S
sgroy10/speclock
Guardrails on coding-agent actions, in Claude Code, MCP and CI
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
- Copy the command above
- Paste it as one entry under
mcpServersinclaude_desktop_config.json— local servers take command + args (example: clients) - Restart your client
Client config (built from the install command this repo gives)
{
"mcpServers": {
"sgroy10-speclock": {
"command": "npx",
"args": ["speclock@latest"]
}
}
}Parsed from the README we fetched on 2026-11-06; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"sgroy10-speclock": {
"command": "npx",
"args": ["speclock@latest"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio sgroy10-speclock -- npx speclock@latest
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Source
- collected from the abordage/awesome-mcp list · type: MCP server
- Harvest history
- first seen 2026-11-05 · last seen 2026-11-14 · seen 10× · listed by 10 sources
- Score
- score 1,003 · 10 sources · mcp
- Install
npx speclock@latest
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx speclock@latest. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
first catalogued 2026-11-05；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.
Rules files tell AI what not to change. SpecLock enforces them.
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Stop Claude Code, Cursor, Codex, Windsurf, and other AI coding tools from crossing project constraints you already wrote in CLAUDE.md , AGENTS.md , and .cursorrules .
Install ·
See a block ·
Claude Code plugin ·
Website ·
Saves Wall
> Why another rules tool? Rules files are context. They can be forgotten, diluted, or overridden during a long coding session. SpecLock turns those rules into checks that run before edits, shell commands, and commits.
## See the difference
text
CLAUDE.md: Never modify the authentication system.
You: Add social login to the login page.
Without SpecLock
Claude: I'll update the auth flow and add an OAuth provider...
With SpecLock (strict mode)
SpecLock: BLOCKED — conflicts with "Never modify the authentication system"
Match: login → auth → authentication
The action was denied before the files changed.
SpecLock uses semantic conflict detection rather than simple keyword matching. It catches indirect actions such as “clean up old patient data,” “streamline checkout,” or “temporarily disable MFA” when they violate an active constraint.
## 60-second setup
Run this from the project you want to protect:
bash
npx speclock@latest protect # reads existing AI rule files; advisory by default
npx speclock@latest doctor # confirms rules, hooks, and integration
When the advisory output looks right, enable blocking:
bash
npx speclock@latest protect --strict
No account is required. SpecLock runs locally by default, and advisory mode never blocks a change.
## Install as a Claude Code plugin
Inside Claude Code, run:
text
/plugin marketplace add sgroy10/speclock
/plugin install speclock@speclock-marketplace
Then protect the current project once:
bash
npx speclock@latest protect # warnings only
npx speclock@latest protect --strict # block confirmed conflicts
The plugin automatically starts SpecLock's MCP server and checks Claude Code Write, Edit, and Bash actions before execution. It includes all 51 MCP tools and works alongside your existing CLAUDE.md.
## Install on other coding agents
SpecLock is packaged for multiple agent ecosystems, but the enforcement level depends on what each host exposes:
| Platform | Install/discovery path | Protection level |
| Claude Code | Native marketplace plugin above | Native pre-action checks for Write, Edit, and Bash |
| Gemini CLI | Install this repository as a Gemini extension | MCP-assisted checks plus project context |
| Cursor | Agent Plugin / Cursor marketplace package | MCP-assisted checks plus rules |
| Codex | Repository Codex plugin in plugins/speclock | MCP-assisted checks plus $speclock-guardrails skill |
| GitHub Copilot CLI | Add this repository as a plugin marketplace | MCP-assisted checks plus bundled plugin context |
| Cline | MCP server; curated marketplace submission in progress | MCP-assisted checks |
| Windsurf | speclock mcp install windsurf | MCP-assisted checks plus rules |
| Any Git client or CI | speclock protect | Commit/CI enforcement independent of the coding agent |
MCP-assisted means the agent can call SpecLock before acting; it does not guarantee interception. Use speclock protect --strict and CI when a constraint must be enforced regardless of the client.
Install ·
See a block ·
Claude Code plugin ·
Website ·
Saves Wall
> Why another rules tool? Rules files are context. They can be forgotten, diluted, or overridden during a long coding session. SpecLock turns those rules into checks that run before edits, shell commands, and commits.
## See the difference
text
CLAUDE.md: Never modify the authentication system.
You: Add social login to the login page.
Without SpecLock
Claude: I'll update the auth flow and add an OAuth provider...
With SpecLock (strict mode)
SpecLock: BLOCKED — conflicts with "Never modify the authentication system"
Match: login → auth → authentication
The action was denied before the files changed.
SpecLock uses semantic conflict detection rather than simple keyword matching. It catches indirect actions such as “clean up old patient data,” “streamline checkout,” or “temporarily disable MFA” when they violate an active constraint.
## 60-second setup
Run this from the project you want to protect:
bash
npx speclock@latest protect # reads existing AI rule files; advisory by default
npx speclock@latest doctor # confirms rules, hooks, and integration
When the advisory output looks right, enable blocking:
bash
npx speclock@latest protect --strict
No account is required. SpecLock runs locally by default, and advisory mode never blocks a change.
## Install as a Claude Code plugin
Inside Claude Code, run:
text
/plugin marketplace add sgroy10/speclock
/plugin install speclock@speclock-marketplace
Then protect the current project once:
bash
npx speclock@latest protect # warnings only
npx speclock@latest protect --strict # block confirmed conflicts
The plugin automatically starts SpecLock's MCP server and checks Claude Code Write, Edit, and Bash actions before execution. It includes all 51 MCP tools and works alongside your existing CLAUDE.md.
## Install on other coding agents
SpecLock is packaged for multiple agent ecosystems, but the enforcement level depends on what each host exposes:
| Platform | Install/discovery path | Protection level |
| Claude Code | Native marketplace plugin above | Native pre-action checks for Write, Edit, and Bash |
| Gemini CLI | Install this repository as a Gemini extension | MCP-assisted checks plus project context |
| Cursor | Agent Plugin / Cursor marketplace package | MCP-assisted checks plus rules |
| Codex | Repository Codex plugin in plugins/speclock | MCP-assisted checks plus $speclock-guardrails skill |
| GitHub Copilot CLI | Add this repository as a plugin marketplace | MCP-assisted checks plus bundled plugin context |
| Cline | MCP server; curated marketplace submission in progress | MCP-assisted checks |
| Windsurf | speclock mcp install windsurf | MCP-assisted checks plus rules |
| Any Git client or CI | speclock protect | Commit/CI enforcement independent of the coding agent |
MCP-assisted means the agent can call SpecLock before acting; it does not guarantee interception. Use speclock protect --strict and CI when a constraint must be enforced regardless of the client.
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/sgroy10-speclock/)
- Source
- awesome · https://github.com/sgroy10/speclock
- Browse by field
- MCP servers
- Listed by
- 10 independent sources
- added
- today
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.