Getting started

Your first watch

Go to the project you’re about to ship and type one word. slowship reads everything aboard, then leaves you a verdict and a short list of what to look at.

#Run it

Open a terminal in your project
The folder with your package-lock.json. That’s where slowship finds your packages.
```
cd ~/code/your-app
```
Start the watch
```
slowship
```
A ship crosses a row of containers, one for each thing aboard. Each container turns the colour of what was found, and the step it’s on lights up: find, fingerprint, read, model, verdict.
Read the verdict card
When it’s done, you get one card with the verdict, the whole manifest as coloured containers, and what it read:

slowship

  
                                                                                              
        Held in port.                                                                 
            ∿∿∿∿∿∿∿∿                                                                 
       6 things do more than they say. Look before you ship, then glance at 10 m…    
                                                                                              
      
   189 aboard  ·  6 held  ·  10 to glance  ·  33 judged by gemma4  ·  3 min 27 s              
                                                                                              
   What it read   read, never run; nothing else on this computer is touched                   
   ▸ Packages      175  from /home/you/code/my-app, its package-lock.json                     
   ▸ Agent skills  2  from the folders your AI agents load skills from, on this computer      
   ▸ MCP servers   0  from your editors' settings · 1 unreadable: a-remote-server (remote)    
   ▸ Your build    /home/you/code/my-app/dist                                                 
                                                                                              
    ↵  review here      o  morning report in the browser      q  done

Then press one key:

Key	What it does
`↵`	Review everything right there, full screen in the terminal. See The terminal review.
`o`	Open the morning report in your browser. See The morning report.
`q`	Done. The results wait for you in `slowship review` and `slowship ui`.

#What it read

The card says exactly where everything came from. This answers the most common first question: did it scan my whole computer? No. It reads:

Packages from the project folder you ran it in, using its package-lock.json.
Agent skills from the folders your coding agents load skills from. These belong to your computer, not to one project, so every project shows the same skills.
MCP servers from your editors’ MCP settings.
Your build, only if you point it at one with --app.

Nothing else on your computer is touched. If you run it in a folder with no package-lock.json, the card says so plainly, and it still reads your skills and MCP servers.

#How long it takes

The first watch is the slow one, because it reads everything and asks the model about anything worth a second opinion. On the project we measured (275 things, a laptop with a 6 GB GPU), 50 went to the model, for 4 minutes 23 seconds of model time.

After that it remembers. Anything whose bytes haven’t changed is skipped, so a re-run with nothing changed took about 4 seconds.

In a hurry? slowship --no-model runs on rules alone and finishes fast. The verdict says it was rules only.

#Check your own build too

Point --app at the folder you’re about to ship:

slowship --app dist/

It looks for secrets that slipped in (redacted everywhere it shows them), shipped .env files and source maps, risky Electron settings like nodeIntegration, DevTools left on, and, with REA, a map of every IPC handler your pages can reach.

#Next

Look through what it found in the morning report, clear what you’ve checked (Clearing things), then let it keep watch every night.

Suggest a change to this page