Shipvigil

Shipvigil is a release gate for GitLab. It blocks only what attackers are using now, fixes it on the merge request with a GitLab Duo flow, and checks the deployed site from outside before anyone calls the release done.

A dependency scanner tells you that 25 of your packages have advisories. Shipvigil tells you that 3 of them matter this week, and opens the fix.

Why

A critical rating doesn't mean an attack is likely. We gave the cve server 25 popular npm packages at old versions, each with a published advisory (the script). On 2026-10-17, 3 of the 25 were likely to be exploited: ejs 3.1.6 (EPSS 32.8%, the chance of exploitation in the next 30 days), lodash 4.17.20 (21.3%) and moment 2.29.1 (13.9%). vm2 3.9.17 is rated critical, but its EPSS is 8.1% and it is not in the CISA KEV catalog, so it is a warning, not a block. Four packages have no EPSS score yet, and the other 18, vm2 among them, are routine.

Shipvigil blocks a release only for a malicious release (OSV), a CVE in the CISA Known Exploited Vulnerabilities catalog, or an EPSS score of 0.1 or more. Everything else shows as a warning in the merge request, so the gate stays strict without becoming noise.

What it does

Step	Where	What happens
Rank	CI job `shipvigil-deps`	Sends each lockfile to the cve MCP server. Blocks on malicious, exploited or likely. Writes a GitLab code quality report, so each package shows on its lockfile line in the merge request.
Fix	Duo flow `Shipvigil gate`	When you add the flow as a reviewer, or the gate fails a pipeline, the flow runs the same CLI, upgrades the blocked packages, regenerates the lockfile, commits to the source branch and posts one verdict note.
Review	CI job `review`	Deploys the merge request's build to a review app with the job's GitLab ID token. No deploy secret is stored in GitLab.
Check live	CI job `review-live`, `deploy-production`	Asks the site-check MCP server, from outside your network, whether the page answers, whether it can be indexed, which security headers are missing, and whether secrets, keys or admin paths are exposed.
Release	Tag pipeline	The release notes carry the gate verdict and link the evidence.
Deploy	Manual job	A person starts production. A blocking live check rolls the host back to the previous version.
Monitor	Scheduled pipeline	Runs the live check every day, so a leak shows up without a release.

Autonomy level: Supervised. The flow commits fixes on its own, and a person approves the production deploy.

Try it in 5 minutes

You need Node.js 20 or later and a project with a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock or go.sum). The MCP servers are public, so you need no key and no sign-up.

git clone https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/13305102/shipvigil.git
cd your-project
node ../shipvigil/bin/shipvigil.mjs deps

The command prints a table, writes shipvigil-report/ and exits 1 when the policy blocks. To see a block, run it on the demo lockfile in this repo:

node bin/shipvigil.mjs deps --lockfile test/fixtures/demo-package-lock.json

Check a deployed page:

node bin/shipvigil.mjs live https://your-site.example/ --env production

The leak scan reads a host only after its owner publishes a proof token. The first run prints the file to serve (/.well-known/agent-tools-exposure.txt) and the token.

Add it to a GitLab project

Add the include to .gitlab-ci.yml. The shipvigil-deps job runs in the test stage by default.

include:
  - project: gitlab-ai-hackathon/transcend-october-2026/13305102/shipvigil
    ref: main
    file: templates/shipvigil.gitlab-ci.yml

Optional: add shipvigil.policy.json to choose the lockfiles and the block rule (see the policy).

Optional: add a live check after your deploy job:

check-live:
  stage: .post
  extends: .shipvigil-live
  variables:
    SHIPVIGIL_URL: https://your-site.example/
    SHIPVIGIL_ENV: production

Optional: set up the Duo flow (see the gate flow).

Push, and the merge request shows each blocked package on its lockfile line.

Parts

Path	What it is
`bin/shipvigil.mjs`, `lib/`	The CLI. No dependencies. Commands: `deps`, `live`, `summary`, `publish`, `rollback`, `stop`.
`templates/shipvigil.gitlab-ci.yml`	The CI template: `shipvigil-deps` and the hidden jobs `.shipvigil-live`, `.shipvigil-publish`, `.shipvigil-stop`.
`flows/shipvigil-gate.yml`	The Duo Agent Platform flow (flow registry v1).
`.gitlab/duo/agent-config.yml`	The flow's runtime: fetches the CLI and allows only the MCP servers and npm.
`skills/shipvigil-gate/SKILL.md`	The playbook the flow follows to clear a block without weakening the gate.
`shipvigil.policy.json`	This project's policy.
`host/`	The Shipvigil host: a Cloudflare Worker that serves production and review apps and takes deploys signed by GitLab. See the host.
`site/`	This documentation site. Shipvigil's own pipeline releases it through the gate.

Where the data comes from

Vulnerabilities: OSV.dev (GitHub Advisory Database and other open databases).
Exploited in the wild: the CISA KEV catalog.
Likely to be exploited: FIRST EPSS, the probability of exploitation in the next 30 days.
Live checks: the Agent Tools site-check MCP server, which requests the page from its own network.

Both MCP servers are part of Agent Tools by OpenKrill and answer at https://api.openkrill.app/plugins/cve/mcp and https://api.openkrill.app/plugins/site-check/mcp. Set SHIPVIGIL_CVE_MCP or SHIPVIGIL_SITE_MCP to use another server with the same tools.

Limits

A match is by exact package name and version. Shipvigil cannot tell whether your code reaches the vulnerable function.
EPSS and KEV change daily. A pass today can be a block tomorrow, which is what the scheduled pipeline is for.
The flow fixes npm projects. For other ecosystems it reports the block and the fixed version, and a person upgrades.
The leak scan needs the owner's proof token on the host.

License

MIT. See LICENSE.