Developers
ShipSleuth is built first for humans, but it now ships an official API surface and an experimental MCP server for agent workflows. The product thesis stays the same: public GitHub diligence, not employee surveillance.
Token boundary
The public website uses the hosted token. Agent tooling does not. If you run the MCP server or self-host the API for automated use, you should provide your own GITHUB_TOKEN. That keeps ShipSleuth from turning into an unbounded hosted automation service.
ShipSleuth is also calculator-first. The goal is direct public GitHub metrics plus caveats, not a black-box judgment engine. Read responsible use.
Public API
| Route | Purpose |
|---|---|
| /api/analyze | Single-target public GitHub diligence. |
| /api/rank | Multi-target ranking across one shared window. |
| /api/history | Adjacent like-for-like historical snapshots. |
These routes power the web app today. For self-hosters and controlled integrations, the shape is documented in /openapi.json.
MCP
| Tool | Use |
|---|---|
| list_radar_packs | Discover the curated market-map packs that ShipSleuth already ships. |
| analyze_target | Run a structured public GitHub diligence pass on a single org or user. |
| compare_targets | Run a head-to-head compare for two orgs or users on one window. |
| rank_targets | Rank 2-12 orgs or users on the same window. |
| build_history | Build adjacent windows for directional longer-history context. |
Run the MCP server
GITHUB_TOKEN=ghp_your_token_here npm run mcpThis is the recommended day-one path for agents: local or self-hosted, with the caller’s own token.
Sample API request
curl -X POST http://localhost:3000/api/analyze \
-H 'Content-Type: application/json' \
--data '{
"target": "vercel",
"startDate": "2026-01-01",
"endDate": "2026-03-31",
"granularity": "week",
"repoLimit": 24
}'Use this for local or self-hosted integrations. Heavy hosted automation is intentionally not the launch posture.
Guardrails