The morning report
Your project drawn as a ship in harbour, a short queue of what to look at, and the real code around every finding. Served on 127.0.0.1 only.
A local, overnight check of what you ship
Ship safe,slowly.
slowship reads every package, agent skill and MCP server your project brings aboard, on your own laptop, and asks each one a single question: does this do what it says it does?
Tonight, while you sleep, it reads everything aboard.Packages from your lockfile. Skills and MCP servers from your coding agents. Your own build, if you ask.
Every line of it. It never runs a single one.It reads the code the way you would, only all of it, and leaves each finding with its file and line.
Two things are worth a glance.You look over coffee, and clear them in a click. They stay cleared until their code changes.
Cleared to sail.
The one question
Everything you install makes a promise. A date picker promises to pick dates. A skill promises to tidy your notes. A server promises to read your calendar. slowship reads the code and checks the promise is kept.
Does this do what it says it does?
See it work
What it says. What it does.
A made-up package rolls into customs. Its paperwork is honest about one thing. Move the x-ray over the container and see what else it carries.
An illustration. slowship’s real test fixtures are inert and point at .invalid addresses, like this one.
What it reads
Four kinds of cargo. One question.
Your coding agent now installs packages, skills and MCP servers for you, usually without reading them. slowship reads all of it, in one pass, with no setup. Pick a container to open it.
How it works
A night’s watch, in five steps.
Cheap first, careful last, so a whole night’s work stays small and the morning stays quiet.
- 1
Find everything aboard.
One pass over your lockfile, the folders your coding agents load skills from, and your editors’ MCP settings. Nothing to set up.
- 2
Remember what it read.
Every item is fingerprinted by its bytes. Anything unchanged since last night is skipped, and anything you cleared stays cleared until its code changes.
- 3
Read the code, never run it.
A pass over the syntax tree finds what the code can actually do: network calls, running programs, writing files, reading secrets, building code at runtime. Each fact keeps its file and line.
- 4
Compare it with what it says.
A small open model on your own laptop, gemma4 through Ollama, checks the description against the facts, one by one, and must cite the facts it means. Nothing is uploaded.
- 5
Leave one verdict.
Severity is decided in code. Only a combination found in code can hold the ship, and the model can never lower a hold, so a README that sweet-talks scanners gets nowhere.
The morning after
One verdict. Three words.
No dashboards to read, no wall of warnings. You wake up to one of three answers, with the exact line of code behind every finding.
Everywhere you work
In your browser, your terminal, your agent.
Every card opens the real thing, made by slowship’s own code. Tap one and try it.
Your terminal
It draws instead of printing: the watch live, a verdict card, then a full-screen review.
Held in port. ∿∿∿∿∿∿∿∿ 6 things do more than they say. Loo… 189 aboard · 6 held · 10 to glance · 33 judg What it read read, never run; nothing else on th ▸ Packages 175 from /home/you/code/my-app, i ▸ Agent skills 2 from the folders your AI agents ▸ MCP servers 0 from your editors' settings · 1 ▸ Your build /home/you/code/my-app/dist ↵ review here o morning report in the browser
A morning ping
The verdict in your Discord channel or Telegram chat. Off until you connect one.
7:02 AM
slowshipReady after a glance.your-app · 2 things worth a look before you ship.
Your coding agent
It asks slowship before anything comes aboard. It can look, never clear.
Add tidy-dates to the projectslowship · check tidy-datesHeld: it reads your npm login file and sends it out. I won’t install it.
Every night, by itself
One command sets a quiet nightly watch. Your laptop just needs to be on.
Who can spend your money
A ledger of every key to an outside account your agent’s tools read or are handed. Only names, never values. On the laptop we measured: 18 keys to 13 accounts, held by 9 tools. One media skill alone read keys for six of them.
GeminiGoogleGoogle CloudHeyGenHyperframesElevenLabsand 7 more
Clear it once
What you clear stays cleared, keyed to its exact bytes. Change one byte of its code and it asks again.
cleared · changed · asks again
Safety
Read, never run.
A checker that starts the servers it checks has already lost. slowship keeps everything it reads in quarantine, sealed, and treats every word a package wrote as data.
Nothing it reads is started
No require, no install scripts, no MCP servers launched. Programs it uses get fixed arguments and no shell.
The model lives on your laptop
gemma4 runs through Ollama, on your machine. Without it, slowship runs on its rules alone and says so.
Nothing is uploaded
The report answers only this machine. The one thing that ever leaves is the morning ping you connect, with the verdict and nothing else.
Clearing stays with you
Your agent gets tools to check and watch, and none to clear. A package can’t talk its way past you.
Measured, not promised
Numbers from one real night.
One project folder: the 174 npm dependencies of REA’s own package, 77 installed skills, 1 MCP server and a deliberately risky test build, on a laptop with a 6 GB GPU.
99.95%
of the code that runs, actually read: 3,827 of 3,829 files.
4 s
about, for a re-run with nothing changed. Unchanged bytes are never read twice.
202 of 275
things found were settled by rules alone. 50 went to the local model.
0
holds among the real packages and skills. The one hold was the risky test build.
Against known malware
On 200 skills from MalSkillBench, 100 malicious and 100 benign: a hold is usually right, 12 of 14. It catches about one malicious skill in eight with rules alone, and more as “worth a glance”. Most misses are attacks written as plain English, which slowship doesn’t read as code yet.
What it can’t see
- Code fetched or built while a program runs
- What compiled code does, past its build record
- TypeScript, and code inside markdown blocks
- Prompt injection beyond four narrow patterns
No findings is not proof of nothing. The report says so too.
The model isn’t repeatable bit for bit: between two runs it moved 4 package verdicts by one step. Rules-only verdicts didn’t change at all. Every number here, and how to rerun it, is in Measured results.
Get started
Three commands. Then sleep.
You need Node.js 22.19 or newer. Ollama is optional but recommended.
- Install it
git clone https://github.com/nirajkhetre/slowship && cd slowship && npm install && npm link - Give it a model (optional)
ollama pull gemma4:e2b - Keep watch in the project you’re about to ship
slowship
See a real watch, right now.
The demo is the real report page, replaying one recorded night. Nothing in it touches your computer.