SpecPilot
Generate and validate a .specs/ bundle for your repo, then hand it to your AI coding agent
사용해야 할까요
품질 및 안전성
발견 사항 (3)
- HIGH
- MEDIUMspecpilot_next_questions에서
- INFOspecpilot_next_questions에서
도구 정의와 프로토콜 준수에 대한 자동 분석을 기반으로 합니다.
컨텍스트 비용
이는 서버의 도구가 모델의 컨텍스트에 로드될 때마다 소비되는 대략적인 토큰 수입니다. 수치가 높을수록 다른 작업에 사용할 수 있는 주의가 줄어듭니다.
설치
원클릭 설치
`claude_desktop_config.json` 파일에 다음을 추가하세요:
{
"mcpServers": {
"specpilot": {
"url": "https://init.specpilot.dev/mcp"
}
}
}원격 엔드포인트
https://init.specpilot.dev/mcpstreamable-http할 수 있는 일
도구 목록
도구 (2)
🟡specpilot_next_questions(answers)
Returns the still-unanswered SpecPilot onboarding questions of the next incomplete step, gated by the answers supplied so far - questions that do not apply to this kind of project are omitted, and options are filtered, badged or flagged the same way the SpecPilot web chat would. Stateless: send every answer collected so far on each call. Procedure: (1) Decide whether the repository already has real source code and set `isNewBuild` accordingly - it changes which onboarding analysis is generated at the end. (2) Infer what the repo already answers rather than asking: `platforms` from the dependency manifests and layout, `languageOverride`, `ideAgent` (you are the IDE - claudecode, cursor, copilot, codex, windsurf), `handle` from git config or the origin remote, `projectName` from the package manifest or folder name, and `projectDescription` from the README only if it plainly says what the project is. (3) Call this tool with what you have; answer what the repo makes obvious and ask the developer the rest, a whole step per message. Send an empty value for an optional question the developer declines, or it will be asked again; send `todoSentinel` verbatim when they do not know yet. For `projectDescription`, sending one of the returned chip labels exactly is what infers `projectCategory` and gates every later question - free prose infers nothing. Confirm any pre-seeded value rather than accepting it silently. (4) Loop until `done` is true, then call specpilot_generate_specs and follow its `nextSteps` for where each file goes.
입력 스키마
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"properties": {
"projectCategory": {
"description": "Project archetype. Normally inferred from projectDescription when it exactly matches a returned chip label - send it only if you already know it.",
"anyOf": [
{
"type": "string",
"enum": [
"saas",
"api",
"mobile",
"cli",
"pipeline",
"ml",
"static",
"docs",
"extension",
"library",
"other"
]
},
{
"type": "null"
}
]
},
"projectName": {
"description": "Short name for the project. Required by specpilot_generate_specs. Infer from the package manifest or the folder name.",
"type": "string"
},
"projectDescription": {
"description": "One line saying what the project is. Required by specpilot_generate_specs. Sending one of the chip labels returned by specpilot_next_questions verbatim is what infers projectCategory and gates every later question; free prose infers nothing.",
"type": "string"
},
"isNewBuild": {
"description": "True for a greenfield project, false when adding onto an existing codebase. Decides which onboarding analysis is generated at the end.",
"type": "boolean"
},
"handle": {
"description": "The developer GitHub handle. Optional; it namespaces generated task IDs (e.g. CD-jsmith-001). Infer from git config or the origin remote.",
"type": "string"
},
"platforms": {
"description": "Platforms this should run on, e.g. web, ios, android, desktop. Infer from the dependency manifests and repo layout.",
"type": "array",
"items": {
"type": "string"
}
},
"ideAgent": {
"description": "The editor or AI IDE in use - claudecode, cursor, copilot, codex, windsurf. You are the IDE, so set this yourself; it decides which rules and config files are generated.",
"type": "string"
},
"languageOverride": {
"description": "Primary language, when it should override what SpecPilot infers from the repo.",
"type": "string"
},
"userTypes": {
"description": "Who is going to use this system, e.g. end users, admins, internal staff.",
"type": "array",
"items": {
"type": "string"
}
},
"customUserType": {
"description": "A user type in free text, when none of the userTypes options fit.",
"type": "string"
},
"accessControl": {
"description": "The access control model. Drives the security spec auth/authorization section and the permission model.",
"type": "string"
},
"specialConsiderations": {
"description": "Cross-cutting concerns that apply, such as accessibility, internationalisation or offline support.",
"type": "array",
"items": {
"type": "string"
}
},
"accessibilityNotes": {
"description": "Anything further on accessibility or constraints, in free text.",
"type": "string"
},
"scaleTier": {
"description": "Expected scale of the system. Drives infrastructure and architecture choices.",
"type": "string"
},
"activeUsers": {
"description": "Roughly how many active users are expected, as a range.",
"type": "string"
},
"deploymentTargets": {
"description": "Where this ships - cloud hosting, a package registry, a browser store. The option list depends on the project type.",
"type": "array",
"items": {
"type": "string"
}
},
"buildTimeline": {
"description": "How long the build is expected to take.",
"type": "string"
},
"teamSize": {
"description": "How many people are building this.",
"type": "string"
},
"systemPattern": {
"description": "Architecture pattern - monolith, modular monolith, or microservices.",
"type": "string"
},
"apiStyle": {
"description": "API style - REST, GraphQL, gRPC or tRPC. Shapes how the architecture spec documents client-server communication.",
"type": "string"
},
"databases": {
"description": "Database kinds in use - SQL, NoSQL, cache/key-value, vector. As many as apply.",
"type": "array",
"items": {
"type": "string"
}
},
"authStrategy": {
"description": "Auth approach - a protocol built in-house (JWT/OAuth/SAML) or a managed service (Clerk, Auth0, Firebase). Feeds the security spec.",
"type": "string"
},
"realtimeEnabled": {
"description": "Whether anything updates live without a refresh. Set automatically when realtimeTypes is non-empty.",
"type": "boolean"
},
"realtimeTypes": {
"description": "Realtime transports - WebSockets, SSE, polling. Leave empty when nothing needs to update live.",
"type": "array",
"items": {
"type": "string"
}
},
"offlineSupport": {
"description": "Whether this has to work offline. Set automatically when localDatabases is non-empty.",
"type": "boolean"
},
"localDatabases": {
"description": "On-device stores backing offline support. Leave empty when offline is not needed.",
"type": "array",
"items": {
"type": "string"
}
},
"dataSyncStrategy": {
"description": "How conflicting local and server state gets reconciled once the device is back online.",
"type": "string"
},
"integrations": {
"description": "Third-party integrations keyed by category, e.g. { payments: [\"stripe\"] }. Only categories relevant to the project type apply.",
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"otherApis": {
"description": "External APIs or services not covered by integrations.",
"type": "string"
},
"nonGoals": {
"description": "What this project explicitly will NOT do. Becomes the non-goals section of the specs.",
"type": "string"
},
"technicalConstraints": {
"description": "Hard constraints - budget, existing infrastructure, legacy systems, a fixed deadline.",
"type": "array",
"items": {
"type": "string"
}
},
"constraintDescription": {
"description": "More detail on whatever was named in technicalConstraints.",
"type": "string"
},
"compliance": {
"description": "Compliance regimes that apply - GDPR, HIPAA, SOC 2. Pick by the actual situation (EU users, health data, payments), since getting it wrong has legal consequences.",
"type": "array",
"items": {
"type": "string"
}
},
"apiResponseTime": {
"description": "Target API response time.",
"type": "string"
},
"availability": {
"description": "Availability SLA target as a fraction of uptime; higher percentages allow far less downtime per year.",
"type": "string"
},
"securityConcerns": {
"description": "Security measures to plan for - encryption, rate limiting, audit logging.",
"type": "array",
"items": {
"type": "string"
}
},
"testingStrategy": {
"description": "Testing approaches this project will use.",
"type": "array",
"items": {
"type": "string"
}
},
"cicd": {
"description": "CI/CD practices - automatically running tests and deploying on every change.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"$schema": "http://json-schema.org/draft-07/schema#"
}🟡specpilot_generate_specs(answers)
Generates the complete SpecPilot .specs/ file set plus the matching IDE rules and slash-command files from a full answer set - identical to what the SpecPilot web chat produces for the same answers. Requires projectName and projectDescription. Returns the files to write and the steps to follow after writing them.
입력 스키마
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"properties": {
"projectCategory": {
"description": "Project archetype. Normally inferred from projectDescription when it exactly matches a returned chip label - send it only if you already know it.",
"anyOf": [
{
"type": "string",
"enum": [
"saas",
"api",
"mobile",
"cli",
"pipeline",
"ml",
"static",
"docs",
"extension",
"library",
"other"
]
},
{
"type": "null"
}
]
},
"projectName": {
"description": "Short name for the project. Required by specpilot_generate_specs. Infer from the package manifest or the folder name.",
"type": "string"
},
"projectDescription": {
"description": "One line saying what the project is. Required by specpilot_generate_specs. Sending one of the chip labels returned by specpilot_next_questions verbatim is what infers projectCategory and gates every later question; free prose infers nothing.",
"type": "string"
},
"isNewBuild": {
"description": "True for a greenfield project, false when adding onto an existing codebase. Decides which onboarding analysis is generated at the end.",
"type": "boolean"
},
"handle": {
"description": "The developer GitHub handle. Optional; it namespaces generated task IDs (e.g. CD-jsmith-001). Infer from git config or the origin remote.",
"type": "string"
},
"platforms": {
"description": "Platforms this should run on, e.g. web, ios, android, desktop. Infer from the dependency manifests and repo layout.",
"type": "array",
"items": {
"type": "string"
}
},
"ideAgent": {
"description": "The editor or AI IDE in use - claudecode, cursor, copilot, codex, windsurf. You are the IDE, so set this yourself; it decides which rules and config files are generated.",
"type": "string"
},
"languageOverride": {
"description": "Primary language, when it should override what SpecPilot infers from the repo.",
"type": "string"
},
"userTypes": {
"description": "Who is going to use this system, e.g. end users, admins, internal staff.",
"type": "array",
"items": {
"type": "string"
}
},
"customUserType": {
"description": "A user type in free text, when none of the userTypes options fit.",
"type": "string"
},
"accessControl": {
"description": "The access control model. Drives the security spec auth/authorization section and the permission model.",
"type": "string"
},
"specialConsiderations": {
"description": "Cross-cutting concerns that apply, such as accessibility, internationalisation or offline support.",
"type": "array",
"items": {
"type": "string"
}
},
"accessibilityNotes": {
"description": "Anything further on accessibility or constraints, in free text.",
"type": "string"
},
"scaleTier": {
"description": "Expected scale of the system. Drives infrastructure and architecture choices.",
"type": "string"
},
"activeUsers": {
"description": "Roughly how many active users are expected, as a range.",
"type": "string"
},
"deploymentTargets": {
"description": "Where this ships - cloud hosting, a package registry, a browser store. The option list depends on the project type.",
"type": "array",
"items": {
"type": "string"
}
},
"buildTimeline": {
"description": "How long the build is expected to take.",
"type": "string"
},
"teamSize": {
"description": "How many people are building this.",
"type": "string"
},
"systemPattern": {
"description": "Architecture pattern - monolith, modular monolith, or microservices.",
"type": "string"
},
"apiStyle": {
"description": "API style - REST, GraphQL, gRPC or tRPC. Shapes how the architecture spec documents client-server communication.",
"type": "string"
},
"databases": {
"description": "Database kinds in use - SQL, NoSQL, cache/key-value, vector. As many as apply.",
"type": "array",
"items": {
"type": "string"
}
},
"authStrategy": {
"description": "Auth approach - a protocol built in-house (JWT/OAuth/SAML) or a managed service (Clerk, Auth0, Firebase). Feeds the security spec.",
"type": "string"
},
"realtimeEnabled": {
"description": "Whether anything updates live without a refresh. Set automatically when realtimeTypes is non-empty.",
"type": "boolean"
},
"realtimeTypes": {
"description": "Realtime transports - WebSockets, SSE, polling. Leave empty when nothing needs to update live.",
"type": "array",
"items": {
"type": "string"
}
},
"offlineSupport": {
"description": "Whether this has to work offline. Set automatically when localDatabases is non-empty.",
"type": "boolean"
},
"localDatabases": {
"description": "On-device stores backing offline support. Leave empty when offline is not needed.",
"type": "array",
"items": {
"type": "string"
}
},
"dataSyncStrategy": {
"description": "How conflicting local and server state gets reconciled once the device is back online.",
"type": "string"
},
"integrations": {
"description": "Third-party integrations keyed by category, e.g. { payments: [\"stripe\"] }. Only categories relevant to the project type apply.",
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"otherApis": {
"description": "External APIs or services not covered by integrations.",
"type": "string"
},
"nonGoals": {
"description": "What this project explicitly will NOT do. Becomes the non-goals section of the specs.",
"type": "string"
},
"technicalConstraints": {
"description": "Hard constraints - budget, existing infrastructure, legacy systems, a fixed deadline.",
"type": "array",
"items": {
"type": "string"
}
},
"constraintDescription": {
"description": "More detail on whatever was named in technicalConstraints.",
"type": "string"
},
"compliance": {
"description": "Compliance regimes that apply - GDPR, HIPAA, SOC 2. Pick by the actual situation (EU users, health data, payments), since getting it wrong has legal consequences.",
"type": "array",
"items": {
"type": "string"
}
},
"apiResponseTime": {
"description": "Target API response time.",
"type": "string"
},
"availability": {
"description": "Availability SLA target as a fraction of uptime; higher percentages allow far less downtime per year.",
"type": "string"
},
"securityConcerns": {
"description": "Security measures to plan for - encryption, rate limiting, audit logging.",
"type": "array",
"items": {
"type": "string"
}
},
"testingStrategy": {
"description": "Testing approaches this project will use.",
"type": "array",
"items": {
"type": "string"
}
},
"cicd": {
"description": "CI/CD practices - automatically running tests and deploying on every change.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"required": [
"answers"
],
"$schema": "http://json-schema.org/draft-07/schema#"
}커뮤니티
증거