Reference
Questions
The things people ask first, answered plainly.
#Does it scan my whole computer?
No. It reads the packages of the project folder you run it in, plus the skill folders your coding agents use and your editors’ MCP settings. Those last two belong to your computer rather than one project, so every project shows the same skills. Nothing else is touched. The verdict card lists exactly what it read.
#Do I need to keep the server running for the nightly watch?
No. The nightly watch is a scheduled task (Task Scheduler on Windows, crontab elsewhere) that runs slowship by itself, hidden. The report server is only for reading the results, and only when you open it with slowship ui. Your computer does need to be on, or wake up.
#Is it a replacement for npm audit?
No, use both. npm audit tells you about known vulnerabilities in published versions. slowship asks a different question: does this code do what its description says? That catches a package that is doing something new and quiet, before anyone has reported it.
#Does it need the internet?
Not for reading. The model runs locally, and your packages are already on disk. It downloads only npx MCP servers so it can read them (--offline turns that off), packages your agent asks it to check, and the morning ping if you connect one.
#Does it work without Ollama?
Yes. It runs on its rules alone and says so in the verdict. You lose the model’s second opinion, which mostly cuts false alarms; holds come from rules either way.
#Why a small local model and not a big cloud one?
Two reasons. Your code stays on your laptop. And the model’s job is deliberately small: compare one description with a short list of facts. It can’t decide a hold or lower one, so a bigger model wouldn’t change what matters most.
#Could a package trick it?
It can try. A package’s README can say anything to an AI, and in testing an injected README did sway the model. But the model never sees the code in bulk, never decides alone, and can’t lower a hold, which comes from code. Your coding agent can’t clear anything either. See How it decides.
#What does “worth a glance” mean?
A single thing the code does that its description doesn’t call for. A date library that also makes a network call, say. Usually there’s a good reason. Look for ten seconds, then clear it.
#Can it break my project?
It never writes into your project. It writes only to its own folder, ~/.slowship, plus the scheduled task or crontab line if you turn on the nightly watch, and the agent skill if you run slowship connect.
#Why does it say nothing about most of my packages?
Because most packages do what they say. Silence is the point: a scanner that warns about everything gets ignored. Everything it read is still listed under Everything aboard.
#What if it finds nothing?
Then nothing it can see was wrong. That’s not proof of nothing; see What it can’t see.
#Where can I try it without installing?
The live demo is the real report page, replaying one recorded watch. Nothing in it touches your computer.