# Slipway

**Build and ship real apps directly from Claude or ChatGPT — free and open source, using the AI subscription you already pay for.**

Slipway is an MCP ([Model Context Protocol](https://modelcontextprotocol.io)) server that gives your AI assistant the tools to actually *ship* software, not just write it: scaffold an app, edit its files, run a live preview you can open in your browser, store data in a built-in database, send email, send push notifications, and deploy to a real public URL.

There is no meter and no credits. The model you already pay for (Claude Pro/Max, ChatGPT Plus, or any MCP-capable client) does the thinking; Slipway just executes. Everything runs on your machine, and deploys go to *your* accounts on free hosting tiers.

> A slipway is the ramp a ship is built on and launched from.

## What your assistant can do once connected

| Capability | Tools | Replaces |
|---|---|---|
| Scaffold apps (static, React+Vite, API, fullstack) | `create_app`, `list_apps`, `delete_app` | boilerplate setup |
| Edit code | `write_file`, `read_file`, `list_files`, `delete_file` | copy-pasting from chat |
| Live preview with logs | `start_preview`, `preview_logs`, `stop_preview` | local dev setup |
| Database (per-app SQLite, zero config) | `query_database` | Supabase setup |
| Secrets / config | `set_env`, `list_env` | .env wrangling |
| Deploy to a public URL | `deploy` (local, Vercel, Netlify, Cloudflare Pages) | git + CI + hosting setup |
| Transactional email (any SMTP) | `send_email` | Resend setup |
| Web push notifications (VAPID) | `push_generate_keys`, `push_send` | OneSignal setup |
| npm packages | `install_dependencies` | terminal juggling |

## Quick start

Requires **Node.js ≥ 22.5** (the built-in SQLite needs it).

```bash
git clone https://github.com/SandeepbhuiyaRTNW/slipway.git
cd slipway
npm install
npm run build
npm run smoke   # optional: end-to-end self-test
```

### Claude Code

```bash
claude mcp add slipway -- node /absolute/path/to/slipway/dist/index.js
```

### Claude Desktop

Add to `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "slipway": {
      "command": "node",
      "args": ["/absolute/path/to/slipway/dist/index.js"]
    }
  }
}
```

### ChatGPT, claude.ai on the web, or your phone (remote HTTP mode)

```bash
SLIPWAY_TOKEN=some-long-secret node dist/index.js --http 8788
# then expose it, e.g.:
cloudflared tunnel --url http://localhost:8788
```

Point the client's MCP connector at `https://<your-tunnel>/mcp` with the header `Authorization: Bearer some-long-secret`. ChatGPT accepts remote MCP connectors in developer mode; claude.ai accepts them as custom connectors.

Then just talk:

> "Build me a habit tracker with streaks, keep the data in the database, and give me a link to try it."

The assistant scaffolds the app, writes the code, starts a preview, and hands you the URL. Ask for changes; refresh the page.

## Where things live

Apps are stored in `~/.slipway/apps/<name>` (override with `SLIPWAY_HOME`). Each app is a plain directory — it's your code, take it anywhere. Per-app extras:

- `data.sqlite` — the app's database
- `.env` — secrets, injected into the app's process on preview/deploy (values are never echoed back through the AI)
- `.slipway-push.json` — Web Push VAPID keys (private key never leaves your machine)

## Deploying

- `deploy(app, "local")` — builds and serves the app persistently on your machine.
- `deploy(app, "vercel" | "netlify" | "cloudflare")` — publishes to a real public URL using that provider's CLI (`vercel`, `netlify`, `wrangler`), which you log into once. Free tiers work; custom domains are configured in the provider's dashboard and are free to attach.

## Email and push

- **Email**: set `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS`, `MAIL_FROM` via `set_env`. Any SMTP provider works — a Gmail app password, Fastmail, Mailgun, Brevo, or your own server.
- **Push**: `push_generate_keys` gives you a VAPID public key for `pushManager.subscribe()` in your app's frontend; `push_send` delivers notifications to a subscription. No third-party push service involved.

## Security notes

Slipway executes code (npm scripts, dev servers) on the machine it runs on — that is its job. Accordingly:

- All file operations are confined to the workspace (`~/.slipway/apps`); path traversal is rejected.
- HTTP mode without `SLIPWAY_TOKEN` prints a loud warning: anyone who can reach the port can build and run code. Always set a token before tunneling.
- Env values are write-only through the AI: `list_env` returns key names, never values.
- `delete_app` requires an explicit `confirm: true`.

Treat a tunneled Slipway like SSH access to your machine, because that is roughly what it is.

## Roadmap

- One-command public tunnels for previews (`share_preview`)
- Postgres option alongside SQLite
- Auth scaffolding (sessions, magic links) in the fullstack template
- A hosted multi-tenant mode so one Slipway can serve a team
- More templates (Next.js, Expo)

Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).

## License

[MIT](LICENSE). Slipway is an independent open-source project, not affiliated with Anthropic, OpenAI, or Floot.