
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
specify-mcp
Advanced tools
An MCP (Model Context Protocol) server that implements Specification-Driven Development (SDD) methodology, enabling AI-augmented software development with controlled non-determinism and iterative refinement.
Specify MCP provides a structured workflow for software development through five key phases:
.specify directory for all project artifacts# Clone the repository
git clone https://github.com/yourusername/specify-mcp.git
cd specify-mcp
# Install dependencies
npm install
# Build the TypeScript code
npm run build
# Run in development mode
npm run dev
Add to your MCP settings configuration:
{
"mcpServers": {
"specify-mcp": {
"command": "node",
"args": ["/path/to/specify-mcp/dist/index.js"],
"env": {}
}
}
}
sdd_initInitialize a new SDD project.
{
name: "Project Name",
description: "Initial project description"
}
sdd_specGenerate or refine product requirements specification.
{
projectId: "uuid", // Optional, uses current if not provided
userInput: "Feature requirements description",
refine: false // Set to true for refinement
}
sdd_planCreate technical implementation plan.
{
projectId: "uuid",
techStack: {
language: "TypeScript",
framework: "Express",
database: "PostgreSQL",
testing: "Jest"
},
refine: false
}
sdd_tasksBreak down work into detailed tasks.
{
projectId: "uuid",
granularity: "medium" // "high", "medium", or "low"
}
sdd_implementGenerate TDD implementation guide for a specific task.
{
projectId: "uuid",
taskId: "T001"
}
sdd_verifyVerify any document for issues.
{
content: "Document content to verify",
phase: "spec" // "init", "spec", "plan", "tasks", or "implement"
}
sdd_list_projectsList all available projects.
sdd_set_current_projectSet the current working project.
{
projectId: "uuid"
}
.specify/
├── projects/
│ └── [project-id]/
│ ├── project.json
│ ├── spec/
│ │ ├── current.md
│ │ └── versions/
│ ├── plan/
│ │ ├── current.md
│ │ ├── research.md
│ │ └── data-model.md
│ ├── tasks/
│ │ └── [task-id]/
│ │ ├── index.md
│ │ └── implementation.md
│ └── implementations/
│ ├── tests/
│ └── code/
├── templates/
├── cache/
└── logs/
# 1. Initialize project
> Use tool: sdd_init
Input: { name: "Todo App", description: "A simple todo application" }
# 2. Create specification
> Use tool: sdd_spec
Input: { userInput: "Users can create, edit, delete todos..." }
# 3. Plan technical implementation
> Use tool: sdd_plan
Input: { techStack: { language: "TypeScript", framework: "Express" } }
# 4. Generate tasks
> Use tool: sdd_tasks
Input: { granularity: "medium" }
# 5. Implement specific task
> Use tool: sdd_implement
Input: { taskId: "T001" }
The server includes comprehensive verification for:
.specify directory and file operations# Run all tests
npm test
# Run with coverage
npm run test:coverage
# Watch mode
npm run test:watch
# Lint code
npm run lint
# Fix linting issues
npm run lint:fix
# Format code
npm run format
# Type checking
npm run typecheck
The project follows clean code guidelines:
MIT License - See LICENSE file for details
For issues, questions, or suggestions, please open an issue on GitHub.
Built with ❤️ for AI-augmented software development
FAQs
MCP server implementing Specification-Driven Development methodology
We found that specify-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.