#1313th of 308 in Skills, plugins and prompts
spec-kit
Spec-driven development toolkit and CLI for AI coding agents
- Stars
- 142.6k
- License
- MIT
- Last commit
- Oct 2026
- Last release
- Oct 2026
- Language
- Python
80,804 on 27 Mar 2026142,643 on 23 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Spec Kit installs a Python CLI (`specify`) that scaffolds a project with slash commands or skills for your coding agent. The core flow is constitution, specify, plan, tasks, implement, converge; bug-fixing and idea-assessment ship as optional extensions. Behavior is customized through extensions, presets, workflows, bundles and catalogs.
Who it is for: Developers who want a structured spec-first workflow in their coding agent
Strengths
- Works with multiple coding agents through integrations; GitHub Copilot is the documented example
- Extensions, presets, workflows and bundles customize the process without forking
- Bug-fix and assessment extensions write reports to .specify/ directories in the repo
- Supports air-gapped use via local sources and self-hosted catalogs
Weaknesses
- Needs a separate supported coding agent; it does not run models itself
- Steps are run one at a time in agent chat, with manual review
- Invocation syntax differs per agent, so examples need translating
- Community catalog components are unaudited and need manual source review
What it needs
- no GPU
- Needs Python 3.11+, uv, a supported AI coding agent
Quick answers
Is spec-kit open source?
Yes. Its code is on GitHub under the MIT license.
Safety checks
Checks passed: 9 of 9 (19 Oct 2026)
Checked commit c6a4c18 ↗ (opens in a new tab) · content sha256:7b8e309fed8a…
- Pass
No hardcoded keys or tokens
No key matching a known secret format in 937 files
- Pass
No binaries or archives in agent or server folders
No binary or archive in 47 files
- Pass
No dangerous CI workflow
No dangerous workflow pattern and no write-all token in 20 workflows. Note: 4 of 20 workflows set no top-level permissions
- Pass
- Pass
No hidden Unicode in agent-facing text
No hidden Unicode in 47 files
- Pass
No override, concealment or secret-file instructions
No override, concealment or sensitive-path instruction in 47 files
- Pass
A private way to report a vulnerability
Security policy published
- Pass
- Pass
No fake prerequisite or installer steps
No installer or prerequisite step in 47 files
N/A: 9 checks do not apply here or had no data
- N/A
Package points back to this repo
Applies to MCP servers only
- N/A
Listed in the official MCP Registry under the owner's name
Applies to MCP servers only
- N/A
Latest release has build provenance
Applies to MCP servers only
- N/A
No advisories at CVSS 7 or higher
No lockfile at the repo root
- N/A
No install-time scripts
Applies to MCP servers only
- N/A
HTTPS endpoints, no credentials in shipped config
Not a plugin and not an MCP server
- N/A
No email recipients added since the last checked version, no hidden BCC
No server code or skill scripts
- N/A
No shell commands built from input, no unchecked URL opening
Applies to MCP servers only
- N/A
HTTP endpoints check auth or stay on localhost
Applies to MCP servers only
Facts, not pass or fail
- Bundles scripts
- No
- Hooks
- No
- A bin folder
- No
- MCP config file
- No
- Calls other MCP tools
- No
- Domains its agent files link to
- api.example.com, codeload.github.com, example.internal, github.com, pypi.org, raw.githubusercontent.com, release-assets.githubusercontent.com, www.conventionalcommits.org
Read on 19 Oct 2026 from the repo's files, npm, PyPI, deps.dev, OSV and the MCP Registry. We ran nothing from the project. N/A means the check does not apply or we could not read its data. Not part of the score: what each check looks at and what it cannot see. A result looks wrong? Tell us on GitHub (opens in a new tab).
Also in Skills, plugins and prompts
See all 308| Rank | Project | Score |
|---|---|---|
| 1 | impeccableDesign skill with 24 slash commands for AI coding agents' frontend output | 96 out of 100 |
| 2 | cavemanCuts token use in coding agents with terse replies and compressed inputs | 95 out of 100 |
| 3 | skillsAgent skills for planning, TDD, debugging and code review | 94 out of 100 |
| #4 | eccAgents, skills, hooks and rules bundle for Claude Code, Codex and other harnesses | 94 out of 100 |
| #5 | oh-my-claudecodeMulti-agent orchestration plugin and CLI for Claude Code | 94 out of 100 |