Start with /seatbelt

Requires Node 22+. One command wires the Seatbelt MCP server and /seatbelt skill into Cursor or Claude Code.

npx @withseatbelt/install

Reload MCP in Cursor or Claude Code and confirm seatbelt shows as connected. Then run /seatbelt in the app you're shipping. Scans run through hosted Seatbelt. Try a Ship Read works the same way without MCP.

Scan a real checkout, never a Repl URL. A live Repl link is not a scan source. Sync or export the Repl to a private GitHub repo, clone it locally, then run /seatbelt on that folder.

Free-tier Repls are public by default and bots scrape them for keys within minutes. A .env file sitting in the project tree is plain text in the repo. Replit's Secrets pane is a separate store, so the file is not protected by it. Any key that ever lived in a public Repl or its git history is burned: rotate it with the provider. Deleting the line or making the Repl private later is not enough.

A browser URL scan is an outside view of what you already deployed. It is real signal, but it cannot read your source tree or close every hard gate from the URL alone.

If the report still shows open hard gates, fix in your builder (Lovable, Replit, Bolt, v0, or wherever you deploy), then rescan the same URL at /app before you graduate to a git clone. The report footer offers a rescan when your deploy URL is on the report. Repo scan comes after export or GitHub sync when you need a full six-surface read or a push gate.

Install (step 1, npx @withseatbelt/install) puts the MCP server and skill on your machine. Init (step 2) latches the app you're shipping: run /seatbelt init inside that project (where your code lives, not the monorepo). It creates .seatbelt/config.json and state.json so /seatbelt again knows what changed. Say yes when the agent offers the enforcement layer: it wires agent deny hooks for Cursor, Claude Code, Codex, Copilot, and Gemini, plus a pre-push gate as the backstop. If your first check was a live URL with open gates, fix in your builder and rescan that URL at /app before you latch a clone.

Agents learn to route around git hooks. A pre-push gate alone is the soft layer: someone can still try git push --no-verify, override core.hooksPath, or commit through GitHub's API and skip local hooks entirely.

When you accept the enforcement layer at /seatbelt init, Seatbelt installs block-no-verify first on agent shell hooks. That deny stack blocks those bypass commands before they run: --no-verify or -n on commit, merge, rebase, cherry-pick, or push; git -c core.hooksPath=… overrides; and GitHub MCP tools that write commits without touching your machine. Then the Seatbelt gate runs on push. The deny hooks are what hold in unattended loops. Pre-push is the backstop for terminal pushes and humans who never hit the agent harness.

CI can run the same gate as a third backstop when code lands outside your laptop. Fully local, no network.

Type /seatbelt and you get a plain-English verdict, a report link, and a next move. Run /seatbelt fix to apply fixes, then /seatbelt again until you're cleared. When git is your deploy, saying commit this safely or push my changes runs the same check first. Flagged pushes land on a PR instead of main. No MCP? Try a Ship Read in the browser. Same Fix-in-Cursor button and report link. URL scan with open gates? Fix in your builder, then rescan the same URL before you export to git.

Delivering an AI-built app to a client, or hiring a vibe code cleanup specialist? Run a Ship Read before the invoice or the handoff meeting. Marketplace cleanup projects often end with a handoff document explaining what changed and why, or a remediation plan a developer can execute. A shareable Ship Read report is the independent proof layer that goes with it: six surfaces in plain English, path and line evidence, and a link your client can open without reading code.

Comprehensive cleanup on platforms like Upwork averages around $7,200 for a full project (Jul 2026, aggregated platform data). A free 60-second triage at /app or via /seatbelt comes first: know which ship-killers are real before you pay for scoped fixes like "fix my Supabase RLS" or "move API keys to env vars."

Honest scope: this is not a security audit and not a substitute for a specialist's remediation plan. It is the safety slice at delivery: proof you checked before handoff, or before you forward the repo to cleanup help.

The same check runs headlessly as seatbelt-gate. Exit 0 means cleared; exit 2 means hard gates open. Accept the enforcement layer during /seatbelt init and you get block-no-verify plus pre-push wired in the right order. The manual recipes below are for teams wiring hooks by hand (pre-push only; add your own block-no-verify deny if agents use --no-verify).

# .git/hooks/pre-push
#!/bin/sh
node /path/to/seatbelt-monorepo/packages/engine/dist/cli.js . || {
  echo "Blocked by seatbelt gate. Fix in your agent or open a PR."
  exit 1
}

Same gate for Claude Code. Block git push when hard gates are open (edit the path to your clone):

# .claude/settings.json (project or ~/.claude)
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "case \\"$TOOL_INPUT\\" in *git\\\\ push*|*'git push'*) node /path/to/seatbelt-monorepo/packages/engine/dist/cli.js . || exit 2;; esac"
          }
        ]
      }
    ]
  }
}

When skill or MCP updates ship, agents still load the copy on your machine (~/.cursor/skills/seatbelt), not the repo. Rerun npx @withseatbelt/install, then reload MCP. To check for drift without reinstalling: npx @withseatbelt/install --check-skill (exit 1 means rerun install).