SpecPilot
Generate and validate a .specs/ bundle for your repo, then hand it to your AI coding agent
我该使用它吗
质量与安全性
发现(3)
- HIGH
- MEDIUM在 specpilot_next_questions 中
- INFO在 specpilot_next_questions 中
基于对工具定义和协议合规性的自动分析。
上下文开销
这是每次将服务器的工具加载到模型上下文窗口时所消耗的大致 token 数。数值越高,可用于其他任务的注意力就越少。
安装
一键安装
将以下内容添加到你的 `claude_desktop_config.json` 文件中:
{
"mcpServers": {
"specpilot": {
"url": "https://init.specpilot.dev/mcp"
}
}
}远程端点
https://init.specpilot.dev/mcpstreamable-http它能做什么
工具清单
工具(2)
🟡specpilot_next_questions(answers)
Returns the still-unanswered SpecPilot onboarding questions of the next incomplete step, gated by the answers supplied so far - questions that do not apply to this kind of project are omitted, and options are filtered, badged or flagged the same way the SpecPilot web chat would. Stateless: send every answer collected so far on each call. Procedure: (1) Decide whether the repository already has real source code and set `isNewBuild` accordingly - it changes which onboarding analysis is generated at the end. (2) Infer what the repo already answers rather than asking: `platforms` from the dependency manifests and layout, `languageOverride`, `ideAgent` (you are the IDE - claudecode, cursor, copilot, codex, windsurf), `handle` from git config or the origin remote, `projectName` from the package manifest or folder name, and `projectDescription` from the README only if it plainly says what the project is. (3) Call this tool with what you have; answer what the repo makes obvious and ask the developer the rest, a whole step per message. Send an empty value for an optional question the developer declines, or it will be asked again; send `todoSentinel` verbatim when they do not know yet. For `projectDescription`, sending one of the returned chip labels exactly is what infers `projectCategory` and gates every later question - free prose infers nothing. Confirm any pre-seeded value rather than accepting it silently. (4) Loop until `done` is true, then call specpilot_generate_specs and follow its `nextSteps` for where each file goes.
输入模式
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"properties": {
"projectCategory": {
"description": "Project archetype. Normally inferred from projectDescription when it exactly matches a returned chip label - send it only if you already know it.",
"anyOf": [
{
"type": "string",
"enum": [
"saas",
"api",
"mobile",
"cli",
"pipeline",
"ml",
"static",
"docs",
"extension",
"library",
"other"
]
},
{
"type": "null"
}
]
},
"projectName": {
"description": "Short name for the project. Required by specpilot_generate_specs. Infer from the package manifest or the folder name.",
"type": "string"
},
"projectDescription": {
"description": "One line saying what the project is. Required by specpilot_generate_specs. Sending one of the chip labels returned by specpilot_next_questions verbatim is what infers projectCategory and gates every later question; free prose infers nothing.",
"type": "string"
},
"isNewBuild": {
"description": "True for a greenfield project, false when adding onto an existing codebase. Decides which onboarding analysis is generated at the end.",
"type": "boolean"
},
"handle": {
"description": "The developer GitHub handle. Optional; it namespaces generated task IDs (e.g. CD-jsmith-001). Infer from git config or the origin remote.",
"type": "string"
},
"platforms": {
"description": "Platforms this should run on, e.g. web, ios, android, desktop. Infer from the dependency manifests and repo layout.",
"type": "array",
"items": {
"type": "string"
}
},
"ideAgent": {
"description": "The editor or AI IDE in use - claudecode, cursor, copilot, codex, windsurf. You are the IDE, so set this yourself; it decides which rules and config files are generated.",
"type": "string"
},
"languageOverride": {
"description": "Primary language, when it should override what SpecPilot infers from the repo.",
"type": "string"
},
"userTypes": {
"description": "Who is going to use this system, e.g. end users, admins, internal staff.",
"type": "array",
"items": {
"type": "string"
}
},
"customUserType": {
"description": "A user type in free text, when none of the userTypes options fit.",
"type": "string"
},
"accessControl": {
"description": "The access control model. Drives the security spec auth/authorization section and the permission model.",
"type": "string"
},
"specialConsiderations": {
"description": "Cross-cutting concerns that apply, such as accessibility, internationalisation or offline support.",
"type": "array",
"items": {
"type": "string"
}
},
"accessibilityNotes": {
"description": "Anything further on accessibility or constraints, in free text.",
"type": "string"
},
"scaleTier": {
"description": "Expected scale of the system. Drives infrastructure and architecture choices.",
"type": "string"
},
"activeUsers": {
"description": "Roughly how many active users are expected, as a range.",
"type": "string"
},
"deploymentTargets": {
"description": "Where this ships - cloud hosting, a package registry, a browser store. The option list depends on the project type.",
"type": "array",
"items": {
"type": "string"
}
},
"buildTimeline": {
"description": "How long the build is expected to take.",
"type": "string"
},
"teamSize": {
"description": "How many people are building this.",
"type": "string"
},
"systemPattern": {
"description": "Architecture pattern - monolith, modular monolith, or microservices.",
"type": "string"
},
"apiStyle": {
"description": "API style - REST, GraphQL, gRPC or tRPC. Shapes how the architecture spec documents client-server communication.",
"type": "string"
},
"databases": {
"description": "Database kinds in use - SQL, NoSQL, cache/key-value, vector. As many as apply.",
"type": "array",
"items": {
"type": "string"
}
},
"authStrategy": {
"description": "Auth approach - a protocol built in-house (JWT/OAuth/SAML) or a managed service (Clerk, Auth0, Firebase). Feeds the security spec.",
"type": "string"
},
"realtimeEnabled": {
"description": "Whether anything updates live without a refresh. Set automatically when realtimeTypes is non-empty.",
"type": "boolean"
},
"realtimeTypes": {
"description": "Realtime transports - WebSockets, SSE, polling. Leave empty when nothing needs to update live.",
"type": "array",
"items": {
"type": "string"
}
},
"offlineSupport": {
"description": "Whether this has to work offline. Set automatically when localDatabases is non-empty.",
"type": "boolean"
},
"localDatabases": {
"description": "On-device stores backing offline support. Leave empty when offline is not needed.",
"type": "array",
"items": {
"type": "string"
}
},
"dataSyncStrategy": {
"description": "How conflicting local and server state gets reconciled once the device is back online.",
"type": "string"
},
"integrations": {
"description": "Third-party integrations keyed by category, e.g. { payments: [\"stripe\"] }. Only categories relevant to the project type apply.",
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"otherApis": {
"description": "External APIs or services not covered by integrations.",
"type": "string"
},
"nonGoals": {
"description": "What this project explicitly will NOT do. Becomes the non-goals section of the specs.",
"type": "string"
},
"technicalConstraints": {
"description": "Hard constraints - budget, existing infrastructure, legacy systems, a fixed deadline.",
"type": "array",
"items": {
"type": "string"
}
},
"constraintDescription": {
"description": "More detail on whatever was named in technicalConstraints.",
"type": "string"
},
"compliance": {
"description": "Compliance regimes that apply - GDPR, HIPAA, SOC 2. Pick by the actual situation (EU users, health data, payments), since getting it wrong has legal consequences.",
"type": "array",
"items": {
"type": "string"
}
},
"apiResponseTime": {
"description": "Target API response time.",
"type": "string"
},
"availability": {
"description": "Availability SLA target as a fraction of uptime; higher percentages allow far less downtime per year.",
"type": "string"
},
"securityConcerns": {
"description": "Security measures to plan for - encryption, rate limiting, audit logging.",
"type": "array",
"items": {
"type": "string"
}
},
"testingStrategy": {
"description": "Testing approaches this project will use.",
"type": "array",
"items": {
"type": "string"
}
},
"cicd": {
"description": "CI/CD practices - automatically running tests and deploying on every change.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"$schema": "http://json-schema.org/draft-07/schema#"
}🟡specpilot_generate_specs(answers)
Generates the complete SpecPilot .specs/ file set plus the matching IDE rules and slash-command files from a full answer set - identical to what the SpecPilot web chat produces for the same answers. Requires projectName and projectDescription. Returns the files to write and the steps to follow after writing them.
输入模式
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"properties": {
"projectCategory": {
"description": "Project archetype. Normally inferred from projectDescription when it exactly matches a returned chip label - send it only if you already know it.",
"anyOf": [
{
"type": "string",
"enum": [
"saas",
"api",
"mobile",
"cli",
"pipeline",
"ml",
"static",
"docs",
"extension",
"library",
"other"
]
},
{
"type": "null"
}
]
},
"projectName": {
"description": "Short name for the project. Required by specpilot_generate_specs. Infer from the package manifest or the folder name.",
"type": "string"
},
"projectDescription": {
"description": "One line saying what the project is. Required by specpilot_generate_specs. Sending one of the chip labels returned by specpilot_next_questions verbatim is what infers projectCategory and gates every later question; free prose infers nothing.",
"type": "string"
},
"isNewBuild": {
"description": "True for a greenfield project, false when adding onto an existing codebase. Decides which onboarding analysis is generated at the end.",
"type": "boolean"
},
"handle": {
"description": "The developer GitHub handle. Optional; it namespaces generated task IDs (e.g. CD-jsmith-001). Infer from git config or the origin remote.",
"type": "string"
},
"platforms": {
"description": "Platforms this should run on, e.g. web, ios, android, desktop. Infer from the dependency manifests and repo layout.",
"type": "array",
"items": {
"type": "string"
}
},
"ideAgent": {
"description": "The editor or AI IDE in use - claudecode, cursor, copilot, codex, windsurf. You are the IDE, so set this yourself; it decides which rules and config files are generated.",
"type": "string"
},
"languageOverride": {
"description": "Primary language, when it should override what SpecPilot infers from the repo.",
"type": "string"
},
"userTypes": {
"description": "Who is going to use this system, e.g. end users, admins, internal staff.",
"type": "array",
"items": {
"type": "string"
}
},
"customUserType": {
"description": "A user type in free text, when none of the userTypes options fit.",
"type": "string"
},
"accessControl": {
"description": "The access control model. Drives the security spec auth/authorization section and the permission model.",
"type": "string"
},
"specialConsiderations": {
"description": "Cross-cutting concerns that apply, such as accessibility, internationalisation or offline support.",
"type": "array",
"items": {
"type": "string"
}
},
"accessibilityNotes": {
"description": "Anything further on accessibility or constraints, in free text.",
"type": "string"
},
"scaleTier": {
"description": "Expected scale of the system. Drives infrastructure and architecture choices.",
"type": "string"
},
"activeUsers": {
"description": "Roughly how many active users are expected, as a range.",
"type": "string"
},
"deploymentTargets": {
"description": "Where this ships - cloud hosting, a package registry, a browser store. The option list depends on the project type.",
"type": "array",
"items": {
"type": "string"
}
},
"buildTimeline": {
"description": "How long the build is expected to take.",
"type": "string"
},
"teamSize": {
"description": "How many people are building this.",
"type": "string"
},
"systemPattern": {
"description": "Architecture pattern - monolith, modular monolith, or microservices.",
"type": "string"
},
"apiStyle": {
"description": "API style - REST, GraphQL, gRPC or tRPC. Shapes how the architecture spec documents client-server communication.",
"type": "string"
},
"databases": {
"description": "Database kinds in use - SQL, NoSQL, cache/key-value, vector. As many as apply.",
"type": "array",
"items": {
"type": "string"
}
},
"authStrategy": {
"description": "Auth approach - a protocol built in-house (JWT/OAuth/SAML) or a managed service (Clerk, Auth0, Firebase). Feeds the security spec.",
"type": "string"
},
"realtimeEnabled": {
"description": "Whether anything updates live without a refresh. Set automatically when realtimeTypes is non-empty.",
"type": "boolean"
},
"realtimeTypes": {
"description": "Realtime transports - WebSockets, SSE, polling. Leave empty when nothing needs to update live.",
"type": "array",
"items": {
"type": "string"
}
},
"offlineSupport": {
"description": "Whether this has to work offline. Set automatically when localDatabases is non-empty.",
"type": "boolean"
},
"localDatabases": {
"description": "On-device stores backing offline support. Leave empty when offline is not needed.",
"type": "array",
"items": {
"type": "string"
}
},
"dataSyncStrategy": {
"description": "How conflicting local and server state gets reconciled once the device is back online.",
"type": "string"
},
"integrations": {
"description": "Third-party integrations keyed by category, e.g. { payments: [\"stripe\"] }. Only categories relevant to the project type apply.",
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"otherApis": {
"description": "External APIs or services not covered by integrations.",
"type": "string"
},
"nonGoals": {
"description": "What this project explicitly will NOT do. Becomes the non-goals section of the specs.",
"type": "string"
},
"technicalConstraints": {
"description": "Hard constraints - budget, existing infrastructure, legacy systems, a fixed deadline.",
"type": "array",
"items": {
"type": "string"
}
},
"constraintDescription": {
"description": "More detail on whatever was named in technicalConstraints.",
"type": "string"
},
"compliance": {
"description": "Compliance regimes that apply - GDPR, HIPAA, SOC 2. Pick by the actual situation (EU users, health data, payments), since getting it wrong has legal consequences.",
"type": "array",
"items": {
"type": "string"
}
},
"apiResponseTime": {
"description": "Target API response time.",
"type": "string"
},
"availability": {
"description": "Availability SLA target as a fraction of uptime; higher percentages allow far less downtime per year.",
"type": "string"
},
"securityConcerns": {
"description": "Security measures to plan for - encryption, rate limiting, audit logging.",
"type": "array",
"items": {
"type": "string"
}
},
"testingStrategy": {
"description": "Testing approaches this project will use.",
"type": "array",
"items": {
"type": "string"
}
},
"cicd": {
"description": "CI/CD practices - automatically running tests and deploying on every change.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"required": [
"answers"
],
"$schema": "http://json-schema.org/draft-07/schema#"
}社区
证据