io.github.CloudCorpRecords/specforge
OCI · GHCR.IO/CLOUDCORPRECORDS/SPECFORGE · 2 COMPONENTS
Spec-driven development locally: specs, constitutions, plans, tasks, git and quality checks.
Available components
Last scanned (4 hours ago)
Scores higher than 46% of OCI servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 902 tokens (~41/item across 22 items; 22 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed oci/ghcr.io/cloudcorprecords/specforge@0.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
artifacts_analyze ~34
Report presence and size for named artifacts of the current feature.
| Name | Type | Req | Description |
|---|---|---|---|
| artifacts | array | yes | Names of the artifacts to analyze. |
No output schema declared.
No examples provided.
clarify_add ~45
Add a clarification question to the current feature's clarifications list.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Optional context for the question. |
| question | string | yes | Clarification question to add. |
No output schema declared.
No examples provided.
clarify_resolve ~44
Resolve a clarification by id with a resolution.
| Name | Type | Req | Description |
|---|---|---|---|
| clarificationId | string | yes | Id of the clarification to resolve. |
| resolution | string | yes | Resolution text for the clarification. |
No output schema declared.
No examples provided.
constitution_create ~57
Write a constitution for the current feature from principles, with optional constraints and preferences.
| Name | Type | Req | Description |
|---|---|---|---|
| constraints | array | – | Optional list of constraints. |
| preferences | array | – | Optional list of preferences. |
| principles | array | yes | List of constitution principles. |
No output schema declared.
No examples provided.
git_create_branch ~34
Create a git branch in the workspace using git.
| Name | Type | Req | Description |
|---|---|---|---|
| branchName | string | yes | Name of the git branch to create. |
No output schema declared.
No examples provided.
plan_create ~34
Create a plan for the current feature from constraint text.
| Name | Type | Req | Description |
|---|---|---|---|
| constraintsText | string | yes | Constraint text the plan is created from. |
No output schema declared.
No examples provided.
quality_format ~33
Run the formatter check, optionally fixing formatting.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | boolean | – | When true, fix formatting instead of only checking. |
No output schema declared.
No examples provided.
quality_lint ~37
Run the linter, optionally fixing lint issues.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | boolean | – | When true, fix lint issues instead of only reporting them. |
No output schema declared.
No examples provided.
quality_security_audit ~37
Run a dependency security audit, optionally fixing findings.
| Name | Type | Req | Description |
|---|---|---|---|
| fix | boolean | – | When true, apply fixes for audit findings where possible. |
No output schema declared.
No examples provided.
quality_test ~33
Run the test suite, optionally with coverage.
| Name | Type | Req | Description |
|---|---|---|---|
| coverage | boolean | – | When true, run the test suite with coverage. |
No output schema declared.
No examples provided.
research_append ~32
Append content to the current feature's research file.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Content to append to the research file. |
No output schema declared.
No examples provided.
spec_refine ~50
Refine a named section of the current feature's spec with new content.
| Name | Type | Req | Description |
|---|---|---|---|
| changes | string | yes | New content for the section. |
| section | string | yes | Name of the spec section to refine. |
No output schema declared.
No examples provided.
spec_validate ~39
Validate the current feature's spec for presence and completeness, returning per-check results.
| Name | Type | Req | Description |
|---|---|---|---|
| checks | object | – | Optional checks object selecting which validations to run. |
No output schema declared.
No examples provided.
specify_describe ~40
Write a feature description into the current feature's spec user-story section.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Feature description text written into the spec user-story section. |
No output schema declared.
No examples provided.
specify_start ~62
Start a new feature: create the next numbered feature directory with a spec template, a contracts directory and a research file.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Agent name recorded with the feature, when given. |
| projectName | string | yes | Project name for the new feature. |
No output schema declared.
No examples provided.
tasks_filter ~48
List actionable tasks from the current feature, optionally by preset and limit.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of tasks to list. |
| preset | string | – | Optional preset selecting the task filter. |
No output schema declared.
No examples provided.
tasks_generate ~36
Generate a numbered checkbox task list for the current feature from its spec.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | – | Optional scope limiting which tasks are generated. |
No output schema declared.
No examples provided.
tasks_search ~46
Search task text in the current feature's task list.
| Name | Type | Req | Description |
|---|---|---|---|
| fuzzy | boolean | – | When true, use fuzzy matching. |
| query | string | yes | Text to search for in task text. |
No output schema declared.
No examples provided.
tasks_stats ~51
Report done and pending task counts for the current feature.
| Name | Type | Req | Description |
|---|---|---|---|
| groupBy | string | – | Grouping key for the task counts. |
| includeCharts | boolean | – | When true, include chart data in the report. |
No output schema declared.
No examples provided.
tasks_tick ~36
Mark a task as done in the current feature's task list.
| Name | Type | Req | Description |
|---|---|---|---|
| taskId | string | yes | Id of the task to mark done. |
No output schema declared.
No examples provided.
tasks_tick_range ~38
Mark several tasks as done in the current feature's task list.
| Name | Type | Req | Description |
|---|---|---|---|
| taskIds | array | yes | Ids of the tasks to mark done. |
No output schema declared.
No examples provided.
tasks_visualize ~36
Render the current feature's task list as text or mermaid.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format: text or mermaid. |
No output schema declared.
No examples provided.
How do I install the io.github.CloudCorpRecords/specforge MCP server?
io.github.CloudCorpRecords/specforge runs locally as a container image, launched with docker run --rm -i ghcr.io/cloudcorprecords/specforge:0.1.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/cloudcorprecords/specforge
claude mcp add cloudcorprecords-specforge -- docker run --rm -i ghcr.io/cloudcorprecords/specforge:0.1.0
What is the io.github.CloudCorpRecords/specforge MCP server?
io.github.CloudCorpRecords/specforge is an MCP server listed in the public MCP registry as io.github.CloudCorpRecords/specforge. Spec-driven development locally: specs, constitutions, plans, tasks, git and quality checks. This page covers its container image (ghcr.io/cloudcorprecords/specforge).
Is the io.github.CloudCorpRecords/specforge MCP server safe to use?
io.github.CloudCorpRecords/specforge scores 41 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.CloudCorpRecords/specforge MCP server expose?
io.github.CloudCorpRecords/specforge exposes 22 tools: specify_start, specify_describe, constitution_create, clarify_add, clarify_resolve, and 17 more. Their descriptions and schemas cost roughly 902 tokens of context every time the server is loaded.
Is the io.github.CloudCorpRecords/specforge MCP server still maintained?
io.github.CloudCorpRecords/specforge is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.CloudCorpRecords/specforge MCP server under?
io.github.CloudCorpRecords/specforge declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.