How shipsecai/studio works
ShipSec Studio is a security-workflow authoring, execution, and monitoring platform. A user designs a workflow in the visual builder, submits it through the backend management plane, and the workflow is compiled and run durably by Temporal-backed workers using security components and integrations. The backend also exposes workflow APIs and product capabilities such as scheduling, human approvals, MCP discovery, templates, and artifact storage. Telemetry flows from workers through Kafka ingestion to monitoring stores. Some subsystem links are documented rather than visible in sampled implementation excerpts.
Main entry points: workflows.service.ts Workflow service · temporal.service.ts Temporal orchestration · schema/index.ts PostgreSQL state · components/index.ts Workflow worker
Components 23
Workflow authoring
- Visual builder
frontend/src/features/workflow-builder/WorkflowBuilder.tsx - Frontend API
frontend/src/services/api.ts
Management plane
- Workflow API
backend/src/workflows/workflows.controller.ts - Workflow service
backend/src/workflows/workflows.service.ts - DSL compiler
backend/src/dsl/compiler.ts - Authentication
backend/src/auth/auth.service.ts - Scheduling
backend/src/schedules/schedules.service.ts - Human approvals
backend/src/human-inputs/human-inputs.service.ts - Workflow templates
backend/src/templates/templates.service.ts - MCP discovery
backend/src/mcp/mcp-discovery-orchestrator.service.ts
Execution plane
- Temporal orchestration
backend/src/temporal/temporal.service.ts - Workflow worker
worker/src/components/index.ts - Security components
worker/src/components/core - External tooling
worker/src/components
Monitoring
- Telemetry adapters
worker/src/adapters - Event ingestion
backend/src/events/event-ingest.service.ts - Log ingestion
backend/src/logging/log-ingest.service.ts - Kafka
- Loki
State and integrations
- PostgreSQL state
backend/src/database/schema/index.ts - Artifact storage
backend/src/storage/storage.service.ts - MinIO
Other components
- Security team
Connections 22
- Security team → Visual builder: designs
- Visual builder → Frontend API: submits workflow
- Frontend API → Workflow API: calls API
- Workflow API → Workflow service: delegates
- Workflow service → DSL compiler: compiles graph
- Workflow service → Temporal orchestration: starts runs
- Temporal orchestration → Workflow worker: dispatches work
- Workflow worker → Security components: executes nodes
- Security components → External tooling: invokes tools
- Workflow service → PostgreSQL state: persists workflow state
- Authentication → PostgreSQL state: reads identity state
- Scheduling → Temporal orchestration: schedules runs
- Human approvals → Temporal orchestration: pauses workflows
- Workflow templates → Workflow service: provides workflows
- MCP discovery → Temporal orchestration: starts discovery
- Workflow worker → Kafka: publishes telemetry
- Kafka → Event ingestion: delivers events
- Kafka → Log ingestion: delivers logs
- Event ingestion → PostgreSQL state: appends traces
- Log ingestion → Loki: pushes logs
- Log ingestion → PostgreSQL state: updates metadata
- Artifact storage → MinIO: stores files