MCP server · Audited from source

Spec Workflow MCP server

by pimzino/spec-workflow-mcpGPL-3.0 licenceAudited 21 Sep 2026 · source 98efb0d29260

npm spec-workflow-mcp 1.1.7stdio★ 4,293

!CAUTIONGrade B · 83/100 · 21 Sep 2026 · 98efb0d

4,293GitHub stars

Is it safe? With care — CAUTION, grade B (83/100). It exposes 16 tools: 13 read, 3 write and 0 destructive. The audit recorded 20 findings (0 critical, 0 high, 5 medium, 15 low). Maintainer's description: A Model Context Protocol (MCP) server that provides structured spec-driven development workflow tools for AI-assisted software development, featuring a real-time web dashboard and VSCode extension for monitoring and managing your project's progress directly in your development environment.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Spec Workflow MCP server (pimzino/spec-workflow-mcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/pimzino/spec-workflow-1

2 MCP servers are called Spec Workflow. This is the one we pick. Compare all 2 →

pimzino/spec-workflow-mcp★ 4,293!CAUTION
kingkongshot/specs-workflow-mcp★ 127✕BLOCK

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score83/100!CAUTION B

0 critical0 high5 medium15 low0 info

20 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared6 observations
ShellDeclared3 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	WARN 6 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 13 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 1 finding
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner pimzinoUser accountAccount type recorded when we read the repository.
PackagePublished on npmspec-workflow-mcp at version 1.1.7
LicenceGPL-3.0From the repository, as read at the audited commit.
Last push3 months agoActivity of the repository when we read it.
Source commit read98efb0d29260The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory16 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (20)

Sorted by severity

MEDIUMInventory / provenanceinv.binary · vscode-extension/webview-assets/sounds/approval-pending.wav

F-13 Inventory / provenanceCWE-1104Layer L0

approval-pending.wav

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · vscode-extension/webview-assets/sounds/task-completed.wav

F-13 Inventory / provenanceCWE-1104Layer L0

task-completed.wav

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · vscode-extension/webview-dist/sounds/approval-pending.wav

F-13 Inventory / provenanceCWE-1104Layer L0

approval-pending.wav

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · vscode-extension/webview-dist/sounds/task-completed.wav

F-13 Inventory / provenanceCWE-1104Layer L0

task-completed.wav

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMNetwork egressnet.raw_ip · playwright.worktree.config.ts:21

F-04 Network egressCWE-200 · CWE-319Layer L1

baseURL: `http://127.0.0.1:${FRONTEND_PORT}`,

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · vscode-extension/.vscode-test.mjs

F-13 Inventory / provenanceCWE-1104Layer L0

.vscode-test.mjs

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · vscode-extension/.vscodeignore

F-13 Inventory / provenanceCWE-1104Layer L0

.vscodeignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInsecure cryptocrypto.weak_hash · src/core/project-registry.ts:30

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

const hash = createHash('sha1').update(absolutePath).digest('base64url');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/core/__tests__/git-utils.test.ts:115

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

mockedExecSync.mockReturnValue('../../.git');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/core/__tests__/git-utils.test.ts:124

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

mockedExecSync.mockReturnValue('../../../.git');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/core/__tests__/security-utils.test.ts:17

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { SecurityConfig } from '../../types.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/dashboard/__tests__/approval-storage-path-resolution.test.ts:84

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

storage.createApproval('Review', '../../../etc/passwd', 'spec', 'test-spec')

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/dashboard/__tests__/approval-storage-path-resolution.test.ts:90

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

storage.createApproval('Review', 'src/../../etc/passwd', 'spec', 'test-spec')

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:304

F-04 Network egressCWE-200 · CWE-319Layer L1

proxy_pass http://127.0.0.1:5000;

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · containers/README.md:376

F-04 Network egressCWE-200 · CWE-319Layer L1

proxy_pass http://127.0.0.1:5000;

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · containers/README.md:387

F-04 Network egressCWE-200 · CWE-319Layer L1

--upstream=http://127.0.0.1:5000 \

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · e2e/worktree-no-shared.spec.ts:5

F-04 Network egressCWE-200 · CWE-319Layer L1

const DASHBOARD_API_BASE_URL = 'http://127.0.0.1:5084';

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@dnd-kit/core, @dnd-kit/sortable, @dnd-kit/utilities, @fastify/cors, @fastify/static, @fastify/websocket, @heroicons/react, @mdx-js/mdx

Why: 52 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · vscode-extension/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@jaames/iro, @radix-ui/react-accordion, @radix-ui/react-dropdown-menu, @radix-ui/react-progress, @radix-ui/react-select, @radix-ui/react-separator, @radix-ui/react-slot, @radix-ui/react-tabs

Why: 37 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.credential_read · README.md:316

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

For sandboxed environments (e.g., Codex CLI with `sandbox_mode=workspace-write`) where `$HOME` is read-only, use the `SPEC_WORKFLOW_HOME` environment variable to redirect global state files to a writa

Why: asks the agent to read credentials
Fix: —

Tools it exposes

16 declared in source · 0 destructive

13 read3 write0 destructive

Tool	Risk	What it does
`create-spec`	write	Guide for creating spec documents directly in the file system. Shows how to use templates and create requirements, design, or tasks documents at the correct paths.
`create-steering-doc`	write	Guide for creating project steering documents (product, tech, structure) directly in the file system. These provide high-level project guidance.
`documentType`	write	Type of document to create: requirements, design, or tasks
`approvals`	read	Manage approval requests through the dashboard interface. # Instructions Use this tool to request, check status, or delete approval requests. The action parameter determines the operation: -
`changes`	read	Description of what changed in requirements or design
`description`	read	Brief description of what this spec should accomplish
`detailed`	read	Show detailed status including task breakdown and approval history
`docType`	read	Type of steering document: product, tech, or structure
`implement-task`	read	Guide for implementing a specific task from the tasks.md document. Provides comprehensive instructions for task execution, including reading _Prompt fields, marking progress, completion criteria, and logging implementation details for the dashboard.
`inject-spec-workflow-guide`	read	Injects the complete spec-driven development workflow guide into the conversation context. This provides immediate access to all workflow phases, tools, and best practices without requiring separate tool calls.
`inject-steering-guide`	read	Injects the complete steering document workflow guide into the conversation context. This provides instructions for creating project-level guidance documents (product.md, tech.md, structure.md) when explicitly requested by the user.
`refresh-tasks`	read	Comprehensive guide for updating tasks.md when requirements or design change during implementation. Preserves completed work while aligning pending tasks with current spec.
`scope`	read	Scope of the steering document (e.g., frontend, backend, full-stack)
`spec-status`	read	Get comprehensive status overview of specification documents, tasks, and approval workflows. Useful for project tracking and progress reporting.
`specName`	read	Feature name in kebab-case (e.g., user-authentication, data-export)
`taskId`	read	Specific task ID to implement (e.g.,

Install

Package version 1.1.7 · audited commit 98efb0d

Read the findings first. The most severe is Inventory / provenance (medium) at vscode-extension/webview-assets/sounds/approval-pending.wav.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 1.1.7. The audit covers commit 98efb0d only.

claude mcp add spec-workflow-mcp -- npx -y [email protected]

{
  "mcpServers": {
    "spec-workflow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

The command pins the package version recorded in the source (1.1.7); the audit covers commit 98efb0d29260. Transport: stdio. No environment variables required.

Audit history

2026-09-21
!CAUTION B 83 / 100
Source changed, verdict held · 98efb0d29260

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/pimzino/spec-workflow-1/badge.svg)](https://modelsatlas.com/mcp/pimzino/spec-workflow-1/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Spec Workflow MCP server

What is the Spec Workflow MCP server?

A Model Context Protocol (MCP) server that provides structured spec-driven development workflow tools for AI-assisted software development, featuring a real-time web dashboard and VSCode extension for monitoring and managing your project's progress directly in your development environment.

What tools does Spec Workflow expose?

16 in total: 13 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Spec Workflow safe to connect to an agent?

With care. The audit graded it B (83/100) and found 20 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Spec Workflow need?

No credential environment variables were found in its source, so it appears to need none.

How does Spec Workflow run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as spec-workflow-mcp at 1.1.7.

How current is this page?

The grade is for one exact copy of the source (98efb0d29260), read on 2026-09-21. The repository is watched and re-audited when it changes.

Which Spec Workflow MCP server is the right one?

pimzino/spec-workflow-mcp (this page). 2 servers share the name; see the side-by-side comparison.

Sources

pimzino/spec-workflow-mcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 98efb0d29260Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Spec Workflow MCP server?
GChatGPT CClaude PPerplexity
What tools does Spec Workflow expose?
GChatGPT CClaude PPerplexity
Is Spec Workflow safe to connect to an agent?
GChatGPT CClaude PPerplexity