github/spec-kit
💫 Toolkit to help you get started with Spec-Driven Development
How spec-kit is put together
Spec Kit is a Python CLI toolkit ('specify-cli') that bootstraps projects for Spec-Driven Development with AI coding agents. It is a single-package Typer/Click application under src/specify_cli with a src-layout, distributed via uv/PyPI and built with hatchling, which force-includes templates, scripts, extensions, presets, workflows, and a community bundle catalog into the wheel so `specify init` works air-gapped. Data flow: the CLI scaffolds agent integrations from an integration registry, fetches remote archives/catalogs through hardened download helpers, applies opt-in per-host credentials from ~/.specify/auth.json via a provider registry (GitHub, Azure DevOps), and installs markdown command templates plus shell/PowerShell/Python helper scripts into target projects. There is no server or datastore; persistence is filesystem-based (project directories, ~/.specify).
Languages
Frameworks
Infrastructure
Major components
specify_cli core CLI
Entry point (`specify`) implementing init, self-upgrade, and project bootstrap commands over the src/specify_cli package.
authentication
Opt-in multi-provider auth registry (GitHub, Azure DevOps) that resolves tokens and builds Authorization headers only when ~/.specify/auth.json opts hosts in.
_download_security
Bounded download and hardened archive extraction (zip/tar.gz) with size caps, format cross-validation, and Windows-reserved-name/path checks.
integrations
Registry-driven agent integrations (Copilot, Claude, Codex, etc.) with scaffold, install, migrate, and query subcommands.
extensions & presets
Installable opt-in extension packages (bug, assess, git, agent-context) and presets (lean, constitution-sync, scaffold) providing slash-command workflows.
workflows engine
Workflow definitions (workflows/speckit/workflow.yml) with an expression evaluator driving the speckit-* command pipeline.
bundler
Catalog/manifest models and services for community catalogs of bundles, extensions, presets, and integrations, including conflict handling and versioning.
templates & scripts assets
Markdown command templates (constitution, specify, plan, tasks, implement, converge) and bash/powershell/python helper scripts bundled into the wheel.
A quieter week focused on keeping bundled extensions and governance presets up to date after the 1.0 launch.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on keeping bundled extensions and governance presets up to date after the 1.0 launch.
Week of 2026-08-17
Spec Kit hit its 1.0.0 milestone and followed up with a 1.0.1 patch, plus anniversary documentation and a large batch of workflow validation fixes.
Week of 2026-08-10
A high-volume week of stability fixes ahead of 1.0, including two patch releases, security hardening of submission workflows, and several new integrations.
Week of 2026-08-03
A robustness-focused week with two releases, extensive handling of unreadable or corrupt files, and new hook context features for agent integrations.
Week of 2026-07-27
The busiest week of the month: two releases, elimination of several file-system race conditions, tar archive support, and a batch of workflow gate validations.
Over the past month, Spec Kit moved from a busy hardening phase into its first major milestone: the project shipped version 1.0.0 in mid-August, followed quickly by a 1.0.1 patch and a wave of documentation celebrating its first anniversary. Alongside the release, the team landed dozens of defensive fixes — protecting against corrupted files, malformed manifests, and race conditions — while steadily growing the community catalog with new extensions and presets.
Week by week
2026-08-24A quieter week focused on keeping bundled extensions and governance presets up to date after the 1.0 launch.latest4 changes
Chore
Parallel Autonomous Run Governance preset updated to v0.2.6
The preset that governs parallel automated runs was refreshed to its latest version.
Chore
SpecAssay bundle and preset updated to v0.4.12
The SpecAssay quality-checking bundle and its matching preset were both bumped to a new release.
Chore
Archive Extension updated to v1.3.0
The extension for archiving completed work received a minor version update.
Chore
Reconcile extension updated to v1.2.1
The extension that reconciles specs and implementations got a small patch update.
2026-08-17Spec Kit hit its 1.0.0 milestone and followed up with a 1.0.1 patch, plus anniversary documentation and a large batch of workflow validation fixes.6 changes
Chore
Released version 1.0.0 (and then 1.0.1)
The project officially reached its 1.0.0 release, immediately starting work on follow-up patch versions.
Docs
First-anniversary docs and adoption guide
New documentation marked Spec Kit's one-year anniversary, added a guide for adopting it in existing projects, and rebranded the docs site.
Fix
Safer workflow switch steps
Workflow 'switch' steps now require a proper 'cases' block and strip resolved values before matching, preventing misbehaving branching logic.
Fix
Stricter manifest and catalog validation
The bundler and preset system now reject malformed entries like non-string list members, duplicate template names, and invalid catalog mutations.
Feature
New community extensions and presets
Azure Cosmos DB, Spec Inventory, AgentDocx, Inventory Alignment, and Closed Vocabulary Check were added to the community catalog.
Fix
Condition validation improvements
Workflows now reject conditions without template blocks and no longer offer corrections that would accidentally invert a condition's meaning.
2026-08-10A high-volume week of stability fixes ahead of 1.0, including two patch releases, security hardening of submission workflows, and several new integrations.6 changes
Fix
Hardened community submission pipeline
The workflow that accepts community contributions had its output allowlists tightened to prevent abuse.
Feature
New Mistral Vibe integration
Added support for Mistral Vibe as an AI coding assistant integration, at feature parity with Claude.
Fix
Safer file handling throughout
Fixed races when loading run state, added bounded reads for bundle downloads, and improved UTF-8 decoding of downloaded manifests.
Fix
Broader task-ID matching
The tasks-to-issues tool now recognizes task IDs longer than three digits, so larger projects convert correctly.
Feature
Presets listed in precedence order
Preset listings now show which settings take priority when multiple presets apply.
Chore
Community catalog growth
SpecAssay, SpecJudge, SpecKit Grill Me, spec-kit-atlas, and Architecture Governance joined the community catalog.
2026-08-03A robustness-focused week with two releases, extensive handling of unreadable or corrupt files, and new hook context features for agent integrations.6 changes
Feature
Extensions can now provide templates and scripts
Extension manifests gained the ability to declare templates and scripts they ship, expanding what extensions can offer.
Feature
Context injection for agent hooks
OpenCode and JSON-envelope agent hooks can now receive context automatically during events.
Fix
Graceful handling of corrupt registries
If an extension or preset registry file is unreadable or not valid UTF-8, the tool now starts fresh instead of crashing.
Fix
Safer init output and gitignore scaffolding
User-supplied values in 'specify init' are now escaped against injection, and init creates a managed .gitignore for the .specify directory.
Fix
Windows text-mode fixes
Two helper scripts stopped crashing on older Windows code pages when running in text mode.
Feature
Copilot defaults to skills
The Copilot integration now defaults to using the skills-based setup rather than the legacy approach.
2026-07-27The busiest week of the month: two releases, elimination of several file-system race conditions, tar archive support, and a batch of workflow gate validations.6 changes
Fix
Race conditions eliminated
Multiple time-of-check-to-time-of-use races in zip packaging and file deletion were fixed, making file operations safer under concurrent use.
Feature
Tar archive installs
Installs now support tar archives in addition to zip files.
Feature
--extension flag for specify init
Users can opt into specific extensions right when initializing a project, rather than adding them afterward.
Fix
Stricter workflow gates
Gates with invalid rejection actions, fan-in steps with bad outputs, and retry gates with mismatched verdict enums now fail clearly instead of misbehaving.
Feature
Constitution-sync preset and verdict binding
An opt-in constitution-sync preset arrived, and gate verdicts can now be bound to workflow inputs via verdict_input.
Chore
Community catalog additions
ContextForge MCP, Intent Reconciliation, and the 'yolo' workflow joined the community catalog.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required