specpack
NPM · SPECPACK · 2 COMPONENTS · SCANNED SEP 20
Audit and write CLAUDE.md / AGENTS.md / Cursor rules; generate full build specs for new projects.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1204 tokens (~172/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the specpack MCP server?
specpack runs locally as an npm package, launched with npx -y specpack. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · specpack
claude mcp add the-kipdev-specpack -- npx -y specpack
{
"mcpServers": {
"the-kipdev-specpack": {
"command": "npx",
"args": [
"-y",
"specpack"
]
}
}
} {
"servers": {
"the-kipdev-specpack": {
"command": "npx",
"args": [
"-y",
"specpack"
]
}
}
} codex mcp add the-kipdev-specpack -- npx -y specpack
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"the-kipdev-specpack": {
"type": "local",
"command": [
"npx",
"-y",
"specpack"
],
"enabled": true
}
}
} openclaw mcp add the-kipdev-specpack --command npx --arg -y --arg specpack
mcp_servers:
the-kipdev-specpack:
command: "npx"
args: ["-y", "specpack"] {
"McpServers": {
"the-kipdev-specpack": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"specpack"
]
}
}
} assistant mcp add the-kipdev-specpack -t stdio -c npx -a -y specpack
{
"mcpServers": {
"the-kipdev-specpack": {
"command": "npx",
"args": [
"-y",
"specpack"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 18 Sept 26 54
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/specpack@0.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit_agent_file Audit an agent memory file ~221
Score CLAUDE.md, AGENTS.md, .cursorrules, .windsurfrules, copilot-instructions.md or a Cursor .mdc rule for bloat: the share of its tokens that change nothing about what the agent does. Returns each line to cut (role-play preamble, generic advice, restated manifests, duplicates, emphasis inflation) or to offload (file trees, schema dumps, endpoint lists, long code blocks, situational sections) with the reason, plus a trimmed copy. Runs locally, nothing is sent. Pass `path` or `content`; with neither, audits every agent file found in the working directory. Use it before editing an agent file, or when the user asks why the agent ignores its rules.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | File content to audit, when it is not on disk. |
| include_trimmed | boolean | – | Append the trimmed file. Default true. |
| path | string | – | File to audit, relative to the working directory (e.g. CLAUDE.md). |
No output schema declared.
No examples provided.
draft_agent_file Draft a lean AGENTS.md / CLAUDE.md from the repository ~182
Scan the project's manifests (package.json scripts and lockfile, framework, tsconfig, Prisma schema, pyproject/requirements, composer.json, go.mod, Cargo.toml, Gemfile, Makefile, Docker Compose, .nvmrc, .env.example) and return a lean agent file: stack, commands with their real scripts, and the constraints those files state. Nothing is guessed and nothing is written to disk: review it, add the project rules only the user knows (the ones the code cannot tell), then write it. Runs locally.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | agents → AGENTS.md (default); claude → CLAUDE.md (imports @AGENTS.md when it exists); cursor → .cursor/rules/project.mdc. |
| path | string | – | Project directory, relative to the working directory. Default: the working directory. |
No output schema declared.
No examples provided.
draft_answers Draft questionnaire answers with AI ~118
Turns a plain-language project description into a complete answer set for generate_spec, using AI on prompt-generator-website.com (10–40 s). Spends one AI draft (3 free without a key) — prefer filling get_questionnaire yourself when you have the context. Returns the answers and the assumptions the description did not settle: show those to the user before calling generate_spec.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What the project is, who it is for, what it must do. |
| type | string | – | Project type id, when known. |
No output schema declared.
No examples provided.
generate_spec Generate a build spec and agent files ~288
Generates the complete specification for a new project (stack, database schema, authentication, type-specific features, pages, design, SEO, security, legal, deployment, file structure, rules) and the agent files that go with it: AGENTS.md, CLAUDE.md (imports @AGENTS.md), .cursor/rules/project.mdc, .cursorrules, .windsurfrules, .github/copilot-instructions.md, README.md. Deterministic (same answers → same spec), no AI involved. Counts one spec (2 free without a key). With `output_dir`, writes spec.md and the pack there (or only `files`) and returns the paths; without it, returns spec.md plus the `files` you ask for.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | object | yes | Answers keyed by question id (see get_questionnaire). project_name and project_description are required. |
| files | array | – | Pack files to write (with output_dir; default: all) or to return inline (default: none), e.g. ["AGENTS.md","CLAUDE.md"]. spec.md is always included. |
| output_dir | string | – | Directory to write the files into, relative to the working directory. |
| overwrite | boolean | – | Overwrite existing files in output_dir. Default false: nothing is written if one exists. |
| type | string | yes | Project type id. |
No output schema declared.
No examples provided.
get_questionnaire Get the questionnaire for a project type ~128
Returns every question behind a build spec for one project type: id, label, type (text, textarea, select, radio, multiselect, boolean, number), options, and conditions (ask only when another answer matches). Fill the answers yourself from the conversation and the repository, ask the user only what you cannot infer, then call generate_spec with {type, answers}. Answer values: option `value` for select/radio, array of values for multiselect, true/false for boolean. Only project_name and project_description are required.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Project type id. |
No output schema declared.
No examples provided.
get_usage Plan and usage ~67
The current plan (free, pass, pro), its end date, and how many specs and AI drafts are left — for the API key in SPECPACK_API_KEY, or for this IP when anonymous. Call it before generate_spec or draft_answers when unsure a call will fit the quota.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_project_types List project types ~42
The project types a build spec can be generated for (saas, ecommerce, business, marketplace, blog, webapp, landing). Next: get_questionnaire.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the specpack MCP server?
specpack is an MCP server listed in the public MCP registry as io.github.THE-KIPDEV/specpack. Audit and write CLAUDE.md / AGENTS.md / Cursor rules; generate full build specs for new projects. This page covers its npm package (specpack).
Is the specpack MCP server safe to use?
specpack scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the specpack MCP server expose?
specpack exposes 7 tools: audit_agent_file, draft_agent_file, list_project_types, get_questionnaire, generate_spec, and 2 more. Their descriptions and schemas cost roughly 1,046 tokens of context every time the server is loaded.
Is the specpack MCP server still maintained?
specpack is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the specpack MCP server under?
specpack declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.