🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

@drafthq/draft

Package Overview
Dependencies
Maintainers
1
Versions
16
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@drafthq/draft

Context-Driven Development for AI coding agents — install Draft into Claude Code, Cursor, Codex, or opencode.

Source
npmnpm
Version
3.3.0
Version published
Weekly downloads
71
-65.2%
Maintainers
1
Weekly downloads
 
Created
Source

Draft

Stop shipping AI-generated bugs.
One command runs a three-stage review on your branch — validation, spec compliance, code quality — and writes the missing tests. Free. Open-source. MIT.

GitHub release MIT License Stars Graph engine: codebase-memory-mcp

Powered by codebase-memory-mcp by DeusData — a 159-language, 100% local knowledge-graph engine.

Website · Docs · Methodology · Watch (8 min) · All Videos

The 60-second pitch

Your AI assistant just wrote 200 lines. Some of them are bugs. Some don't match your patterns. Some skip tests.

/draft:review

Three stages, one command:

  • Validation — runs your tests, lints, type-checks, and surfaces real failures
  • Spec compliance — checks the diff against the agreed spec, not vibes
  • Code quality — flags hotspots, blast radius, and missing test coverage using a tree-sitter knowledge graph of your repo

Free. No API keys. No paid tier. No vendor lock-in. Catches the 3 bugs you missed before they hit your reviewer.

Demo coming soon — for now, watch the 8-minute walkthrough.

Install (30 seconds)

One command installs Draft into your agent. No clone, no config.

npx @drafthq/draft install <host>      # claude-code | cursor | codex | opencode

…or install the CLI once and reuse it:

npm install -g @drafthq/draft
draft install <host>
draft list                             # show every host + where it installs

Each host installs the way that host actually loads extensions — no manual steps after the command:

Hostdraft install …What it does
Claude Codeclaude-codeRegisters the plugin via claude plugin marketplace add + claude plugin install (user scope). Restart Claude Code.
CursorcursorCopies the plugin into ~/.cursor/plugins/local/draft/, writes .cursor-plugin/plugin.json, registers draft@draft-plugins in Cursor's plugin registry, and enables it. Restart Cursor (or Developer: Reload Window).
CodexcodexWrites ./AGENTS.md, which Codex reads automatically.
opencodeopencodeWrites ./AGENTS.md + ~/.agents/skills/draft/, both auto-discovered.

Flags: --global / --project to pick scope, --dry-run to preview, --force to overwrite, --no-graph to skip the graph-engine fetch.

Then, in Claude Code (after restarting):

/draft:init       # 5-phase codebase analysis (one-time)
/draft:review     # ← run this on every branch before you push

Run /draft for the full command map.

Other ways to install →

Claude Code — native marketplace

/plugin marketplace add drafthq/draft
/plugin install draft

Cursor — from GitHub

Cursor requires .cursor-plugin/plugin.json; the draft install cursor command also registers the plugin via the shared Claude plugin registry that Cursor reads on many builds. To add from source instead, use Settings > Rules, Skills, Subagents > Rules > New > Add from Github:

https://github.com/drafthq/draft.git

GitHub Copilot

Copilot reads a committed instructions file — copy it directly (not a draft install host):

mkdir -p .github && curl -o .github/copilot-instructions.md \
  https://raw.githubusercontent.com/drafthq/draft/main/integrations/copilot/.github/copilot-instructions.md

Gemini

curl -o .gemini.md https://raw.githubusercontent.com/drafthq/draft/main/integrations/gemini/.gemini.md

Beyond /draft:review — 32 more commands

/draft:review is the wedge. Once Draft has indexed your repo, you also get spec-driven planning, TDD-enforced implementation, exhaustive bug hunting, deep architectural audits, and 32 more commands covering the full development lifecycle.

What You Get

CommandWhat It Does
/draftOverview, intent mapping, and command reference
/draft:planRouter for planning, architecture, and track management
/draft:opsRouter for operations, deployment, incident, and lifecycle
/draft:docsRouter for authoring and documentation workflows
/draft:discoverRouter for discovery, debugging, investigation, and quality
/draft:initAnalyze codebase, create context files + state tracking
/draft:graphBuild / refresh the knowledge-graph snapshot
/draft:new-trackCollaborative spec + plan with AI
/draft:decomposeModule decomposition with dependency mapping
/draft:implementTDD workflow with checkpoints
/draft:coverageCode coverage report (target 95%+)
/draft:review3-stage review (validation + spec compliance + code quality)
/draft:deep-reviewEnterprise-grade module lifecycle and ACID audit
/draft:bughuntExhaustive 14-dimension defect discovery with taint tracking
/draft:learnDiscover coding patterns, update guardrails
/draft:adrArchitecture Decision Records
/draft:statusShow progress overview
/draft:revertGit-aware rollback
/draft:changeHandle mid-track requirement changes
/draft:debugStructured debugging: reproduce, isolate, diagnose, fix
/draft:quick-reviewLightweight 4-dimension code review
/draft:deploy-checklistPre-deployment verification with rollback triggers
/draft:uploadPre-upload handoff gate (review, HLD, checklist, validators)
/draft:testing-strategyTest plan design with coverage targets
/draft:tech-debtTechnical debt analysis across 6 dimensions
/draft:standupGit activity standup summary (read-only)
/draft:incident-responseIncident lifecycle: triage, communicate, mitigate, postmortem
/draft:documentationTechnical docs: readme, runbook, api, onboarding
/draft:integrationsExternal system exports and syncs (jira preview / create)
/draft:jiraUnified Jira workflows (preview / create / review)
/draft:tourInteractive architecture mentorship and codebase walk-through
/draft:impactROI analytics tracking friction and timeline metrics
/draft:assist-reviewSummarize intent and highlight structural PR risks for reviewers

See full command reference →

Recommended next step after install: run /draft:init to index your repo, then /draft:review on any branch with AI-generated changes. Once you've seen what it catches, explore the rest.

Built-in Code Intelligence

Draft is powered by a local knowledge graph engine (codebase-memory-mcp) that gives every command precise structural context — module boundaries, call graphs, dependencies, hotspots. It's 100% local (no API key, no SaaS), fetched during draft install (best-effort; --no-graph to skip), with first-use fetch as a fallback.

/draft:graph                                  # build / refresh the snapshot
scripts/tools/graph-impact.sh --file src/auth/login.go
# → blast radius: which files, which symbols, which tests/docs/configs
CapabilityWhat it provides
Multi-language extractionTree-sitter + LSP-grade resolution across 159 languages, 100% local
Call graphCallers/callees with confidence signals so review/bughunt can weight findings
Impact analysisBlast-radius with file-class dimension (code/test/doc/config) — answers "what breaks if I change this?"
Cycle detectionFlags circular call dependencies before they bite
Hotspot rankingFan-in score so high-risk symbols get extra scrutiny
Incremental indexinggit-aware, content-based; only changed code re-indexes
Track impact memorymetadata.json.impact snapshots each completed track's blast radius — /draft:new-track flags overlap with recent work

The graph powers /draft:graph and /draft:impact, enriches /draft:bughunt and /draft:review, and is consumed by skills via core/shared/graph-query.md. The engine is installed via scripts/fetch-memory-engine.sh; the deterministic shell helpers live under scripts/tools/.

Deterministic helper tools

Skills also call into shell helpers under scripts/tools/ for mechanical work — git metadata, file classification, test-framework detection, hotspot ranking, freshness checks, ADR indexing, and live graph queries (graph-callers.sh, graph-impact.sh, hotspot-rank.sh, cycle-detect.sh, mermaid-from-graph.sh). All emit JSON or markdown, follow a uniform exit-code contract, and degrade gracefully when their input source is unavailable.

How It Works

┌─────────────────────────────────────────────────────────────┐
│                        /draft:init                          │
│    5-phase codebase analysis + signal detection + state     │
│  architecture.md + .ai-context.md + .state/ (freshness,    │
│                   signals, run memory)                      │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                      /draft:new-track                       │
│            AI-guided spec.md + phased plan.md               │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                     /draft:implement                        │
│              RED → GREEN → REFACTOR (repeat)                │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                      /draft:review                          │
│        Three-stage review (validation + spec + quality)     │
└─────────────────────────────────────────────────────────────┘

         /draft:init refresh  ←── incremental: only re-analyze
                                   files with changed hashes

Full workflow →

Why Draft?

AI tools are fast but unstructured. Draft applies Context-Driven Development to impose clear boundaries: explicit context, phased execution, and built-in verification, ensuring outputs remain aligned, predictable, and production-ready.

product.md       →  "Build a task manager"
tech-stack.md    →  "React, TypeScript, Tailwind"
architecture.md  →  Comprehensive: 10-section graph-primary engineering reference, Mermaid diagrams (source of truth). Mature brownfield projects with strong existing agent docs (CLAUDE.md, INVARIANTS.md, etc.) receive early Context Quality Audit, graph fidelity dashboard, and explicit Relationship + Gaps sections (no blind duplication).
.ai-context.md   →  200-400 lines: condensed from architecture.md (token-optimized AI context)
.state/          →  freshness hashes, signal classification, run memory (incremental refresh)
spec.md          →  "Add drag-and-drop reordering"
plan.md          →  "Phase 1: sortable, Phase 2: persist"

Each layer narrows the solution space. By the time AI writes code, decisions are made.

Incremental refresh: After initial setup, /draft:init refresh uses stored file hashes and signal classification to only re-analyze what changed — no full re-scan needed.

Read methodology →

Contributing

Source of Truth

  • core/methodology.md — Master methodology
  • skills/<name>/SKILL.md — Command implementations
  • integrations/ — Auto-generated (don't edit)

Update Workflow

# 1. Edit core/methodology.md or skills/*/SKILL.md
# 2. Rebuild integrations
./scripts/build-integrations.sh

Full architecture →

Star History

Star History Chart

MIT License · Graph engine: codebase-memory-mcp by DeusData

Credits: Inspired by gemini-cli-extensions/conductor

Keywords

claude-code

FAQs

Package last updated on 20 Jun 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts