About this project

Spec Workflow MCP is a Model Context Protocol (MCP) server that adds a structured, spec-driven development workflow to AI-assisted coding. Instead of letting an assistant jump straight into code, it guides work through sequential specification documents: requirements, then design, then tasks. It is distributed as an npm package (@pimzino/spec-workflow-mcp) and is configured as an MCP server inside tools such as Claude Code, Claude Desktop, Cursor, Windsurf, Cline, Continue, Augment Code, OpenCode and Codex. Core capabilities described in the README: - Structured workflow: specs are created in order (Requirements → Design → Tasks), and individual tasks can be executed by name or number through conversation prompts. - Real-time web dashboard: a dashboard process (default port 5000) shows specs, tasks, progress bars and status, with live updates. One dashboard instance can serve multiple projects. - VSCode extension: an integrated sidebar dashboard for VSCode users, published on the Visual Studio Marketplace. - Approval workflow: documents can be submitted for approval through the dashboard, with feedback and revisions tracked. - Task progress tracking: visual progress indicators and detailed task status. - Implementation logs: searchable logs of task implementations including code statistics. - Multi-language support: the project provides documentation in 11 languages (English, Japanese, Chinese, Spanish, Portuguese, German, French, Russian, Italian, Korean and Arabic). Usage is prompt-driven: users mention spec-workflow in conversation to create a spec, list specs, or execute a specific task. Project state lives in a .spec-workflow directory containing approvals, archive, specs, steering, templates and user templates. Deployment and operations: the dashboard can be run in Docker via the provided Dockerfile and docker-compose setup, with a volume mount for the .spec-workflow workspace. Security notes in the README state that the server binds to 127.0.0.1 by default, applies rate limiting (120 requests/minute per client), writes structured JSON audit logs, sets security headers, restricts CORS to localhost, and hardens the Docker image with a non-root user, read-only filesystem, dropped capabilities and resource limits. HTTPS/TLS and user authentication are explicitly listed as not yet implemented, with reverse proxies (nginx/Apache) recommended for external access. For sandboxed environments where $HOME is read-only, the SPEC_WORKFLOW_HOME environment variable redirects global state to a writable location. Development is done with npm (install, build, dev scripts), and the project is licensed under GPL-3.0. The README also notes the maintainer has taken a temporary break from the repository.