# specpack (npm · specpack)

Audit and write CLAUDE.md / AGENTS.md / Cursor rules; generate full build specs for new projects.

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `prompt-generator-website.com`: 68/100, [markdown](https://verifymcp.io/servers/the-kipdev-specpack/prompt-generator-website.md), [page](https://verifymcp.io/servers/the-kipdev-specpack/prompt-generator-website)
- npm · `specpack`: 69/100 (this document), [markdown](https://verifymcp.io/servers/the-kipdev-specpack/specpack.md), [page](https://verifymcp.io/servers/the-kipdev-specpack/specpack)

## Channel facts

- Registry: `npm`
- Package: `specpack`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1204 tokens (~172/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the specpack MCP server?

specpack runs locally as an npm package, launched with npx -y specpack. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add the-kipdev-specpack -- npx -y specpack
```

### Cursor

```json
{
  "mcpServers": {
    "the-kipdev-specpack": {
      "command": "npx",
      "args": [
        "-y",
        "specpack"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "the-kipdev-specpack": {
      "command": "npx",
      "args": [
        "-y",
        "specpack"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add the-kipdev-specpack -- npx -y specpack
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "the-kipdev-specpack": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "specpack"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add the-kipdev-specpack --command npx --arg -y --arg specpack
```

### Hermes

```yaml
mcp_servers:
  the-kipdev-specpack:
    command: "npx"
    args: ["-y", "specpack"]
```

### Netclaw

```json
{
  "McpServers": {
    "the-kipdev-specpack": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "specpack"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add the-kipdev-specpack -t stdio -c npx -a -y specpack
```

### Other

```json
{
  "mcpServers": {
    "the-kipdev-specpack": {
      "command": "npx",
      "args": [
        "-y",
        "specpack"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 69, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-18 (score 54)

First indexed and scored.

## MCP tools (7)

### `audit_agent_file` (~221 tokens)

Audit an agent memory file

Score CLAUDE.md, AGENTS.md, .cursorrules, .windsurfrules, copilot-instructions.md or a Cursor .mdc rule for bloat: the share of its tokens that change nothing about what the agent does. Returns each line to cut (role-play preamble, generic advice, restated manifests, duplicates, emphasis inflation) or to offload (file trees, schema dumps, endpoint lists, long code blocks, situational sections) with the reason, plus a trimmed copy. Runs locally, nothing is sent. Pass `path` or `content`; with neither, audits every agent file found in the working directory. Use it before editing an agent file, or when the user asks why the agent ignores its rules.

Input parameters:

- `content` (string): File content to audit, when it is not on disk.
- `include_trimmed` (boolean): Append the trimmed file. Default true.
- `path` (string): File to audit, relative to the working directory (e.g. CLAUDE.md).

### `draft_agent_file` (~182 tokens)

Draft a lean AGENTS.md / CLAUDE.md from the repository

Scan the project's manifests (package.json scripts and lockfile, framework, tsconfig, Prisma schema, pyproject/requirements, composer.json, go.mod, Cargo.toml, Gemfile, Makefile, Docker Compose, .nvmrc, .env.example) and return a lean agent file: stack, commands with their real scripts, and the constraints those files state. Nothing is guessed and nothing is written to disk: review it, add the project rules only the user knows (the ones the code cannot tell), then write it. Runs locally.

Input parameters:

- `format` (string): agents → AGENTS.md (default); claude → CLAUDE.md (imports @AGENTS.md when it exists); cursor → .cursor/rules/project.mdc.
- `path` (string): Project directory, relative to the working directory. Default: the working directory.

### `list_project_types` (~42 tokens)

List project types

The project types a build spec can be generated for (saas, ecommerce, business, marketplace, blog, webapp, landing). Next: get_questionnaire.

### `get_questionnaire` (~128 tokens)

Get the questionnaire for a project type

Returns every question behind a build spec for one project type: id, label, type (text, textarea, select, radio, multiselect, boolean, number), options, and conditions (ask only when another answer matches). Fill the answers yourself from the conversation and the repository, ask the user only what you cannot infer, then call generate_spec with {type, answers}. Answer values: option `value` for select/radio, array of values for multiselect, true/false for boolean. Only project_name and project_description are required.

Input parameters:

- `type` (string, required): Project type id.

### `generate_spec` (~288 tokens)

Generate a build spec and agent files

Generates the complete specification for a new project (stack, database schema, authentication, type-specific features, pages, design, SEO, security, legal, deployment, file structure, rules) and the agent files that go with it: AGENTS.md, CLAUDE.md (imports @AGENTS.md), .cursor/rules/project.mdc, .cursorrules, .windsurfrules, .github/copilot-instructions.md, README.md. Deterministic (same answers → same spec), no AI involved. Counts one spec (2 free without a key). With `output_dir`, writes spec.md and the pack there (or only `files`) and returns the paths; without it, returns spec.md plus the `files` you ask for.

Input parameters:

- `answers` (object, required): Answers keyed by question id (see get_questionnaire). project_name and project_description are required.
- `files` (array): Pack files to write (with output_dir; default: all) or to return inline (default: none), e.g. ["AGENTS.md","CLAUDE.md"]. spec.md is always included.
- `output_dir` (string): Directory to write the files into, relative to the working directory.
- `overwrite` (boolean): Overwrite existing files in output_dir. Default false: nothing is written if one exists.
- `type` (string, required): Project type id.

### `get_usage` (~67 tokens)

Plan and usage

The current plan (free, pass, pro), its end date, and how many specs and AI drafts are left — for the API key in SPECPACK_API_KEY, or for this IP when anonymous. Call it before generate_spec or draft_answers when unsure a call will fit the quota.

### `draft_answers` (~118 tokens)

Draft questionnaire answers with AI

Turns a plain-language project description into a complete answer set for generate_spec, using AI on prompt-generator-website.com (10–40 s). Spends one AI draft (3 free without a key) — prefer filling get_questionnaire yourself when you have the context. Returns the answers and the assumptions the description did not settle: show those to the user before calling generate_spec.

Input parameters:

- `description` (string, required): What the project is, who it is for, what it must do.
- `type` (string): Project type id, when known.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/the-kipdev-specpack/specpack#diagnostics

## Score history

- 2026-09-20: 69
- 2026-09-19: 69
- 2026-09-18: 54

## Common questions

### What is the specpack MCP server?

specpack is an MCP server listed in the public MCP registry as io.github.THE-KIPDEV/specpack. Audit and write CLAUDE.md / AGENTS.md / Cursor rules; generate full build specs for new projects. This page covers its npm package (specpack).

### Is the specpack MCP server safe to use?

specpack scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the specpack MCP server expose?

specpack exposes 7 tools: audit_agent_file, draft_agent_file, list_project_types, get_questionnaire, generate_spec, and 2 more. Their descriptions and schemas cost roughly 1,046 tokens of context every time the server is loaded.

### Is the specpack MCP server still maintained?

specpack is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the specpack MCP server under?

specpack declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/specpack
- Socket report: https://socket.dev/npm/package/specpack
- Repository: https://github.com/THE-KIPDEV/specpack
- Website: https://prompt-generator-website.com/
- Changelog RSS feed: https://verifymcp.io/servers/the-kipdev-specpack/specpack.xml
- Changelog JSON feed: https://verifymcp.io/servers/the-kipdev-specpack/specpack.json
- HTML version of this page: https://verifymcp.io/servers/the-kipdev-specpack/specpack