Before you ship your AI-built SaaS, Assurly tells you in 60 seconds what will break in production — and what you can safely ignore.

Run a pre-deploy check that reads the project the way an attacker would, not the way the code reads. Assurly scans a Next.js, Supabase, Stripe and Vercel project across 13 rule areas and returns a single verdict — READY TO SHIP, REVIEW RECOMMENDED, or NOT READY TO SHIP — with a Ship Score out of 100. AI coding tools produce working code quickly but routinely leave production wiring unfinished: a database table without row-level security, a payment webhook that never verifies its signature, a service key that reaches the browser. Those are the gaps the scan is built to find.

Assurly checks 13 rule areas: Supabase row-level security and exposed service-role keys, Stripe webhook signature verification, secrets and undocumented environment variables reaching the client bundle, React Server Component data leaks, SQL and migration safety, serverless connection pooling, Vercel edge compatibility, cold-start cost, TypeScript strictness, missing CI checks, the AI agent's own tooling and MCP configuration, and install-time trust under npm 12. Each finding arrives with the exact fix — the SQL statement or the config change — rather than a warning to go research.

No. The Assurly CLI and the MCP server analyse your project entirely on your own machine and make no network calls while scanning. The manual web checker parses pasted snippets, folders and ZIP files inside your browser. Connected GitHub scans are the exception and are explicit: Assurly retrieves repository content server-side using a short-lived GitHub App token, stores findings, file paths and line numbers, and does not retain complete source files.

Run `npx assurly scan --supply` to list them. npm 12 stopped running install scripts by default, so every project now records which dependencies it trusts to execute code during installation in an `allowScripts` allowlist. A bare package name in that allowlist grants execution to every version of the package, forever — including a version published later by whoever takes the package over. An exact version pin does not. Assurly reads the allowlist, the lockfile install-script flags and non-registry dependencies, entirely offline.

Yes. Assurly ships an MCP server with 6 tools, so an agent in Cursor, Claude Code, VS Code or Windsurf can gate its own work. Install it with `npx -y @assurly/mcp-server`. When the verdict is blocked the tool returns an error rather than a passing result, which stops the agent instead of letting it ship. Assurly also audits the agent stack itself with `npx assurly scan --agent`, reporting MCP servers that run shell commands, remote endpoints on plain HTTP, credentials written into config, and instructions hidden from readers but visible to models.

A Ship Score is a single number out of 100 summarising whether a project is ready for production, shown with one of three verdicts. Blockers are the findings that must be fixed before deploying and drive the verdict to NOT READY TO SHIP. When the verdict is blocked the score is capped so the number never looks like READY. Warnings are worth reviewing but do not block. The score exists so the decision to deploy is one answer rather than a list a non-specialist has to interpret.

Yes. `npx assurly scan` exits with a non-zero status when the verdict is blocked, so it drops into any CI pipeline as an ordinary step with no plugin required. `assurly init` writes a GitHub Actions workflow for you. Because the CLI scans locally, CI needs no API key and no account.

The CLI is free and unlimited: `npx assurly scan` runs the full gate locally with no account. The free hosted plan adds the live URL proof-probe, one guarded app and MCP server access. The Pro plan, at $19 per month, starts with a 3-day free trial and adds unlimited guarded apps, continuous monitoring on every deploy, AI deep review, auto-fix pull requests and private repository scanning.

Yes. Pro includes a 3-day free trial. You add a payment method at checkout; nothing is charged during the trial. Unless you cancel before it ends, the subscription converts to the plan you chose ($19 per month or $149 per year) and billing starts. One trial per customer and payment method.

The SEO & GEO Audit scores a live URL for machine readability — separately from the Ship Gate security verdict. It returns an AI Readiness Score out of 100 and one of three verdicts: FULLY VISIBLE, PARTIALLY VISIBLE, or INVISIBLE TO AI. The audit checks canonical URLs, structured data (JSON-LD), llms.txt, server-rendered content, AI crawler access in robots.txt, and share images (og:image), among related readiness signals. It does not query ChatGPT, Perplexity, or Google for rankings. Anonymous visitors see the headline scores; Pro unlocks every check and the exact fix for each gap.