
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
magic-spec
Advanced tools
The Specification-Driven Development (SDD) Operating System for AI Coding Agents.
Stop your AI from writing fragile code before it fully understands the problem. magic-spec installs a high-performance, structured pipeline — Thought → Spec → Task → Run → Code — directly into any project, regardless of the tech stack.
Whether you are a coding novice building your first application or a senior engineer architecting enterprise systems, Magic Spec brings maximum automation and professional rigor to your development process. It enforces a deterministic workflow that ensures your AI agent perfectly aligns with your vision before writing a single line of code.
magic-spec is a set of markdown-based workflow instructions specifically designed for AI coding agents like Cursor, Windsurf, Claude, and Gemini. It acts as a project-level operating system that orchestrates agentic development.
Instead of chaotic prompt-engineering, Magic Spec provides a rigorous pipeline:
💡 Idea → 📋 Specification → 🗺️ Task & Plan → ⚡ Run → 🚀 Code
Once initialized, your AI agent will automatically:
After running the installer, your project directory will be augmented with the following structure:
root-project/
├── .agents/workflows/ # Slash commands wrapper (e.g., magic.spec, magic.task)
├── .magic/ # The SDD Engine (workflow logic and scripts - read-only)
└── .design/ # Your Project Design Workspace (INDEX.md, RULES.md, PLAN.md)
.magic/: Deploys the core SDD engine..agents/: Sets up workflows for your AI..design/: Initializes your project's workspace for Specifications, Rules, and Plans.[!TIP] Magic Workspaces: Magic Spec supports multiple, isolated design environments within a single repository (e.g.,
.design/engine/,.design/installers/). This allows you to manage fundamentally different project domains without specification overlap, while sharing a single core engine. See workspaces.md for details.
"No code without a spec. No spec without a plan."
Magic Spec is built around a single conviction: AI agents write better code when they are forced to think before they act. Left unconstrained, they jump straight to implementation — producing code that is fragile, misaligned, and expensive to refactor. Magic Spec installs a structured pipeline that makes this impossible.
The core design goal is to keep humans out of the loop as much as possible — without sacrificing control over what actually matters. Magic Spec moves from manual "Status Gates" to an Autonomous Partner model.
Once you describe what you want, the engine takes over:
Draft -> RFC -> Stable -> Plan -> Run). The internal SDD ceremony is encapsulated — you only see the result and a final "Go" gate..design/ at any time to review specifications and plans. The rigor is there for when you need it.Stable automatically if the logic is clear.Everything else is automated. The agent does the engineering. You approve the direction.
Every specification in Magic Spec belongs to one of two layers, and this separation is strictly enforced:
Layer 1 — Concept (layer: concept)
Technology-agnostic. Describes what the system must do: business rules, domain invariants, data contracts, and behavioral requirements. A Layer 1 spec can be ported to any tech stack without modification. It is the source of truth for the entire implementation.
Layer 2 — Implementation (layer: implementation)
Stack-specific. Describes how a Layer 1 concept is realized in a concrete technology (e.g., a Node.js REST API, a PostgreSQL schema, a React component). Every Layer 2 spec must declare its parent via Implements: {l1-file.md} and cannot reach RFC or Stable status until its parent is Stable.
This separation prevents a common failure mode in AI-assisted development: mixing "what we want" with "how we build it" in a single document, which leads to specs that are impossible to reuse, validate, or evolve independently.
Why this matters in practice: Imagine you built your backend on Node.js + PostgreSQL. Six months later, performance demands require a migration to Go + ScyllaDB. With a two-layer model, your Layer 1 specs — authentication rules, data contracts, business logic — remain completely intact. Only the Layer 2 specs are rewritten to reflect the new stack. Your AI agent gets a clean, unambiguous brief for the migration without you having to re-explain the entire domain from scratch.
The engine actively protects specification integrity throughout the project lifecycle:
Stable), all dependent Layer 2 specs are automatically flagged and their tasks are blocked. The plan cannot proceed on a broken foundation.INDEX.md. Every registered spec must appear in the implementation plan or the backlog. Orphaned specs are treated as critical blockers.RULES.md), any existing task plan is flagged as stale. The agent will not execute tasks generated under outdated rules without an explicit sync.Magic Spec includes a built-in retrospective engine that runs automatically at two levels:
These retrospectives feed back into the specification layer, closing the loop between what was planned and what was actually built.
The engine enforces a rigorous, unskippable pipeline: Idea → Specification → Task & Plan → Code. AI agents are prevented from jumping straight to coding. They must first formally specify the solution, then break it down into a concrete plan and tasks, and only then proceed to execution.
flowchart TB
IDEA(["💡 Idea"])
subgraph BOX ["Magic Spec"]
direction TB
SPEC["📋 Spec"]
subgraph TASK ["🗺️ Task"]
direction TB
PLAN["📐 Plan"]
TASKS["📌 Tasks"]
PLAN --> TASKS
end
RUN["⚡ Run"]
SPEC --> PLAN
TASKS --> RUN
end
CODE(["🚀 Code"])
IDEA --> SPEC
RUN --> CODE
style IDEA fill:#1e1e2e,stroke:#89b4fa,color:#cdd6f4
style CODE fill:#1e1e2e,stroke:#a6e3a1,color:#cdd6f4
style BOX fill:#181825,stroke:#fab387,stroke-width:3px,color:#fab387
style SPEC fill:#1e1e2e,stroke:#89b4fa,color:#cdd6f4
style RUN fill:#1e1e2e,stroke:#89b4fa,color:#cdd6f4
style TASK fill:#11111b,stroke:#89b4fa,stroke-dasharray:5 5,color:#89b4fa
style PLAN fill:#1e1e2e,stroke:#45475a,stroke-dasharray:4 4,color:#cdd6f4
style TASKS fill:#1e1e2e,stroke:#45475a,stroke-dasharray:4 4,color:#cdd6f4
Before installing Magic Spec, ensure you have one of the following available on your system:
| Requirement | Details |
|---|---|
| Node.js | Version 16.x or higher (for npx method) |
| Python | Version 3.8 or higher (for uvx or pipx methods) |
| Git | Required for installing edge versions directly from GitHub |
| Terminal | tar utility (pre-installed on Windows/Linux/macOS) |
Works perfectly with any project — Rust, Go, Python, JavaScript, C++, or anything else. No runtime lock-in.
npx)Stable Release:
# Basic installation (defaults to .agents/ folder)
npx magic-spec@latest
# Targeted installation for Cursor
npx magic-spec@latest --cursor
Edge Version (GitHub):
npx --yes github:teratron/magic-spec
uvx)Stable Release:
# Basic installation
uvx magic-spec
# Targeted installation for Windsurf
uvx magic-spec --windsurf
Edge Version (GitHub):
uvx --from git+https://github.com/teratron/magic-spec.git magic-spec
pipx)pipx run magic-spec
You can install support for multiple adapters at once:
npx magic-spec@latest --cursor --copilot --windsurf
If automated installers do not fit your environment:
.magic/ folder from the GitHub repository.workflows/..cursor/commands).Keep your SDD engine up to date with the latest logic and features:
# Check if update is available
npx magic-spec@latest --check
# Perform the update
npx magic-spec@latest --update
[!TIP] The update process preserves your
.design/workspace and automatically creates backups of.magic/and.agents/folders. If you have modified core engine files, the installer will detect conflicts and ask for your preference (overwrite, skip, or abort). After updating Magic Spec, it is highly recommended to run the/magic.analyzecommand to ensure your project's specifications and engine metadata are fully synchronized.
.gitignoreThe installer automatically adds .magic/ and the adapter directory (e.g., .agents/, .cursor/rules/) to your project's .gitignore. These directories are installed dependencies — similar to node_modules/ — and should be reinstalled via npx magic-spec@latest rather than committed to version control.
[!TIP] Vendoring: If you prefer to commit the engine into your repository (so teammates get it without running the installer), simply remove the
.magic/and.agents/entries from your.gitignore.
Just talk to your AI agent naturally in your prompt interface. No complex commands to learn:
Magic Spec is heavily optimized and provides native workflow generation for the world's most powerful AI development environments.
You can install support for a specific adapter using the shortcut flag (e.g., --cursor) or the environment flag (e.g., --env cursor).
| AI Agent / IDE | Shortcut Flag | Env Flag |
|---|---|---|
| Cursor (Agent Mode) | --cursor | --env cursor |
| Windsurf (Cascade) | --windsurf | --env windsurf |
| Claude Code | --claude | --env claude |
| Gemini CLI | --gemini | --env gemini |
| GitHub Copilot | --copilot | --env copilot |
| Roo Code | --roo | --env roo |
| Amp | --amp | --env amp |
| Amazon Q Developer | --q | --env q |
| Kilo Code | --kilocode | --env kilocode |
| Qwen Code | --qwen | --env qwen |
| OpenCode | --opencode | --env opencode |
| SHAI (OVHcloud) | --shai | --env shai |
| IBM Bob | --bob | --env bob |
| CodeBuddy | --codebuddy | --env codebuddy |
| Qoder IDE | --qoder | --env qoder |
| Codex CLI | --codex | --env codex |
| Auggie CLI | --augment | --env augment |
| Antigravity IDE | --antigravity | --env antigravity |
| Lingma IDE | --lingma | --env lingma |
If you encounter issues or have questions:
We welcome contributions! Whether it's a bug fix, a new adapter, or an improvement to the workflow logic. Please see Contributing Guide for details.
Distributed under the MIT License.
Active Development (v1.x). We are constantly refining the SDD engine based on real-world usage.
FAQs
Magic Specification-Driven Development (SDD) Workflow
We found that magic-spec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.