The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
C-Rank Grade: S (Elite) - 77/100
External PR Merge Rate: 84%
Response Time: 14h
First Timer Success: 100%
asamassekou10/ship-safe has a recorded first-timer success rate of 100.0%. Repositories ranked S typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in asamassekou10/ship-safe respond to incoming external pull requests in approximately 14.3 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 76.5 places asamassekou10/ship-safe in the S tier.
The external contributor pull request merge rate for asamassekou10/ship-safe is 84.4%, based on public PR activity from non-core contributors.
asamassekou10/ship-safe currently has 14 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
Highly welcoming maintainers in asamassekou10/ship-safe. Prompt code reviews with positive guidance for new contributors.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/asamassekou10/ship-safe?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 01:00 UTC (01:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 01:00 to 05:00 UTC (01:00 - 05:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~9 hours (96% approval). Large PRs (>500 lines) take ~69 hours (38% approval). Keep your diff compact for rapid review.
Why this matters Make connect → investigate → inspect evidence work consistently across supported clients, and keep CI acceptance independent of what a coding agent says. Definition of done Build a fake-client stdio harness plus manual versioned smoke checklist for Claude Code, Codex and Cursor. Test malformed inputs, cancellation, root confusion, secret redaction and connected-versus-invoked status. Bind CI evidence to trusted base policy, source/test digests and permitted runner identity; subject PRs cannot relax their own gate. Test stale/forged cases, unavailable runners and missing coverage; no false-green result. Add held-out vulnerable/fixed/control fixtures for supported replay families, including deceptive patches. Publish denominators, unsupported scope and timing/cost methodology; no universal safety or precision claims. Preserve existing benchmark floors. Where to start / first PR Start with cli/tests/mcp-*.test.js, cli/tests/ci-verdict-gate.test.js and benchmar
Why this matters Connect existing approved fix planning and undo to bounded replay. A patch must not receive a successful verdict by changing its own test or hiding a pattern. Definition of done Reuse existing fix approval/diff/undo; do not introduce autonomous merge or deployment. Freeze reviewed test oracle before patch generation; changes to it require separate approval. Run vulnerable-before/fixed-after and legitimate-behavior controls on exact artifacts; unsupported cases stay inconclusive. Check affected files and dependencies; preserve new unresolved/confirmed concerns. Export source, test, runner and result provenance; tampering or stale digests prevents acceptance. Include a deceptive rename/move patch that removes an alert but leaves the reproduction working. Where to start / first PR Start with cli/commands/agent-fix.js, cli/utils/fix-verification.js and evidence tests. First PR can be pure case-result classification with synthetic runner results. Dependencies #227,#
Why this matters Add a dedicated Cursor guide for Ship Safe's existing MCP server and a repeatable contributor smoke test. Definition of done Cover project versus user configuration using official Cursor documentation, explicit root selection and pinned executable/package. Show connection verification, a harmless existing tool call, troubleshooting and removal. Explain tool approvals and why MCP connection alone is not continuous enforcement. Record exact tested client/Node/Ship Safe versions; distinguish IDE from CLI/cloud support. Use synthetic fixture/config only, never blanket auto-approval, credentials or unimplemented command examples. Where to start / first PR Create docs/integrations/cursor.md and link it from the integration documentation. Small docs PR welcome; ask a maintainer for access-dependent smoke tests. Dependencies Can start now. Coordinate with #230/#229. Official reference: https://#233.com/docs/#229 Contribution invitation Please comment with the slice you
Why this matters Improve the existing Codex MCP guide so users can connect Ship Safe and verify a real tool call without confusing configuration with enforcement. Definition of done Document supported stdio registration, explicit workspace handling, diagnostics and removal using current official docs. Include a harmless test against existing tools and expected evidence/status; record tested versions and date. Keep CLI, IDE and desktop claims separate; mark untested surfaces rather than assuming parity. Preserve the existing available/not-protected distinction; lifecycle research stays in #137. Use synthetic config and sanitized output. No provider keys or private transcripts in examples. Where to start / first PR Start with docs/integrations/codex.md. This is a bounded docs/testing task, not an implementation of undocumented Codex hooks. Maintainers can run unavailable client checks. Dependencies Can start now. Coordinate with #230/#229 for future command examples; relates to #1
Why this matters Give contributors a small, useful starting point: improve the existing Claude Code guide for today's Ship Safe MCP tools, with a clearly marked future workflow section. Definition of done Document pinned local stdio setup, workspace scope, connection check, one harmless review and removal. Explain MCP availability versus existing Claude hooks; do not claim every action is intercepted. Use synthetic fixtures and redacted output. Record tested client/Node/Ship Safe versions and date. Include troubleshooting for missing executable, wrong working directory and unavailable tools. Link official documentation; separate Claude Code from Claude Desktop or web clients. Do not document proposed tools as already available. Where to start / first PR Start with docs/integrations/claude-code.md and existing MCP tests. Documentation and one inert sample fixture only; no credentials, paid model runs or privileged installation required. Maintainers can validate a client you canno
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to asamassekou10/ship-safe, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of asamassekou10/ship-safe acknowledge new external contributions in approximately 14 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 84.4% were successfully merged into the primary branch.
asamassekou10/ship-safe has a recorded first-timer success rate of 100.0%. Repositories ranked Elite typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~14 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 76.5 places asamassekou10/ship-safe in the Elite tier.
The external pull request merge rate is 84.4%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, asamassekou10/ship-safe currently has 14 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for asamassekou10/ship-safe are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.