SIGSHIPDocs
Get started in one command.
Everything you need to run SIGSHIP, read what it says and fix what it finds. If you have never used a terminal, start with Quick start, and keep the plain-English glossary open for any word you don't know.
On this page
Quick start
You need Node.js 22 or newer. Open a terminal in your project folder and run:
npx sigshipThat's it. No signup, no install, no config. SIGSHIP reads your project, prints what it found, and ends with GO or NO-GO.
Never used a terminal? On a Mac, open the Terminal app. On Windows, open PowerShell. Type cd, a space, drag your project folder into the window, press Enter, then run the command above. Built your app in Lovable, Bolt or Replit? Export it to GitHub first and download it, or ask your AI tool to run SIGSHIP for you.
Reading the report
Each problem has a severity, a plain title, where it is (file:line), and what happens in production if you ship it.
| Severity | What it means |
|---|---|
| SEV-1 | Blocks launch. Exposes your data or money, like a leaked key or an open database table. |
| SEV-2 | Blocks launch. Makes abuse easy, like an AI route with no spending limit. |
| SEV-3 | Worth fixing. Reported, but blocks only with --strict. |
The last line is the verdict. GO means these checks found nothing that blocks launch. It does not prove your app is safe.
Fixing problems
You don't have to fix things by hand. Print every fix as one prompt and paste it into your AI tool:
npx sigship --promptYour AI tool makes the changes. Run npx sigship again, and repeat until it says GO. Each check also has its own page explaining the fix, linked from the full list.
Commands and options Reference
| Command | What it does |
|---|---|
npx sigship [folder] | Check a project and print the report. |
npx sigship ui [folder] | Open the browser dashboard for the project. |
npx sigship init [folder] | Add the pull request check and the agent rule. |
npx sigship mcp | Start the MCP server for coding agents. |
| Option | What it does |
|---|---|
--prompt | Print every fix as one prompt for your AI tool. |
--json | Print the result as JSON. |
--markdown | Print the result as Markdown, for pull request comments. |
--strict | Also block on SEV-3. |
--report | Write sigship-report.html for a client. Needs a licence key. |
--no-open | With ui, print the dashboard link without opening a browser. |
--version, --help | Print the version or the help. |
Exit codes Reference
| Code | Meaning |
|---|---|
0 | GO. No SEV-1 or SEV-2 findings. |
1 | NO-GO. Something blocks launch. |
2 | SIGSHIP could not run, for example the folder does not exist. |
Scripts and CI can rely on these, which is what makes SIGSHIP a real test for done.
Pull request check
npx sigship initThis adds .github/workflows/sigship.yml, a GitHub check that fails when a pull request brings back a SEV-1 or SEV-2 problem, and a definition of done in AGENTS.md. It never overwrites a file that already exists.
AI coding agents
Connect SIGSHIP to Claude Code, Cursor or any MCP app so your agent checks its own work. Setup for each tool is on the AI agents page.
Browser dashboard
npx sigship uiOpens a private dashboard with the verdict, every finding, a button to copy the fix prompt and a re-run button. It runs on your computer only: it listens on 127.0.0.1, answers only the private link it prints, and shows findings, never your files. Press Ctrl+C to stop it.
Licence keys
Paid plans are on the waitlist. If you already have a licence key, set it to add the Pro pack of extra checks:
SIGSHIP_KEY=your-key npx sigshipFor pull request comments and a nightly check, run npx sigship init --pro and add the key as the repository secret SIGSHIP_KEY. If the licence server can't be reached, SIGSHIP uses its last download of the Pro pack or the free checks. A network problem never fails a scan.
Privacy
- The free tool, the dashboard and the MCP server run entirely on your machine, with no network calls and no telemetry.
- SIGSHIP never prints a secret value, in any output.
- With a licence key, and only then, it sends the key and a one-way repo fingerprint. Never code, file names or findings.
Full details are in the privacy policy.
Limits
- SIGSHIP uses pattern checks. It can miss real problems and flag safe code.
- It reads your repo, so it can't see settings changed only in a dashboard, such as Supabase policies made in the web console.
- A GO is not a security audit. For a person to read your code, see the pilot review.
Troubleshooting
"npx: command not found" or a Node.js error
Install Node.js 22 or newer from nodejs.org, open a new terminal and try again. Check your version with node --version.
It flagged something that is safe
Pattern checks can be wrong. Please report a false positive with the smallest code that shows it, without any real secrets.
It missed a real problem
Tell us with the same form, and suggest a new check in Discussions.
Getting an old version
Run npx sigship@latest to make sure you have the newest checks. This is version 0.3.1.
Still stuck? Ask in the community or email support@sigship.dev.
Check your app before your users do.
Free, open source, and nothing leaves your machine.
$ npx sigship