Docs

Everything in one page.

From your first check to a fully automated pipeline. Never used a terminal? Start with the 4-step guide.

Install

You need Node.js 22 or newer. No install step — run it with npx in your project folder.

npx sigship

Commands

The main ones you'll use.

npx sigship            # run all 17 checks
npx sigship --prompt   # one fix brief for your AI
npx sigship init       # add the GitHub check + AGENTS.md rule
npx sigship mcp        # start the MCP server
npx sigship ui         # private local dashboard

Flags

Shape the output for humans, CI or agents.

--json       machine-readable output
--markdown   report for a pull request comment
--prompt     paste-ready fix brief
--strict     also fail on Nice-to-fix (SEV-3)
--report     write sigship-report.html (licence key)
--no-open    with ui: print the link, no browser

Exit codes

Your CI and agents can trust these.

0  GO      nothing blocks launch
1  NO-GO   at least one Fix now / Fix soon
2  ERROR   the check could not run

GitHub check

npx sigship init adds this workflow. It checks every pull request and blocks merges that bring a serious problem back. It never overwrites a file you already have.

# .github/workflows/sigship.yml
name: sigship
on: [pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npx --yes sigship@latest

AI agents

The MCP server gives your coding agent three tools, sigship_check, sigship_explain and sigship_badge, and the launch-check prompt. Setup for each tool is on the AI agents page.

claude mcp add sigship -- npx -y sigship mcp

Licence key

Paid plans are on the waitlist. Set it to add the Pro pack of extra checks and the client report. A network problem never fails a scan.

SIGSHIP_KEY=your-key npx sigship

Privacy and limits

The free tool, the dashboard and the MCP server run on your machine with no network calls and never print a secret value. SIGSHIP reads your code, so it can’t see settings changed only in a dashboard, and a GO is not a security audit.

npx sigship ui   # dashboard on 127.0.0.1 only