How it works

What it reads

Four kinds of cargo, found in one pass with no setup. Everything is read where it already sits, except MCP servers that live on npm, which are downloaded into quarantine first.

#Packages

slowship reads your package-lock.json, so it reads exactly what you’ll ship, at the versions you’ll ship, including every dependency of a dependency. The code itself is read from node_modules.

No lockfile? It falls back to reading node_modules directly and says so, because then versions aren’t pinned.

#Agent skills

Skills are folders of instructions and scripts that coding agents load. slowship reads the skill folders that coding agents use, in your home folder and in the project, plugin folders included. For example ~/.agents/skills and ~/.codex/skills.

A skill has two parts, and both are read:

Its scripts: JavaScript is parsed properly; Python and shell are read line by line.
Its instructions in SKILL.md: checked for four narrow things. Telling the agent to hide something from you, to ignore its other instructions, to download and run a script, or to send your data somewhere.

#MCP servers

MCP servers are the tools your agents connect to. slowship finds them in the MCP settings of popular coding agents and editors (Cursor, VS Code, Codex and others).

An npx server is downloaded into a quarantine folder with every script off, and read there. --offline turns that download off.
A compiled server is read as far as its build record, with REA.
A remote server or one in a container can’t be read, and the report says so.

None are ever started.

#Compiled files

With REA installed, compiled files stop being blind spots. That covers a compiled MCP server, or a .node, .exe or .dll inside a package.

Kind	What slowship learns
Go and Rust	What they were built from: modules or crates and their versions, the toolchain, dependencies swapped in at build time, builds from uncommitted changes.
.NET	Its references and the native functions it declares, like starting programs, raw network, keystroke hooks, writing into other programs, or decrypting what Windows protects for you. Then, method by method, the framework calls each method makes and the strings it loads.
C and C++	They leave no build record, so they are named, not read.

So a .NET method that decodes base64 and loads it as code, or names the browser’s password file and then posts, is held just like the same JavaScript function.

#Your build

Only when you ask, with --app or in Settings. slowship looks for:

Secrets that slipped in, redacted in every output.
Shipped .env files and source maps.
Electron settings like nodeIntegration or contextIsolation: false, and DevTools left on.
The IPC map, with REA: every handler a page can reach (window.api.x), whether it checks who sent the message, and what it does.
Electron fuses on a packaged app: whether it still lets anyone run it as plain Node.js, inject code through NODE_OPTIONS, attach a debugger with --inspect, or change its code after signing.

#What it leaves out

Test and example files inside packages are left out on purpose: they ship, but they don’t run when you use the package. Files over 2 MB, usually generated bundles, are skipped and named. Both appear in Blind spots.

Suggest a change to this page