before it writes, and a fix plan it can work through after. Stableship proves each fix on a private copy of your app.

  • Claude Code
  • Cursor
  • Codex
  • Windsurf
  • Lovable
  • Bolt
  • Replit

Run the free audit first; you connect your agent from inside the app with a token made for it.

Claude Code

One plugin: tools, a skill and a status check.

Install it from Claude Code. The plugin brings the MCP server with it.

In Claude Code
/plugin marketplace add stableship-ai/claude-plugins/plugin install stableship@stableship

  • The Stableship MCP server

    Your rules, findings and fix plan, one tool call away.

  • /stableship:gate status · check · fix

    See what holds the release, run a check, or fix blocking findings one by one and verify each.

  • The stableship skill

    Read the rules before touching auth, data or money; give every new table row level security; propose rule changes instead of loosening access.

  • A session-start note

    Each session opens with what is blocking and how many rules your app has.

Cursor, Codex and Windsurf

The same tools over MCP.

Add the Stableship server, https://api.stableship.ai/mcp, with a token from Settings in the app.

.cursor/mcp.json
{  "mcpServers": {    "stableship": {      "url": "https://api.stableship.ai/mcp",      "headers": {        "Authorization": "Bearer <your Stableship token>"      }    }  }}

Lovable, Bolt and Replit

Building in an app builder? Connect through GitHub.

If your project syncs to GitHub and runs on Supabase, Stableship checks it like any other.

  1. 01

    Sync your project to GitHub

    Lovable, Bolt and Replit all push to a GitHub repo. Install Stableship on that repo and every change is checked.

  2. 02

    Turn on Watchdog

    When a change breaks your rules, you get an alert and a pull request that reverts it, ready to merge.

  3. 03

    Paste the fix into chat

    Every finding comes with a prompt written for your builder. Copy it, paste it, and Stableship re-checks the result.

Project instructions

Tell every session about your rules.

Paste this block into the file your agent reads. The get_setup tool hands it to your agent too.

Stableship block
## Stableship Stableship checks this app before each release and holds releases that break its rules (who may see and change what). - Before changing auth, data access, payments or database migrations, read the rules: the Stableship `get_rules` tool, or `.gate/rules.md`. `get_context` adds the founder's product notes (`.gate/context.md`).- Every new Supabase table gets row level security and policies that match the rules. Never put the service-role key in client code.- Never change who can access what on your own: call `propose_rule` and say why. Record important product facts with `add_context_note`.- Before pushing risky changes, call `run_check` and wait for the verdict. To fix findings, work through `get_fix_plan` in order and call `verify_fix` after each fix.- In Claude Code, the Stableship plugin's `stableship` skill has the full workflow.
  • CLAUDE.md
    Claude Code
  • AGENTS.md
    Codex and other agents that read AGENTS.md
  • .cursor/rules/stableship.mdc
    Cursor

Your rules live in your repo

.gate/rules.md and .gate/context.md sync both ways through pull requests, so agents that only read files still follow them.

MCP tools

What your agent can ask Stableship.

get_context
Rules, kinds of user and your product notes, before work on auth, data, money or migrations.
get_rules
Who may see, create, change and delete what, as plain sentences.
propose_rule
Suggest an access change for you to approve, instead of changing it in code.
add_context_note
Record a lasting product fact; it lands in .gate/context.md through a pull request.
run_check
Check a pushed commit and get the verdict.
get_run_status
Status, verdict and findings for a check or audit.
get_findings
Open findings, blocking ones first.
get_fix_brief
Everything to fix one finding: the rule, where to look, repro steps, done-when.
get_fix_plan
STABLESHIP_FIXES.md: every open finding as ordered tasks.
verify_fix
Re-run just the checks that found a finding, against your fix.
get_report
The audit report in plain English, to explain it to you.
run_audit
Start a full audit (protected apps).
list_projects
Your projects, matched to the repo the agent is in.
get_setup
The project-instructions block for CLAUDE.md, AGENTS.md or Cursor rules.

CLI and CI

From the terminal, or as a step in CI.

For agents without MCP, scripts and pipelines.

Terminal
npm i -g @stableship/clistableship loginstableship findings --blockingstableship brief <findingId> --prompt | pbcopystableship verify <findingId> --wait
GitHub Actions
- name: Stableship check  env:    STABLESHIP_TOKEN: ${{ secrets.STABLESHIP_TOKEN }}  run: npx --yes @stableship/cli@0.1 check --ref "$GITHUB_SHA" --wait
  • 0Passed, or Stableship failed on its side. We never block you on our own errors.
  • 1Held: a reproduced finding blocks this release.
  • 2Could not run: not logged in, bad token or a usage error.

Start with the free audit.

Sign in with GitHub, connect Supabase, and connect your agent when the report is ready.

Start your free audit