Tell your terminal to ship it. A natural-language deploy & ops assistant that orchestrates DigitalOcean, Vercel, and (soon) anywhere — you pick the destination, shipmate handles the build, the host, the DNS, and the certificate. One command instead of an afternoon of dashboard clicking.
It's a Claude Code skill — say "deploy this" and it runs the whole dance — and it's voice: "Hey Siri, shipmate — deploy panogram… ship it" from CarPlay, a continuous conversation in the Claude app (via MCP), or a question asked into a pair of Even G2 glasses (glasses/) — while background agents build, test, and wait for your go. And it speaks first: it watches every live site, briefs you at 7:30, and remembers across channels. None of that adds a way to ship.
Shipping a small app still means hand-clicking across three silos that don't talk to each other:
- the host (DigitalOcean / Vercel / …),
- the DNS (records, subdomains, certs),
- the registrar — and some, like SquareSpace, have no API at all.
Every new project, you redo the same manual ritual. shipmate is the brain that does it for you — and, crucially, it knows where the gaps are. It tells you the one thing a provider won't let it automate instead of pretending it can.
shipmate separates brains from authority. Agents can read state, plan work, and build on
throwaway branches with zero credentials; nothing reaches production except through one gate.
The interesting problem was never getting an LLM to run doctl — it's an authority model
where you can hand agents your infrastructure and sleep.
- Authority is structural, not conversational. Executing requires a fresh single-use grant minted by a plan step (10-minute TTL, enforced in code). An agent that never planned cannot execute — no prompt injection, mishearing, or hallucination changes that.
- Read-only means enforced read-only — plan turns run under Claude Code's
--permission-mode plan, not under "please don't write anything." - Workers are untrusted by design. Background agents get a fresh branch, no deploy credentials, and can't touch the default branch. Their output is proposals; merge and deploy pass back through the gate.
- Thin clients, one engine. Siri/SSH, the Claude app's voice mode (via MCP), and the terminal are interchangeable mouths on the same tested core — adding a front-end adds zero new authority.
- Tests where bugs are catastrophic. The env secret-classifier and the parser that
decides plan-vs-execute are the two places a bug ships a plaintext secret or executes a
misheard command; both have suites, and so do the gate, the guard, the sign-in, the ledger,
the sentinel, the briefing, memory and the glasses (
tests/,glasses/test/). - Count what it let through. Every gate decision — allowed ones included — is one line in an append-only ledger. Facts only; whether a refusal mattered is a human note, never inferred.
- The cheapest gesture gets the least authority. The glasses and the R1 ring can watch and ask, never ship; approvals stay on the phone, where the plan is on the screen.
- Deliberation is a toggle, not a lifestyle.
counsel off(default): the single default Anthropic model answers — fast, and frankly the best.counsel on: questions fan out to a multi-model panel in parallel and a chair synthesizes, required to name the dissent. Always read-only either way. - Honest gaps over false magic. No provider API → shipmate says so and hands you the one manual step.
- Deploys the current project to DigitalOcean App Platform or Vercel (GitHub deploy-on-push), behind one set of lifecycle verbs — status, url, phase, check, rollback, roll-forward — so the gate, the checks and the ledger behave the same on both.
- Generates the right
.do/app.yamlfor your stack (Next.js, Astro SSR, …) with no secrets in the repo. - Prints the exact DNS record to map your subdomain — or, when your DNS is hosted on the provider, maps it automatically (record + TLS cert, zero clicks).
- Has a safety model: it shows the plan and the cost and waits for your explicit yes before anything bills or goes live. Voice is a lovely demo and a terrible UI for irreversible infra — so confirmation is built in, not bolted on.
- Speaks and listens: Siri/CarPlay one-shots, or a continuous Claude-app voice conversation (via MCP) — background agents build on jailed branches, push results to your phone, and wait for your go. New spend needs a tap on a notification (from your own tailnet), not a "yeah". "Roll back panogram, confirm" reverts a bad deploy with no model in the loop.
- Deliberates on demand:
counsel onconvenes a multi-model panel that must report its dissent; off (default), the single best Anthropic model answers. - Guards every push, from anyone: a pre-push hook per clone refuses the wrong remote, a protected path, or a change bigger than the project's cap (generated build output doesn't count); a preflight runs before any execute; a live check reports when the commit is actually serving. An override must name the rule it skips, and lands in the ledger.
- Signs you in properly: the Claude-app connector uses OAuth 2.1 (PKCE, two scopes, rotating refresh tokens) with a passkey or an authenticator app.
- Speaks first: a sentinel checks every live site every five minutes (down, failed deploy, expiring cert) and pushes once when a problem starts and once when it ends; a deterministic briefing arrives at 7:30 ("good morning" asks for it any time); "remember…", "remind me to…" and "where did we leave off?" work across Siri, the Claude app and the terminal — memory is notes for the model, never permissions.
- Fits on your face: a read-only glance on Even G2 glasses (fleet, briefing, plan, gate), and press-and-hold — on a temple or the R1 ring — to ask; speech is transcribed on your own machine with whisper.cpp and never kept.
git clone git@github.com:dapinitial/shipmate.git
cd shipmate && ./install.sh # links the skills into ~/.claude/skillsThen in Claude Code, from any project: /deploy.
Requires doctl (DigitalOcean) and/or the
vercel CLI, gh, and a Claude Code
session. Optional: Tailscale (voice + the Claude app), ntfy (pushes), whisper.cpp (talking on the
glasses). bash skills/deploy/bin/doctor.sh reports what's set up.
| Provider | Status | Notes |
|---|---|---|
| DigitalOcean App Platform | ✅ live | ~$5/mo flat · commercial-OK · you size scaling |
| Vercel | ✅ live | free Hobby (non-commercial) / $20 Pro · best Next.js DX · auto-scales |
| Cloudflare / Render / Fly.io | 💭 wishlist |
/deploy detects the target (.do/app.yaml → DO, .vercel/ → Vercel) or asks you inline.
The per-provider details and the full DNS story live in docs/PROVIDERS.md.
- Provider-agnostic
/deploy— pick DO or Vercel inline ("choose your destiny"). - Voice v1 — conversational Apple Shortcut → headless-Claude bridge ("Hey Siri, shipmate, deploy panogram" … "do it"): persistent sessions, background agent jobs, push-back to CarPlay. Plan mode is code-enforced. See voice/.
- DNS automation — host the domain on the provider and subdomains become fully hands-off.
- Alexa Skill front-end (same bridge).
- MCP server — the engine as agent-callable tools (plan/execute/status/jobs) with the plan→confirm gate enforced in code; drivable from the Claude iOS app's voice mode as a custom connector, with a tailnet-only device onboarding page. See mcp/.
- OAuth 2.1 sign-in, the decision ledger, Vercel at parity behind the same gate.
- It speaks first — the sentinel, the 7:30 briefing, memory across channels, and questions through Even G2 glasses + the R1 ring (simulator-verified; hardware next).
- Always-on host, one-tap rollback from the sentinel — queued in the roadmap.
- MCP ecosystem — providers ship their own agent-callable skills (Cloudflare, Stripe, GitHub already do); shipmate becomes the orchestration + safety layer that composes them.
Full thinking in docs/ROADMAP.md.
Early, and dogfooded on the author's own fleet since July (eight live sites today). The honest gaps: the host is still a laptop, the glasses and ring are verified in the simulator rather than on the hardware, and Siri dictation remains the weakest link — which is why nothing executes on a single sentence. The full story, numbers included: unakin.com/case-studies/shipmate.
MIT © 2026 David Puerto