MCP.Market

Speclock MCP server

by sgroy10·io.github.sgroy10/speclock·v5.5.3·25 stars
No reviews yet

AI Constraint Engine — enforces CLAUDE.md and .cursorrules as laws. 51 MCP tools.

C69/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C69/100

full report

Adoption
Growing

25 stars227 downloads/wk

Reviews

Write one

Nobody has reviewed Speclock yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Speclock tools (53, 6 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • speclock_add_decision

    Record an architectural or design decision.

  • speclock_add_lock

    Add a non-negotiable constraint (SpecLock).

  • speclock_add_note

    Add a pinned note for reference.

  • speclock_add_typed_lock

    Add a typed constraint for autonomous systems governance.

  • speclock_apply_template

    Apply a pre-built constraint template (nextjs, react, express, supabase, stripe, security-hardened).

  • speclock_audit

    Audit staged files against active locks.

  • speclock_auto_guard

    Auto-guard files related to lock keywords.

  • speclock_blast_radius

    Calculate blast radius — transitive dependents, impact %, depth.

  • speclock_build_graph

    Build/refresh code dependency graph from imports (JS/TS/Python).

  • speclock_check_conflict

    Check if a proposed action conflicts with any active SpecLock. Uses fast heuristic + Gemini LLM for universal domain coverage. In hard enforcement mode, conflicts above the threshold will BLOCK the action.

  • speclock_check_typed

    Check a proposed value or state transition against typed constraints.

  • speclock_checkpointwrite action

    Create a named git tag checkpoint for easy rollback.

  • speclock_compile_spec

    Compile natural language (PRDs, READMEs) into structured constraints via Gemini Flash.

  • speclock_coverage

    Lock Coverage Audit — scans the codebase for high-risk patterns (auth, payments, database, secrets, API routes, security, error handling, logging) and identifies areas with no lock protecting them. Auto-suggests the missing locks you need. Like a security scanner but for AI constraint gaps.

  • speclock_detect_drift

    Scan recent changes for constraint violations.

  • speclock_discover_rules

    Discover all AI rule files in the project (.cursorrules, CLAUDE.md, AGENTS.md, copilot-instructions.md, .windsurfrules, GEMINI.md, .aider.conf.yml). Shows which tools have rules configured and their sizes. Use this to see what rules exist before running speclock_protect.

  • speclock_drift_score

    Compute a 0-100 Drift Score measuring how much the project has drifted from the founder's original intent. Analyzes violations, overrides, reverts, lock churn, goal stability, and session gaps. Returns score, grade, trend, signal breakdown, and per-session impact. Only SpecLock can compute this because only SpecLock knows what was INTENDED vs what was DONE.

  • speclock_export_compliance

    Generate compliance reports (SOC 2, HIPAA, CSV).

  • speclock_get_changes

    Get recent file changes tracked by SpecLock.

  • speclock_get_context

    THE KEY TOOL. Returns the full structured context pack.

  • speclock_get_events

    Get the event log, optionally filtered by type.

  • speclock_guard_file

    Add SPECLOCK-GUARD header to lock specific files.

  • speclock_health

    Health check with completeness score and multi-agent timeline.

  • speclock_init

    Initialize SpecLock in the current project directory.

  • speclock_list_sessions

    List available sessions for replay. Shows session IDs, tools used, timestamps, and event counts.

  • speclock_list_sync_formats

    List all available AI tool formats that SpecLock can sync constraints to. Shows format key, tool name, output file path, and description.

  • speclock_list_typed_locks

    List all typed constraints.

  • speclock_log_change

    Manually log a significant change.

  • speclock_map_locks

    Map active locks to actual code files via the dependency graph.

  • speclock_override_history

    Show lock override history.

  • speclock_override_lock

    Override a lock with justification. Logged to audit trail.

  • speclock_parse_diff

    Parse unified diff into structured changes — imports, exports, symbols, routes, schema detection.

  • speclock_policy_evaluate

    Evaluate policy-as-code rules against proposed actions.

  • speclock_policy_manage

    Policy CRUD: list, add, remove policy rules.

  • speclock_protect

    Zero-config Guardian Mode — Reads existing AI rule files (.cursorrules, CLAUDE.md, AGENTS.md, copilot-instructions.md, etc.), auto-extracts enforceable constraints, installs pre-commit hook, and syncs rules to all AI tools. One command, no flags. Makes your AI rules unbreakable.

  • speclock_remove_lockwrite action

    Remove (deactivate) a SpecLock by its ID.

  • speclock_replay

    Replay a session's activity log — shows exactly what AI agents tried and what SpecLock caught. Returns chronological event list with ALLOW/WARN/BLOCK verdicts, changes logged, locks added/removed, and session stats. Like a flight recorder for your AI coding sessions.

  • speclock_repo_status

    Get current git repository status.

  • speclock_report

    Violation report — how many times SpecLock blocked changes.

  • speclock_review_patchwrite action

    ALLOW/WARN/BLOCK verdict — combines semantic conflict + lock-file mapping + blast radius.

  • speclock_review_patch_diffwrite action

    Diff-native review — parses actual diffs for interface breaks, protected symbols, dependency drift, schema changes.

  • speclock_semantic_audit

    Semantic pre-commit: analyzes code changes vs locks.

  • speclock_session_briefing

    Start a new session and get a full briefing.

  • speclock_session_summary

    End the current session and record what was accomplished.

  • speclock_set_deploy_factswrite action

    Record deployment configuration facts.

  • speclock_set_enforcement

    Set enforcement mode: advisory (warn) or hard (block).

  • speclock_set_goal

    Set or update the project goal.

  • speclock_strengthen

    Lock Strengthener — grades each lock's specificity, scope, and detection power (0-100). Identifies weak locks and suggests stronger versions that catch more violations. Checks for: vagueness, missing enforcement verbs, no scope, no consequence, ambiguous language, missing euphemism guards.

  • speclock_suggest_locks

    AI-powered lock suggestions based on project patterns.

  • speclock_sync_rules

    Sync SpecLock constraints to AI tool rules files. Generates .cursorrules, CLAUDE.md, AGENTS.md, .windsurfrules, copilot-instructions.md, GEMINI.md, and .aider.conf.yml from your SpecLock constraints. One source of truth for all AI tools. Use --format for a specific tool, or sync all at once.

  • speclock_telemetry

    Opt-in usage analytics summary.

  • speclock_update_thresholdwrite action

    Update a typed lock threshold.

  • speclock_verify_audit

    Verify the integrity of the HMAC audit chain.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan41 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 41 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    src/cli/index.js: …`, { cwd: root, stdio: "pipe" }); execSync(`git commit -m "v${newVersion}"`, { cwd: root, stdio: "pipe…
Overall 69/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Speclock compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
69/100
higher than 33% of 48,255 servers
Tools
53
the typical server has 7
Tools that change things
11%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
25
more than 91% of 28,688 servers
Downloads a week
227
more than 77% of 12,191 servers with a package

What its tools let an agent do: 47 read · 6 change

Install Speclock in Claude Code, Cursor or VS Code

Runs npx -y speclock on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add speclock -- npx -y speclock
Add to Cursor

What the publisher says

From the Speclock repository's README, as published. We do not edit it. Read it on GitHub

Rules files tell AI what not to change.SpecLock enforces them.

Stop Claude Code, Cursor, Codex, Windsurf, and other AI coding tools from crossing project constraints you already wrote in CLAUDE.md, AGENTS.md, and .cursorrules.

Install · See a block · Claude Code plugin · Website · Saves Wall

Why another rules tool? Rules files are context. They can be forgotten, diluted, or overridden during a long coding session. SpecLock turns those rules into checks that run before edits, shell commands, and commits.

See the difference

CLAUDE.md:  Never modify the authentication system.

You:        Add social login to the login page.

Without SpecLock
Claude:     I'll update the auth flow and add an OAuth provider...

With SpecLock (strict mode)
SpecLock:   BLOCKED — conflicts with "Never modify the authentication system"
            Match: login → auth → authentication
            The action was denied before the files changed.

SpecLock uses semantic conflict detection rather than simple keyword matching. It catches indirect actions such as “clean up old patient data,” “streamline checkout,” or “temporarily disable MFA” when they violate an active constraint.

60-second setup

Run this from the project you want to protect:

npx speclock@latest protect          # reads existing AI rule files; advisory by default
npx speclock@latest doctor           # confirms rules, hooks, and integration

When the advisory output looks right, enable blocking:

npx speclock@latest protect --strict

No account is required. SpecLock runs locally by default, and advisory mode never blocks a change.

Install as a Claude Code plugin

Inside Claude Code, run:

/plugin marketplace add sgroy10/speclock
/plugin install speclock@speclock-marketplace

Then protect the current project once:

npx speclock@latest protect          # warnings only
npx speclock@latest protect --strict # block confirmed conflicts

The plugin automatically starts SpecLock's MCP server and checks Claude Code Write, Edit, and Bash actions before execution. It includes all 51 MCP tools and works alongside your existing CLAUDE.md.

Install on other coding agents

SpecLock is packaged for multiple agent ecosystems, but the enforcement level depends on what each host exposes:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Speclock: common questions

Is Speclock MCP server safe?
With care: it is graded C, so read the findings first (69/100). Read the Speclock safety report
How do I install Speclock?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Speclock need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Speclock maintained?
The last commit was 78 days ago (2026-08-18). The latest release is v5.5.3.
How does Speclock compare with other MCP servers?
safety score 69/100 (higher than 33% of 48,255 servers); tools 53 (the typical server has 7); tools that change things 11% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.