
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A meta-prompting, context engineering and spec-driven development system for Claude Code.
A meta-prompting, context engineering and spec-driven development system for Claude Code and OpenCode.
Solves context rot — the quality degradation that happens as Claude fills its context window.
npx specops-cc
Works on Mac, Windows, and Linux.
SpecOps is a context engineering layer that makes Claude Code reliable for real projects.
Vibecoding has a bad reputation — you describe what you want, AI generates code, and you get inconsistent garbage that falls apart at scale. SpecOps fixes that by giving Claude everything it needs: structured context, phased execution, fresh subagent windows, and automated verification.
Describe your idea, let the system extract everything it needs to know, and let Claude Code get to work.
— Hardik Desai
Developers who want to describe what they want and have it built correctly — without the overhead of enterprise project management tools.
npx specops-cc
The installer prompts you to choose:
Verify with /so:help inside your Claude Code or OpenCode interface.
SpecOps evolves fast. Check for updates periodically:
/so:whats-new
Update with:
npx specops-cc@latest
# Claude Code
npx specops-cc --claude --global # Install to ~/.claude/
npx specops-cc --claude --local # Install to ./.claude/
# OpenCode (open source, free models)
npx specops-cc --opencode --global # Install to ~/.opencode/
# Both runtimes
npx specops-cc --both --global # Install to both directories
Use --global (-g) or --local (-l) to skip the location prompt.
Use --claude, --opencode, or --both to skip the runtime prompt.
Clone the repository and run the installer locally:
git clone https://github.com/hardik874/specops.git
cd specops
node bin/install.js --claude --local
Installs to ./.claude/ for testing modifications before contributing.
SpecOps is designed for frictionless automation. Run Claude Code with:
claude --dangerously-skip-permissions
[!TIP] This is how SpecOps is intended to be used — stopping to approve
dateandgit commit50 times defeats the purpose.
If you prefer not to use that flag, add this to your project's .claude/settings.json:
{
"permissions": {
"allow": [
"Bash(date:*)",
"Bash(echo:*)",
"Bash(cat:*)",
"Bash(ls:*)",
"Bash(mkdir:*)",
"Bash(wc:*)",
"Bash(head:*)",
"Bash(tail:*)",
"Bash(sort:*)",
"Bash(grep:*)",
"Bash(tr:*)",
"Bash(git add:*)",
"Bash(git commit:*)",
"Bash(git status:*)",
"Bash(git log:*)",
"Bash(git diff:*)",
"Bash(git tag:*)"
]
}
}
Already have code? Run
/so:map-codebasefirst. It spawns parallel agents to analyze your stack, architecture, conventions, and concerns. Then/so:new-projectknows your codebase — questions focus on what you're adding, and planning automatically loads your patterns.
/so:new-project
One command, one flow. The system:
You approve the roadmap. Now you're ready to build.
Creates: PROJECT.md, REQUIREMENTS.md, ROADMAP.md, STATE.md, .planning/research/
/so:discuss-phase 1
This is where you shape the implementation.
Your roadmap has a sentence or two per phase. That's not enough context to build something the way you imagine it. This step captures your preferences before anything gets researched or planned.
The system analyzes the phase and identifies gray areas based on what's being built:
For each area you select, it asks until you're satisfied. The output — CONTEXT.md — feeds directly into the next two steps:
The deeper you go here, the more the system builds what you actually want. Skip it and you get reasonable defaults. Use it and you get your vision.
Creates: {phase}-CONTEXT.md
/so:plan-phase 1
The system:
Each plan is small enough to execute in a fresh context window. No degradation, no "I'll be more concise now."
Creates: {phase}-RESEARCH.md, {phase}-{N}-PLAN.md
/so:execute-phase 1
The system:
Walk away, come back to completed work with clean git history.
Creates: {phase}-{N}-SUMMARY.md, {phase}-VERIFICATION.md
/so:verify-work 1
This is where you confirm it actually works.
Automated verification checks that code exists and tests pass. But does the feature work the way you expected? This is your chance to use it.
The system:
If everything passes, you move on. If something's broken, you don't manually debug — you just run /so:execute-phase again with the fix plans it created.
Creates: {phase}-UAT.md, fix plans if issues found
/so:discuss-phase 2
/so:plan-phase 2
/so:execute-phase 2
/so:verify-work 2
...
/so:complete-milestone
/so:new-milestone
Loop discuss → plan → execute → verify until milestone complete.
Each phase gets your input (discuss), proper research (plan), clean execution (execute), and human verification (verify). Context stays fresh. Quality stays high.
When all phases are done, /so:complete-milestone archives the milestone and tags the release.
Then /so:new-milestone starts the next version — same flow as new-project but for your existing codebase. You describe what you want to build next, the system researches the domain, you scope requirements, and it creates a fresh roadmap. Each milestone is a clean cycle: define → build → ship.
/so:quick
For ad-hoc tasks that don't need full planning.
Quick mode gives you SpecOps guarantees (atomic commits, state tracking) with a faster path:
.planning/quick/, not phasesUse for: bug fixes, small features, config changes, one-off tasks.
/so:quick
> What do you want to do? "Add dark mode toggle to settings"
Creates: .planning/quick/001-add-dark-mode-toggle/PLAN.md, SUMMARY.md
Claude Code is incredibly powerful if you give it the context it needs. Most people don't.
SpecOps handles it for you:
| File | What it does |
|---|---|
PROJECT.md | Project vision, always loaded |
research/ | Ecosystem knowledge (stack, features, architecture, pitfalls) |
REQUIREMENTS.md | Scoped v1/v2 requirements with phase traceability |
ROADMAP.md | Where you're going, what's done |
STATE.md | Decisions, blockers, position — memory across sessions |
PLAN.md | Atomic task with XML structure, verification steps |
SUMMARY.md | What happened, what changed, committed to history |
todos/ | Captured ideas and tasks for later work |
Size limits based on where Claude's quality degrades. Stay under, get consistent excellence.
Every plan is structured XML optimized for Claude:
<task type="auto">
<name>Create login endpoint</name>
<files>src/app/api/auth/login/route.ts</files>
<action>
Use jose for JWT (not jsonwebtoken - CommonJS issues).
Validate credentials against users table.
Return httpOnly cookie on success.
</action>
<verify>curl -X POST localhost:3000/api/auth/login returns 200 + Set-Cookie</verify>
<done>Valid credentials return cookie, invalid return 401</done>
</task>
Precise instructions. No guessing. Verification built in.
Every stage uses the same pattern: a thin orchestrator spawns specialized agents, collects results, and routes to the next step.
| Stage | Orchestrator does | Agents do |
|---|---|---|
| Research | Coordinates, presents findings | 4 parallel researchers investigate stack, features, architecture, pitfalls |
| Planning | Validates, manages iteration | Planner creates plans, checker verifies, loop until pass |
| Execution | Groups into waves, tracks progress | Executors implement in parallel, each with fresh 200k context |
| Verification | Presents results, routes next | Verifier checks codebase against goals, debuggers diagnose failures |
The orchestrator never does heavy lifting. It spawns agents, waits, integrates results.
The result: You can run an entire phase — deep research, multiple plans created and verified, thousands of lines of code written across parallel executors, automated verification against goals — and your main context window stays at 30-40%. The work happens in fresh subagent contexts. Your session stays fast and responsive.
Each task gets its own commit immediately after completion:
abc123f docs(08-02): complete user registration plan
def456g feat(08-02): add email confirmation flow
hij789k feat(08-02): implement password hashing
lmn012o feat(08-02): create registration endpoint
[!NOTE] Benefits: Git bisect finds exact failing task. Each task independently revertable. Clear history for Claude in future sessions. Better observability in AI-automated workflow.
Every commit is surgical, traceable, and meaningful.
You're never locked in. The system adapts.
| Command | What it does |
|---|---|
/so:new-project | Full initialization: questions → research → requirements → roadmap |
/so:discuss-phase [N] | Capture implementation decisions before planning |
/so:plan-phase [N] | Research + plan + verify for a phase |
/so:execute-phase <N> | Execute all plans in parallel waves, verify when complete |
/so:verify-work [N] | Manual user acceptance testing |
/so:audit-milestone | Verify milestone achieved its definition of done |
/so:complete-milestone | Archive milestone, tag release |
/so:new-milestone [name] | Start next version: questions → research → requirements → roadmap |
| Command | What it does |
|---|---|
/so:progress | Where am I? What's next? |
/so:help | Show all commands and usage guide |
/so:whats-new | See what changed since your installed version |
/so:update | Update SpecOps with changelog preview |
| Command | What it does |
|---|---|
/so:map-codebase | Analyze existing codebase before new-project |
| Command | What it does |
|---|---|
/so:add-phase | Append phase to roadmap |
/so:insert-phase [N] | Insert urgent work between phases |
/so:remove-phase [N] | Remove future phase, renumber |
/so:list-phase-assumptions [N] | See Claude's intended approach before planning |
/so:plan-milestone-gaps | Create phases to close gaps from audit |
| Command | What it does |
|---|---|
/so:pause-work | Create handoff when stopping mid-phase |
/so:resume-work | Restore from last session |
| Command | What it does |
|---|---|
/so:settings | Configure model profile and workflow agents |
/so:set-profile <profile> | Switch model profile (quality/balanced/budget) |
/so:add-todo [desc] | Capture idea for later |
/so:check-todos | List pending todos |
/so:debug [desc] | Systematic debugging with persistent state |
/so:quick | Execute ad-hoc task with SpecOps guarantees |
SpecOps stores project settings in .planning/config.json. Configure during /so:new-project or update later with /so:settings.
| Setting | Options | Default | What it controls |
|---|---|---|---|
mode | yolo, interactive | interactive | Auto-approve vs confirm at each step |
depth | quick, standard, comprehensive | standard | Planning thoroughness (phases × plans) |
Control which Claude model each agent uses. Balance quality vs token spend.
| Profile | Planning | Execution | Verification |
|---|---|---|---|
quality | Opus | Opus | Sonnet |
balanced (default) | Opus | Sonnet | Sonnet |
budget | Sonnet | Sonnet | Haiku |
Switch profiles:
/so:set-profile budget
Or configure via /so:settings.
These spawn additional agents during planning/execution. They improve quality but add tokens and time.
| Setting | Default | What it does |
|---|---|---|
workflow.research | true | Researches domain before planning each phase |
workflow.plan_check | true | Verifies plans achieve phase goals before execution |
workflow.verifier | true | Confirms must-haves were delivered after execution |
Use /so:settings to toggle these, or override per-invocation:
/so:plan-phase --skip-research/so:plan-phase --skip-verify| Setting | Default | What it controls |
|---|---|---|
parallelization.enabled | true | Run independent plans simultaneously |
planning.commit_docs | true | Track .planning/ in git |
Commands not found after install?
~/.claude/commands/so/ (global) or ./.claude/commands/so/ (local)Commands not working as expected?
/so:help to verify installationnpx specops-cc to reinstallUpdating to the latest version?
npx specops-cc@latest
Using Docker or containerized environments?
If file reads fail with tilde paths (~/.claude/...), set CLAUDE_CONFIG_DIR before installing:
CLAUDE_CONFIG_DIR=/home/youruser/.claude npx specops-cc --global
This ensures absolute paths are used instead of ~ which may not expand correctly in containers.
To remove SpecOps completely:
# Global installs
npx specops-cc --claude --global --uninstall
npx specops-cc --opencode --global --uninstall
# Local installs (current project)
npx specops-cc --claude --local --uninstall
npx specops-cc --opencode --local --uninstall
This removes all SpecOps commands, agents, hooks, and settings while preserving your other configurations.
MIT License. See LICENSE for details.
Claude Code is powerful. SpecOps makes it reliable.
FAQs
A meta-prompting, context engineering and spec-driven development system for Claude Code.
The npm package specops-cc receives a total of 0 weekly downloads. As such, specops-cc popularity was classified as not popular.
We found that specops-cc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.