The Ship's list

An extension is a skill, a plugin or an MCP server. The Extensions page lists each one with its kind, where it came from, what it brings ("text only" or "brings code", and why), and its decision: allowed, blocked or waiting. What waits is listed first. Each row has Allow, Block and Remove.

Skills a crew member writes for itself, in its own cabin, are its own: they need no decision, and no other crew member sees them.

Adding one

Under "Add an extension":

From Anthropic's marketplace

A skill or a plugin by its name in claude-plugins-official. The Helm fetches it from GitHub itself and reads every file to say what it brings. The entry waits for your decision.

An MCP server, by its command

A name, the program and its arguments. Claude Code starts it in the container of each crew member that has it. The command is shown and written where the container can read it, so it must hold no secret.

An MCP server outside the Ship

A name and its https:// address. A crew member reaches it through the Helm, which adds its sign-in, a secret of the safe, so no key is in a container (see MCP servers that need a sign-in).

From a GitHub address

For what is in no marketplace: the repository, a folder in it, the whole 40-digit commit and a name. Always yours to decide. Once allowed, the Helm copies it into the Ship's repository, so the Ship does not depend on that address again.

Write a skill

A name, a one-line description and the body. Allowed at once, as yours, and committed to the Ship's marketplace.

• The Helm fetches from https://github.com/… only, at one commit, and keeps that copy: what you read when you added it is what runs. Nothing updates by itself.
• A copy may hold at most 20 MiB, 2 000 files and 1 MiB a file. A link, a submodule or a path out of the folder refuses the whole fetch.
• The Helm runs nothing of what it fetched. A plugin's own MCP server is not started; add it as a server if you want it.
• Brings code means a hook, a script or program, an MCP server, a setting Claude Code acts on, a shell line in a skill or command, or anything the Helm could not read with certainty. The check is careful, not complete: read what you allow.

When a crew member asks

A crew member that needs an extension asks with request_extension and says why: from a marketplace by name, from GitHub by address and commit, or an MCP server. It is answered at once when the extension is allowed, blocked or waits already. Otherwise the Helm fetches it, puts it on the list as waiting and decides who answers. A crew member makes at most 5 requests an hour and has at most 5 waiting at once.

The First Mate decides

A skill of text only, and a plugin from Anthropic's marketplace that brings no code, when the Helm read it with certainty. It allows or blocks with review_extension, noted in #ships-log, or sends the request on to you with a write-up.

You decide

Everything else: every MCP server, anything that brings code, everything from a GitHub address or proposed for the Ship's marketplace as a plugin, and every request of the First Mate's own. Also any request the First Mate has not answered within an hour, and all of them while there is no First Mate.

Your decisions come as an approval, a card in #bridge and an entry on the Approvals page, with Approve and Refuse and block. You can also decide on the Extensions page itself. When a request closes, the crew member is told in the thread where it asked.

A block outlives its entry. What you block cannot be asked for, or allowed by the First Mate, until you lift the block: allow the entry, or press Lift the block under "Blocked, not on the list".

Each crew member's set

Allowed means "may be used". A crew member has an extension only when it is in its own set: a crew member adds an allowed one to its set with use_extension, takes one out with drop_extension, and you change any set on the Extensions page. A change counts from the crew member's next turn. Blocking an extension takes it out of every set.

Before each turn the Helm writes the crew member's settings for Claude Code and a folder holding exactly its set, which the container sees read-only. Claude Code knows that folder as its only marketplace. A plugin that brings code runs that code inside the crew member's container: the container, the policy hook and the egress gateway are what bound it.

The Ship's marketplace

The folder marketplace/ of the Ship's repository is kept by the Helm alone. Each allowed skill or plugin that was proposed by a crew member, written by you or copied from a GitHub address has a folder there, and marketplace/README.md lists them. It is pushed to GitHub with the rest of the repository.

A crew member shares a skill or a plugin it made with propose_extension: a folder of its own cabin, a name and a reason. The Helm copies the folder, runs nothing of it, scans it for secrets and decides who answers: the First Mate for a skill of text only, you for the rest. The version is the SHA-256 of the copy, and what was reviewed is what is committed, byte for byte.

Software

Software is a program package a crew member is given for its cabin's work: a compiler, a build tool, a browser for tests. It is asked for and decided like an extension, and it is not one: extensions are what Claude Code loads, software is what the crew member's programs run.

Off in this version. A Ship needs a builder for the packages, and v0.3.0 has none: there are no software tools, and the Bridge says "Software is not available on this Ship." The next release adds the builder.

Once a Ship has one, it works like this:

• A crew member asks with request_software for a package of the Ship's package set, such as go_1_23 or jdk21, and says why. list_software shows its packages and requests, drop_software takes one off its list.
• The First Mate alone decides a request only when the package's licence is free, it comes from the binary cache, its size is at most the Ship's limit and you have not blocked it. Everything else, and every request of the First Mate's own, is yours. The limit is "Largest software the First Mate may allow alone" on the Settings page (default 2048 MiB; 0 sends every package to you).
• On the Crew page, each crew member's Software panel lists its packages, with Add software and Drop, and Blocked software lifts a block.
• At most 5 requests an hour and 5 waiting at once. A package is there from the crew member's next turn after it is built.

What a crew member installs for itself

This works now. Each crew member has a folder /software that it can write and that stays when its container goes (data/helm/software/<name> on the host, outside the Ship's repository). The usual version and package managers install there: mise, sdkman, npm -g, go install, cargo, and pip for a Python installed with mise.

• The image's own programs come first on the path, so nothing a crew member installs takes their place. To use a newer node or python it calls mise's or the program's own path.
• A container's /tmp and home folder cannot run programs: what a crew member builds and runs lives in /cabin or /software.
• What it downloads goes through the egress gateway, as everything else does.
• The folder goes when the crew member signs off.