Shypset API

export SHYPSET_API_KEY="shp_live_<your key>"
BASE=https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1

# 1. Start a scan
curl -sS -X POST "$BASE/v1/scans" \
  -H "Authorization: Bearer $SHYPSET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'
# -> 202 {"scan_id": "...", "status": "queued", "poll_url": "..."}

# 2. Poll every 3-5 seconds until status is "completed" or "failed"
curl -sS "$BASE/v1/scans/$SCAN_ID" \
  -H "Authorization: Bearer $SHYPSET_API_KEY"

# 3. One fix prompt for the open issues, written for your AI tool
curl -sS "$BASE/v1/scans/$SCAN_ID/fix-prompt?target=cursor" \
  -H "Authorization: Bearer $SHYPSET_API_KEY"

// Save as scan.mjs (top-level await) and run: node scan.mjs. Node 18+ (global fetch).
// Run it on a server or in CI, never in a browser.
const BASE = 'https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1';
const auth = { Authorization: `Bearer ${process.env.SHYPSET_API_KEY}` };
const sleep = s => new Promise(r => setTimeout(r, s * 1000));

async function api(path, init = {}) {
  const res = await fetch(BASE + path, { ...init, headers: { ...auth, ...init.headers } });
  const body = await res.json();
  if (!res.ok) {
    const err = new Error(`${res.status} ${body.error.code}: ${body.error.message}`);
    err.code = body.error.code;
    throw err;
  }
  return { body, res };
}

// 1. Start a scan
const { body: created } = await api('/v1/scans', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ url: 'https://example.com' }),
});

// 2. Poll until it is done
let scan;
for (;;) {
  const { body, res } = await api(`/v1/scans/${created.scan_id}`);
  scan = body;
  if (scan.status === 'completed' || scan.status === 'failed') break;
  await sleep(Math.max(3, Number(res.headers.get('Retry-After')) || 3));
}
console.log(scan.status, scan.report.risk_score, scan.report.counts);

// 3. Fix prompt for the open issues
if (scan.status === 'completed') {
  const { body: fix } = await api(`/v1/scans/${scan.id}/fix-prompt?target=cursor`);
  console.log(fix.prompt);
}

# pip install requests. Run on a server or in CI, never in client code.
import os, time, requests

BASE = "https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1"
session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['SHYPSET_API_KEY']}"

def api(method, path, **kwargs):
    res = session.request(method, BASE + path, timeout=30, **kwargs)
    body = res.json()
    if not res.ok:
        raise RuntimeError(f"{res.status_code} {body['error']['code']}: {body['error']['message']}")
    return body, res

# 1. Start a scan
created, _ = api("POST", "/v1/scans", json={"url": "https://example.com"})

# 2. Poll until it is done
while True:
    scan, res = api("GET", f"/v1/scans/{created['scan_id']}")
    if scan["status"] in ("completed", "failed"):
        break
    time.sleep(max(3, int(res.headers.get("Retry-After", 3))))
print(scan["status"], scan["report"]["risk_score"], scan["report"]["counts"])

# 3. Fix prompt for the open issues
if scan["status"] == "completed":
    fix, _ = api("GET", f"/v1/scans/{scan['id']}/fix-prompt", params={"target": "cursor"})
    print(fix["prompt"])

Authorization: Bearer shp_live_<your key>

{
  "error": {
    "code": "invalid_url",
    "message": "Invalid URL format"
  }
}

claude mcp add --transport http shypset \
  https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1/mcp \
  --header "Authorization: Bearer $SHYPSET_API_KEY"

{
  "mcpServers": {
    "shypset": {
      "url": "https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SHYPSET_API_KEY}"
      }
    }
  }
}

Use the shypset MCP tools to scan https://example.com, wait for the report and fix
what it finds in this codebase, most severe first. Tell me which issues are locked on my plan.

Scan my site with the Shypset API and fix what it finds.

- Docs: https://www.shypset.com/docs/api (OpenAPI: https://www.shypset.com/openapi/v1.yaml)
- Base URL: https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1
- My API key is in the SHYPSET_API_KEY environment variable. Send it as
  "Authorization: Bearer $SHYPSET_API_KEY". Never print it, never write it to a file
  and never put it in client-side code.
- My site: https://example.com

1. POST /v1/scans with {"url": "<my site>"} and an Idempotency-Key header.
2. Poll GET /v1/scans/{scan_id} every 5 seconds until status is "completed" or "failed".
3. GET /v1/scans/{scan_id}/fix-prompt?target=claude (use target=cursor in Cursor) and follow
   that prompt: fix the issues in this codebase, most severe first. Do not invent issues
   that are not in the report.
4. If you get 403 upgrade_required, or locked_count is above 0, fix what you can see and
   tell me which issues are locked on my plan.
5. Tell me what you changed for each finding. After I deploy, scan again and report
   diff.fixed and diff.new from GET /v1/scans/{scan_id}.

# .github/workflows/shypset.yml (a step after your deploy job)
- name: Shypset scan
  shell: bash
  env:
    SHYPSET_API_KEY: ${{ secrets.SHYPSET_API_KEY }}
    SITE_URL: https://example.com
  run: |
    set -euo pipefail
    BASE=https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1
    AUTH="Authorization: Bearer $SHYPSET_API_KEY"

    # A refusal (for example 429 free_monthly) fails the step with the API's error.
    RESP=$(curl -sS --fail-with-body -X POST "$BASE/v1/scans" -H "$AUTH" \
      -H "Content-Type: application/json" \
      -H "Idempotency-Key: gh-${{ github.run_id }}-${{ github.run_attempt }}" \
      -d "{\"url\": \"$SITE_URL\"}") || { echo "::error::Scan not started: $RESP"; exit 1; }
    SCAN_ID=$(echo "$RESP" | jq -r .scan_id)
    [ -n "$SCAN_ID" ] && [ "$SCAN_ID" != null ] || { echo "::error::No scan_id: $RESP"; exit 1; }

    STATUS=queued
    SCAN='{}'
    for i in $(seq 1 120); do
      sleep 5
      SCAN=$(curl -sS --fail-with-body "$BASE/v1/scans/$SCAN_ID" -H "$AUTH") || continue
      STATUS=$(echo "$SCAN" | jq -r .status)
      case "$STATUS" in completed|failed) break ;; esac
    done

    [ "$STATUS" = completed ] || { echo "::error::Scan did not complete (status: $STATUS)"; exit 1; }
    echo "score=$(echo "$SCAN" | jq .report.risk_score)"

    # diff is null on the first scan of a site: nothing to compare, nothing new.
    NEW_CRITICAL=$(echo "$SCAN" | jq '.diff.new_by_severity.critical // 0')
    if [ "$NEW_CRITICAL" -gt 0 ]; then
      echo "::error::$NEW_CRITICAL new critical issue(s) since the previous scan"
      exit 1
    fi