How it works
Safety and privacy
A checker should never be the way something gets in. Everything slowship reads stays in quarantine, nothing it reads is started, and almost nothing ever leaves your computer.
#It never runs what it reads
- No scanned code is executed. No
require, no install scripts, no starting MCP servers. - REA runs only its static readers:
analyze-javascript-application,inspect-go-binary,inspect-rust-binary,inspect-managed-artifact,inspect-managed-native-boundaries,inspect-managed-membersandinspect-electron-fuses. Each gets fixed arguments, a timeout and a cap on output. None of them loads or starts the file it reads. - No shell anywhere. Programs are started with fixed arguments, never through a shell. Package names are checked before
npm pack, and downloaded packages are unpacked by slowship’s own reader, which refuses any path that tries to leave the quarantine folder.
#Nothing is uploaded
slowship uses the network for exactly three things, and nothing else:
| What | Where to | When |
|---|---|---|
Downloading npx MCP servers so they can be read | npm | During a watch. --offline turns it off. |
| A package your agent asks it to check | npm | Only when your agent calls check. |
| The morning ping | discord.com or api.telegram.org | Only if you connect one. A summary in slowship’s own words, never code, paths or keys. |
The model runs on your machine through Ollama. Your code never goes to it in bulk: it gets a description and a short list of facts.
#The report answers only you
- It listens on
127.0.0.1, so other computers can’t reach it. - It checks the
Hostheader, so a website can’t reach it by renaming itself (DNS rebinding), and it checks theOrigin. - It takes JSON only, and caps the size of what it accepts.
- The code shown around a finding is read only from inside that item’s own folder, and secrets are cut down before they reach the page.
#Your agent can look, never clear
The coding agent connector has two tools, check and watch, and no tool to clear anything. Answers repeat only slowship’s own words, never the scanned text, and say that names and paths are data. Clearing happens only in slowship review and slowship ui, by you.
#Key names, never values
“Who can spend your money” keeps only the names of keys that an MCP config hands a server, in its env and auth headers. Their values are never read into the report.
#What’s kept on your computer
Everything lives in ~/.slowship (or SLOWSHIP_HOME): the memory of what it read, your clears, the last watch, and, if you connected one, the morning ping’s webhook or token in notify.json, readable only by you. Delete the folder and it’s all gone.