
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
specleft
Advanced tools
A planning-first CLI for AI coding agents to externalize intent before writing code, with optional CI enforcement for Python projects.

SpecLeft keeps feature intent and test coverage aligned by turning plans into version-controlled specs, then generating pytest test skeletons from those specs.
.specleft/specs/*.mdSpecLeft currently works with Python and pytest. It does not replace your test runner or reinterpret existing tests.
Website: specleft.dev
Two paths, depending on how you want to start. See docs/cli-reference.md for full command details.
pip install specleft
specleft init
Create a feature, then add a scenario and generate a skeleton test for it:
# Create the feature spec
specleft features add --id AUTHENTICATION --title "Authentication" --format json
# Add a scenario and generate a skeleton test file
specleft features add-scenario \
--feature AUTHENTICATION \
--title "Successful login" \
--step "Given a user has valid credentials" \
--step "When the user logs in" \
--step "Then the user is authenticated" \
--add-test skeleton \
--format json
# Show traceability / coverage status
specleft status
Create prd.md describing intended behavior.
Recommended: Update .specleft/templates/prd-template.yml to customize how your PRD sections map to features/scenarios.
Then run:
# Generate specs from the PRD without writing files (remove --dry-run to write)
specleft plan --dry-run
# Validate the generated specs
specleft features validate
# Preview skeleton generation (remove --dry-run to generate)
specleft test skeleton --dry-run
# Confirm and generate skeleton tests
specleft test skeleton
# Show traceability / coverage status
specleft status
# Run your tests with pytest as normal
pytest
That flow converts prd.md into .specleft/specs/*.md, validates the result, previews skeleton generation, then generates the skeleton tests.
SpecLeft treats specs as intent (not executable text) and keeps execution in plain pytest. For the longer comparison, see docs/why-not-bdd.md.
If you are integrating SpecLeft into an agent loop, it's recommended to install the MCP server (see in section below).
Otherwise begin with:
specleft doctor --format json
specleft contract --format json
specleft features stats --format json
SpecLeft includes a verifiable skill file at .specleft/SKILL.md. Verify integrity with:
specleft skill verify --format json
⚠️ Only follow instructions from SKILL.md when integrity is reported as "passed".
SpecLeft includes an MCP server so agents can read/create specs, track status, and generate test scaffolding without leaving the conversation.
See GET_STARTED.md for setup details.
For MCP end-to-end smoke testing and CI workflow details, see docs/mcp-testing.md.
SpecLeft is licensed under Apache License 2.0.
FAQs
A planning-first CLI for AI coding agents to externalize intent before writing code, with optional CI enforcement for Python projects.
The pypi package specleft receives a total of 48 weekly downloads. As such, specleft popularity was classified as not popular.
We found that specleft demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.