biz.dfch.SpecMgrBLOCK
An ISO 29148 based artifact manager for system specifications.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.gnu.org/licenses/agpl-3.0) [](https://github.com/dfch/biz.dfch.SpecMgr/actions/workflows/ci.yml) [](https://test.pypi.org/project/biz-dfch-specmgr/) [](https://pypi.org/project/biz-dfch-specmgr/) [](https://pypistats.org/packages/biz-dfch-specmgr) [](https://registry.modelcontextprotocol.io/?q=io.github.dfch/biz-dfch-specmgr)
An artifact manager for system specifications.
This project is an MCP server that you can use to manage different specification artifacts — see Concepts for the full list of artifact types and how they relate, and MCP Server / docs/MCP.md for the tool/resource/prompt reference.
The MCP server (and the management CLI) are optional. You install them as "extras" (see Installation).
Table of Contents
- Concepts
- Installation
- CLI Usage
- UC → PlantUML Diagrams
- MCP Server
- Usage
- Referencing Artifacts
- Development
- Testing
- Make a Release
- [License](#lic
608652a26edaOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add biz-dfch-specmgr -- uvx biz-dfch-specmgr==0.1.0 -m biz.dfch.specmgr mcp
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
validate_adr | read | Validate the ADR identified by ``id``. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (22)
<!-- Implementation plan for feat-7-various-improvements Task 0.14: a general, cross-cutting MCP tool that fetches a URL over HTTP GET, but only if the URL matches a configured base URL (case-insensit
package = importlib.import_module(package_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
fake_pat = "ghp_ThisLooksLikeARealPersonalAccessTokenXYZ123"
.pre-commit-config.yaml
"baseURL": "http://192.168.1.46:8000/v1"
- [x] ACC-006: the drafted upstream bug report has been filed as a real GitHub issue against `anomalyco/opencode`, its URL recorded in this feature's Related PRs / Commits. Filed later, in a follow-up
- [anomalyco/opencode#47740](https://github.com/anomalyco/opencode/issues/47740): the upstream bug report (ACC-006), filed in a later session after this feature's own closeout.
The specmgr MCP server currently bundles Confluence-specific tools (`confluence_fetch`, `confluence_update`) and their prompts inside the cross-cutting `general/` package, added by feat-50-confluence
I've verified `_doc_paths.py` — it's completely generic (`doc_base_dir("rsk")` → `{SPECMGR_DOCS_DIR or docs}/rsk`), so **no base directory / environment variable tasks are needed**. And feat-10's gitImplemented Tasks 1a.1-1a.6 (REQ-013 / ACC-015 / ACC-016): (1) a new shared, non-raising `ParseFailureResult` model (`general/models/parse_failure_result.py`, fields `error`/`path`/`id`) mirroring `In
docs/api/biz.dfch.specmgr.dec.models.v1.body.md
docs/api/biz.dfch.specmgr.feat.models.v1.body.md
docs/api/biz.dfch.specmgr.sop.models.v1.body.md
docs/api/biz.dfch.specmgr.sysrs.models.v1.body.md
docs/api/biz.dfch.specmgr.uc.models.v2.use_case.md
- [x] Task 100.100: Complete the black-box API investigation of tekom.termtechnologies.com (read-only, with the public `tekom_EN` demo credentials) and document findings in `findings.md`.
(read-only, with the public `tekom_EN` demo credentials); findings written
"command": "sed -n 55:115p src/biz/dfch/specmgr/general/tools/_doc_paths.py 2>/dev/null || sed -n '55,115p' src/biz/dfch/specmgr/general/tools/_doc_paths.py; echo ===; grep -m1 \"^# \" .specmgr/feat/f
- `tests/conftest.py` (new file — none exists today): load the gitignored root `.env` mirroring `cli.py:_load_default_dotenv`'s **dual** lookup (upward from the conftest file's location, then from CWD
GitHub issue #208: multiple parts of the program read `SPECMGR_*` environment variables directly (12 at planning time), which has repeatedly led to documentation errors and gaps (the root `README.md`'
Gates applied: no_behavioural_pass.
608652a26edafull audit observations/trust-audit/mcp-server/dfch__biz.dfch.specmgr.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 608652a26eda | BLOCK | D | 69 | first audit |
Questions
What is the biz.dfch.SpecMgr MCP server?
An ISO 29148 based artifact manager for system specifications.
What tools does biz.dfch.SpecMgr expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is biz.dfch.SpecMgr safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does biz.dfch.SpecMgr need?
No credential environment variables were found in its source, so it appears to need none.
How does biz.dfch.SpecMgr run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as biz-dfch-specmgr.
How current is this page?
The grade is for one exact copy of the source (608652a26eda), read on 2026-10-11. The repository is watched and re-audited when it changes.