SpeclockBLOCK
mcp/sgroy10/speclock
Action guardrails for AI coding agents — native Claude Code enforcement, MCP integrations, and Git/CI checks.
Verdict
BLOCK
Grade
F
Trust score
55 /100
Exposed tools
57 37r · 18w · 2d
Transport
stdio · streamable-http
License
MIT
Stars
25
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Rules files tell AI what not to change.SpecLock enforces them.
Stop Claude Code, Cursor, Codex, Windsurf, and other AI coding tools from crossing project constraints you already wrote in CLAUDE.md, AGENTS.md, and .cursorrules.
Install · See a block · Claude Code plugin · Website · Saves Wall
Why another rules tool? Rules files are context. They can be forgotten, diluted, or overridden during a long coding session. SpecLock turns those rules into checks that run before edits, shell commands, and commits.
See the difference
CLAUDE.md: Never
Read from source at commit
6fabfaae7c4bOBSERVED · 2026-10-09Advertisement
02
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (npm)
claude mcp add speclock -- npx -y [email protected]
03
Exposed tools (57)
37 read · 18 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
admin | read | Full access including auth management and enforcement config |
architect | write | Read + write locks, decisions, goals, notes |
developer | read | Read access + can override locks with reason |
speclock_add_decision | write | Record an architectural or design decision. |
speclock_add_lock | write | Add a non-negotiable constraint (SpecLock). |
speclock_add_note | write | Add a pinned note for reference. |
speclock_add_typed_lock | write | Add a typed constraint for autonomous systems governance. |
speclock_apply_template | write | Apply a pre-built constraint template (nextjs, react, express, supabase, stripe, security-hardened). |
speclock_audit | read | Audit staged files against active locks. |
speclock_auto_guard | read | Auto-guard files related to lock keywords. |
speclock_blast_radius | read | Calculate blast radius — transitive dependents, impact %, depth. |
speclock_build_graph | read | Build/refresh code dependency graph from imports (JS/TS/Python). |
speclock_check_conflict | read | Check if a proposed action conflicts with any active SpecLock. Uses fast heuristic + Gemini LLM for universal domain coverage. In hard enforcement mode, conflicts above the threshold will BLOCK the action. |
speclock_check_typed | read | Check a proposed value or state transition against typed constraints. |
speclock_checkpoint | write | Create a named git tag checkpoint for easy rollback. |
speclock_compile_spec | read | Compile natural language (PRDs, READMEs) into structured constraints via Gemini Flash. |
speclock_coverage | read | Lock Coverage Audit — scans the codebase for high-risk patterns (auth, payments, database, secrets, API routes, security, error handling, logging) and identifies areas with no lock protecting them. Auto-suggests the missing locks you need. Like a security scanner but for AI constraint gaps. |
speclock_detect_drift | read | Scan recent changes for constraint violations. |
speclock_discover_rules | read | Discover all AI rule files in the project (.cursorrules, CLAUDE.md, AGENTS.md, copilot-instructions.md, .windsurfrules, GEMINI.md, .aider.conf.yml). Shows which tools have rules configured and their sizes. Use this to see what rules exist before running speclock_protect. |
speclock_drift_score | read | Compute a 0-100 Drift Score measuring how much the project has drifted from the founder |
speclock_export_compliance | read | Generate compliance reports (SOC 2, HIPAA, CSV). |
speclock_get_changes | read | Get recent file changes tracked by SpecLock. |
speclock_get_context | read | THE KEY TOOL. Returns the full structured context pack. |
speclock_get_events | read | Get the event log, optionally filtered by type. |
speclock_guard_file | write | Add SPECLOCK-GUARD header to lock specific files. |
speclock_health | read | Health check with completeness score and multi-agent timeline. |
speclock_init | read | Initialize SpecLock in the current project directory. |
speclock_list_sessions | read | List available sessions for replay. Shows session IDs, tools used, timestamps, and event counts. |
speclock_list_sync_formats | write | List all available AI tool formats that SpecLock can sync constraints to. Shows format key, tool name, output file path, and description. |
speclock_list_typed_locks | read | List all typed constraints. |
speclock_log_change | read | Manually log a significant change. |
speclock_map_locks | read | Map active locks to actual code files via the dependency graph. |
speclock_override_history | read | Show lock override history. |
speclock_override_lock | read | Override a lock with justification. Logged to audit trail. |
speclock_parse_diff | read | Parse unified diff into structured changes — imports, exports, symbols, routes, schema detection. |
speclock_policy_evaluate | read | Evaluate policy-as-code rules against proposed actions. |
speclock_policy_manage | destructive | Policy CRUD: list, add, remove policy rules. |
speclock_protect | read | Zero-config Guardian Mode — Reads existing AI rule files (.cursorrules, CLAUDE.md, AGENTS.md, copilot-instructions.md, etc.), auto-extracts enforceable constraints, installs pre-commit hook, and syncs rules to all AI tools. One command, no flags. Makes your AI rules unbreakable. |
speclock_remove_lock | destructive | Remove (deactivate) a SpecLock by its ID. |
speclock_replay | read | Replay a session |
speclock_repo_status | read | Get current git repository status. |
speclock_report | read | Violation report — how many times SpecLock blocked changes. |
speclock_review_patch | write | ALLOW/WARN/BLOCK verdict — combines semantic conflict + lock-file mapping + blast radius. |
speclock_review_patch_diff | write | Diff-native review — parses actual diffs for interface breaks, protected symbols, dependency drift, schema changes. |
speclock_semantic_audit | write | Semantic pre-commit: analyzes code changes vs locks. |
speclock_session_briefing | write | Start a new session and get a full briefing. |
speclock_session_summary | read | End the current session and record what was accomplished. |
speclock_set_deploy_facts | write | Record deployment configuration facts. |
speclock_set_enforcement | write | Set enforcement mode: advisory (warn) or hard (block). |
speclock_set_goal | write | Set or update the project goal. |
speclock_strengthen | read | Lock Strengthener — grades each lock |
speclock_suggest_locks | read | AI-powered lock suggestions based on project patterns. |
speclock_sync_rules | write | Sync SpecLock constraints to AI tool rules files. Generates .cursorrules, CLAUDE.md, AGENTS.md, .windsurfrules, copilot-instructions.md, GEMINI.md, and .aider.conf.yml from your SpecLock constraints. One source of truth for all AI tools. Use --format for a specific tool, or sync all at once. |
speclock_telemetry | read | Opt-in usage analytics summary. |
speclock_update_threshold | write | Update a typed lock threshold. |
speclock_verify_audit | read | Verify the integrity of the HMAC audit chain. |
viewer | read | Read-only access to context, events, and status |
04
Trust audit
BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (9 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vscode-extension/extension.js:227
exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vscode-extension/extension.js:282
exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vscode-extension/extension.js:315
exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vscode-extension/extension.js:344
exec(cmd, { cwd: root, timeout: 30000 }, (err, stdout, stderr) => {Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
README.md:259
<tr><td>Safety system bypass</td><td>100%</td><td>"Disable safety interlock" = bypass safety</td></tr>
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMInventory / provenance · inv.binary · CWE-1104
vscode-extension/speclock-0.1.0.vsix
speclock-0.1.0.vsix
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
src/core/semantics.js:380
"exfiltrate": ["extract", "steal", "expose", "leak"],
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
speclock_policy_manage, speclock_remove_lock
Why it matters. 2 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.aider.conf.yml
.aider.conf.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
vscode-extension/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/guardian.test.js:187
const content = "- NEVER use eval()\n* ALWAYS escape HTML output\n• MUST sanitize inputs";
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, chokidar, zod, esbuild, jest
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
vscode-extension/package.json
@types/vscode
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
syndication-channels.md:355
- **dev.to API key:** https://dev.to/settings/extensions — then I can republish all 5 new HTML posts with canonical URLs via POST /api/articles.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
syndication-channels.md:357
- **Reddit script-app creds** (`client_id`, `client_secret`, `username`, `password`): https://www.reddit.com/prefs/apps → create "script" app — then I can autonomously submit to r/mcp, r/ClaudeAI, r/c
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
<tool:admin>:1
Full access including auth management and enforcement config
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
src/templates/rule-packs/fastapi.md:9
- NEVER expose database connection strings, API keys, or secrets in code — load them from environment variables or a secrets manager.
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
src/templates/rule-packs/nextjs.md:17
- NEVER hardcode database URLs, connection strings, or secrets in source files — read from `process.env`.
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
src/templates/rule-packs/python.md:11
- NEVER hardcode secrets, API keys, or passwords in source files — read from environment variables or a secrets manager.
Why it matters. asks the agent to read credentials
Gates applied: instruction_override, no_behavioural_pass.
Audited 2026-10-09 · audit v0.4.1 · source sha
6fabfaae7c4bfull audit observations/trust-audit/mcp-server/sgroy10__speclock.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 6fabfaae7c4b | BLOCK | F | 55 | first audit |
06
Questions
What is the Speclock MCP server?
Action guardrails for AI coding agents — native Claude Code enforcement, MCP integrations, and Git/CI checks.
What tools does Speclock expose?
57 in total: 37 read-only, 18 that write, and 2 that can delete or overwrite (speclock_policy_manage, speclock_remove_lock). Every one is listed on this page with its risk.
Is Speclock safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (55/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Speclock need?
It reads ANTHROPIC_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY, SPECLOCK_API_KEY, SPECLOCK_AUDIT_SECRET, SPECLOCK_ENCRYPTION_KEY, SPECLOCK_LICENSE_KEY, SPECLOCK_LLM_KEY, SPECLOCK_SSO_CLIENT_SECRET and STRIPE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Speclock run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as speclock at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (6fabfaae7c4b), read on 2026-10-09. The repository is watched and re-audited when it changes.