ShipSleuthShipSleuthPublic GitHub diligence

Developers

Human-first, agent-compatible tooling.

ShipSleuth is built first for humans, but it now ships an official API surface and an experimental MCP server for agent workflows. The product thesis stays the same: public GitHub diligence, not employee surveillance.

Website for humansAPI for softwareExperimental MCPSame methodology underneath
Open OpenAPI specView the repo

Token boundary

The public website uses the hosted token. Agent tooling does not. If you run the MCP server or self-host the API for automated use, you should provide your own GITHUB_TOKEN. That keeps ShipSleuth from turning into an unbounded hosted automation service.

ShipSleuth is also calculator-first. The goal is direct public GitHub metrics plus caveats, not a black-box judgment engine. Read responsible use.

Public API

Current machine-readable surface

RoutePurpose
/api/analyzeSingle-target public GitHub diligence.
/api/rankMulti-target ranking across one shared window.
/api/historyAdjacent like-for-like historical snapshots.
/api/mutualsAuthenticated mutual-follow helper used by Squad.

These routes power the web app today. For self-hosters and controlled integrations, the shape is documented in /openapi.json. The authenticated /api/mutuals helper is app-internal and is not currently part of the OpenAPI document.

MCP

Experimental agent workflow support

ToolUse
list_radar_packsDiscover the curated market-map packs that ShipSleuth already ships.
analyze_targetRun a structured public GitHub diligence pass on a single org or user.
compare_targetsRun a head-to-head compare for two orgs or users on one window.
rank_targetsRank 2-12 orgs or users on the same window.
build_historyBuild adjacent windows for directional longer-history context.
Resources: methodology, radar packsPrompts: DD brief, portfolio check

Run the MCP server

GITHUB_TOKEN=ghp_your_token_here npm run mcp

This is the recommended day-one path for agents: local or self-hosted, with the caller’s own token.

Sample API request

curl -X POST http://localhost:3000/api/analyze \
  -H 'Content-Type: application/json' \
  --data '{
    "target": "vercel",
    "startDate": "2026-01-01",
    "endDate": "2026-03-31",
    "granularity": "week",
    "repoLimit": 24
  }'

Use this for local or self-hosted integrations. Heavy hosted automation is intentionally not the launch posture.

Rate expectations

ShipSleuth and GitHub enforce separate limits.

Responses expose X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset; a 429 also includes Retry-After. One ShipSleuth request can make several GitHub requests, so these ceilings do not replace GitHub's quota.

GitHub documents a primary REST allowance of 60 requests/hour without authentication and 5,000 requests/hour for a typical authenticated user. Secondary limits can still apply. Read GitHub's current rate-limit guidance.

Guardrails

What ShipSleuth agent tooling is for