Spec Workflow

Name: Spec Workflow
Author: pimzino

CAUTIONgrade B · trust 83/100

A Model Context Protocol (MCP) server that provides structured spec-driven development workflow tools for AI-assisted software development, featuring a real-time web dashboard and VSCode extension for monitoring and managing your project's progress directly in your development environment.

Overview

From the repository's own README, as read at the audited commit.

# Spec Workflow MCP*I HAVE TAKEN A SMALL BREAK FROM THIS REPO FOR PERSONAL REASONS BUT I WILL BE BACK WITH SOME UPDATES IN THE NEAR FUTURE**THANK YOU FOR YOUR UNDERSTANDING*[![npm version](https://img.shields.io/npm/v/@pimzino/spec-workflow-mcp)](https://www.npmjs.com/package/@pimzino/spec-workflow-mcp)[![VSCode Extension](https://vsmarketplacebadges.dev/version-short/Pimzino.spec-workflow-mcp.svg)](https://marketplace.visualstudio.com/items?itemName=Pimzino.spec-workflow-mcp)A Model Context Protocol (MCP) server for structured spec-driven development with real-time dashboard and VSCode extension.## ☕ Support This Project<a href="https://buymeacoffee.com/Pimzino" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>## 📺 Showcase### 🔄 Approval System in Action<a href="https://www.youtube.com/watch?v=C-uEa3mfxd0" target="_blank">  <img src="https://img.youtube.com/vi/C-uEa3mfxd0/maxresdefault.jpg" alt="Approval System Demo" width="600"></a>*See how the approval system works: create documents, request approval through the dashboard, provide feedback, and track revisions.*### 📊 Dashboard & Spec Management<a href="https://www.youtube.com/watch?v=g9qfvjLUWf8" target="_blank">  <img src="https://img.youtube.com/vi/g9qfvjLUWf8/maxresdefault.jpg" alt="Dashboard Demo" width="600"></a>*Explore the real-time dashboard: view specs, track progress, navigate documents, and monitor your development workflow.*## ✨ Key Features- **Structured Development Workflow** - Sequential spec creation (Requirements → Design → Tasks)- **Real-Time Web Dashboard** - Monitor specs, tasks, and progress with live updates- **VSCode Extension** - Integrated sidebar dashboard for VSCode users- **Approval Workflow** - Complete approval process with revisions- **Task Progress Tracking** - Visual progress bars and detailed status- **Implementation Logs** - Searchable logs of all task impleme

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add spec-workflow-mcp -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "spec-workflow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (16) 13 read · 3 write · 0 destructive

Tool	Risk	Description
`approvals`	read	Manage approval requests through the dashboard interface.# InstructionsUse this tool to request, check status, or delete approval requests. The action parameter determines the operation:-
`changes`	read	Description of what changed in requirements or design
`create-spec`	write	Guide for creating spec documents directly in the file system. Shows how to use templates and create requirements, design, or tasks documents at the correct paths.
`create-steering-doc`	write	Guide for creating project steering documents (product, tech, structure) directly in the file system. These provide high-level project guidance.
`description`	read	Brief description of what this spec should accomplish
`detailed`	read	Show detailed status including task breakdown and approval history
`docType`	read	Type of steering document: product, tech, or structure
`documentType`	write	Type of document to create: requirements, design, or tasks
`implement-task`	read	Guide for implementing a specific task from the tasks.md document. Provides comprehensive instructions for task execution, including reading _Prompt fields, marking progress, completion criteria, and logging implementation details for the dashboard.
`inject-spec-workflow-guide`	read	Injects the complete spec-driven development workflow guide into the conversation context. This provides immediate access to all workflow phases, tools, and best practices without requiring separate tool calls.
`inject-steering-guide`	read	Injects the complete steering document workflow guide into the conversation context. This provides instructions for creating project-level guidance documents (product.md, tech.md, structure.md) when explicitly requested by the user.
`refresh-tasks`	read	Comprehensive guide for updating tasks.md when requirements or design change during implementation. Preserves completed work while aligning pending tasks with current spec.
`scope`	read	Scope of the steering document (e.g., frontend, backend, full-stack)
`spec-status`	read	Get comprehensive status overview of specification documents, tasks, and approval workflows. Useful for project tracking and progress reporting.
`specName`	read	Feature name in kebab-case (e.g., user-authentication, data-export)
`taskId`	read	Specific task ID to implement (e.g.,

Details

Source: pimzino/spec-workflow-mcp
npm: spec-workflow-mcp@1.1.7
Transports: stdio
License: GPL-3.0
Stars: 4,289 · pushed 72d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (6 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (20)

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode-extension/webview-assets/sounds/approval-pending.wav

approval-pending.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode-extension/webview-assets/sounds/task-completed.wav

task-completed.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode-extension/webview-dist/sounds/approval-pending.wav

approval-pending.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode-extension/webview-dist/sounds/task-completed.wav

task-completed.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

playwright.worktree.config.ts:21

baseURL: `http://127.0.0.1:${FRONTEND_PORT}`,

LOWInventory / provenance · inv.hidden_file · CWE-1104

vscode-extension/.vscode-test.mjs

.vscode-test.mjs

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

vscode-extension/.vscodeignore

.vscodeignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/core/project-registry.ts:30

const hash = createHash('sha1').update(absolutePath).digest('base64url');