Spec Workflow Mcp

Serve spec-driven dev tools via MCP for AI-assisted workflows. Use when adding tasks, planning iterations, tracking completion, reviewing quality.

Security Scan

The skill is internally coherent: the included shell script implements the described local, file-backed task/logging tool and requests no external credentials or network access.

Purpose & Capability

The name/description match the observed behavior. The SKILL.md documents a local CLI that appends timestamped lines to per-command log files; scripts/script.sh implements the listed commands and data layout under ~/.local/share/spec-workflow-mcp. Nothing requested by the skill (no env vars, no binaries, no network) appears out of scope for a local spec/task logger.

Instruction Scope

Runtime instructions and the script are narrowly scoped to reading/writing plain-text log files under the DATA_DIR and invoking standard coreutils (date, tail, grep, wc, du). There are no network calls or attempts to read unrelated system config. Note: export routines write raw values into CSV/JSON/TXT without sanitization; exported CSV/JSON may contain unsanitized content and could lead to CSV injection when opened in spreadsheet software or produce invalid JSON if values contain unescaped quotes/newlines.

Install Mechanism

No install spec is present (instruction-only skill) and the only code is a single shell script included in the package. No downloads, third-party package installs, or archive extraction are performed by the skill itself—low install risk.

Credentials

The skill requires no credentials or special environment variables. It uses an optional DATA_DIR environment variable (default: $HOME/.local/share/spec-workflow-mcp) which is reasonable for a local CLI. Users should be aware that logs are stored in plaintext in the file system; do not record secrets or sensitive data in entries unless you move DATA_DIR to a secure location.

Persistence & Privilege

always:false and the skill writes only to its own data directory in the user's home. It does not request elevated privileges or modify other skills or system-wide settings. Autonomous invocation is allowed (default) but is not combined with broad credential access or privileged actions.

Assessment

This skill appears to be a simple local CLI logger and is coherent with its description. Before installing: (1) review scripts/script.sh yourself (it will run on your system); (2) be aware it creates and writes plaintext logs at ~/.local/share/spec-workflow-mcp by default — avoid entering passwords or secrets into entries; (3) if you export data, exported CSV/JSON are not sanitized (CSV may expose CSV-injection risks when opened in spreadsheet apps and JSON may be malformed if entries contain unescaped quotes/newlines); (4) you can change DATA_DIR to a different folder if you prefer to keep data elsewhere.

Spec Workflow MCP v2.0.0 — a productivity toolkit for spec-driven development workflows served via the Model Context Protocol (MCP). Manage tasks, plan sprints, track progress, review deliverables, set reminders, prioritize work, and run weekly reviews — all from the command line with timestamped log entries.

Commands

The script (scripts/script.sh) exposes the following commands via a case dispatcher:

Command	Description
add <input>	Add a new spec/task entry. Without args, shows the 20 most recent add entries.
plan <input>	Record a planning entry (sprint planning, iteration goals). Without args, lists recent plans.
track <input>	Track progress on a task or deliverable. Without args, lists recent tracking entries.
review <input>	Record a review note (code review, spec review). Without args, lists recent reviews.
streak <input>	Log a streak entry (daily consistency tracking). Without args, lists recent streaks.
remind <input>	Set a reminder or log a reminder note. Without args, lists recent reminders.
prioritize <input>	Record a prioritization decision. Without args, lists recent prioritizations.
archive <input>	Archive a completed item. Without args, lists recent archive entries.
tag <input>	Tag or categorize an entry. Without args, lists recent tags.
timeline <input>	Record a timeline/milestone entry. Without args, lists recent timeline entries.
report <input>	Generate or log a report entry. Without args, lists recent reports.
weekly-review <input>	Record a weekly review summary. Without args, lists recent weekly reviews.
stats	Show summary statistics across all log files (entry counts per type, total, disk usage).
export <fmt>	Export all data in json, csv, or txt format to $DATA_DIR/export.<fmt>.
search <term>	Search all log files for a term (case-insensitive grep).
recent	Show the 20 most recent lines from history.log.
status	Health check — shows version, data directory, total entries, disk usage, last activity.
help	Display the full help/usage message.
version	Print spec-workflow-mcp v2.0.0.

How Each Entry Command Works

1. If called without arguments, it tails the last 20 lines of <command>.log.
2. If called with arguments, it:
   • Timestamps the input (YYYY-MM-DD HH:MM|<input>)
   • Appends it to $DATA_DIR/<command>.log
   • Prints confirmation with the current total count
   • Logs the action to history.log

Data Storage

All data is stored as plain-text log files under:

~/.local/share/spec-workflow-mcp/
├── add.log
├── plan.log
├── track.log
├── review.log
├── streak.log
├── remind.log
├── prioritize.log
├── archive.log
├── tag.log
├── timeline.log
├── report.log
├── weekly-review.log
└── history.log          # unified activity log

Each log line uses pipe-delimited format: YYYY-MM-DD HH:MM|<value>

The history.log uses: MM-DD HH:MM <command>: <value>

Requirements

• Bash 4.0+ (uses local variables, set -euo pipefail)
• coreutils: date, wc, du, tail, cat, basename, grep, sed
• No external dependencies, API keys, or network access required
• Works on Linux and macOS

When to Use

1. Sprint planning — use plan to record iteration goals, then track to log progress against them throughout the sprint
2. Task management — use add to capture new specs or tasks, prioritize to rank them, and archive when complete
3. Daily standups — use streak to maintain consistency tracking and recent to review what happened yesterday
4. Code/spec reviews — use review to log review notes and decisions for future reference
5. Weekly retrospectives — use weekly-review to capture weekly summaries, then export to generate reports for stakeholders

Examples

Add a task and plan a sprint

# Add a new spec
bash scripts/script.sh add "API rate limiting — sliding window implementation"

# Plan the sprint
bash scripts/script.sh plan "Sprint 8: rate limiter, caching layer, monitoring"

Track progress and review

# Track completion
bash scripts/script.sh track "rate limiter: Redis backend done, unit tests passing"

# Log a review
bash scripts/script.sh review "rate limiter PR #87: approved, added integration tests"

Set reminders and manage priorities

# Set a reminder
bash scripts/script.sh remind "demo prep for Friday stakeholder meeting"

# Prioritize
bash scripts/script.sh prioritize "P1: cache invalidation edge case in multi-region"

Weekly review and export

# Record weekly summary
bash scripts/script.sh weekly-review "shipped rate limiter, started caching layer, blocked on Redis cluster config"

# Export all data as CSV
bash scripts/script.sh export csv

Search and view timeline

# Find all entries mentioning "cache"
bash scripts/script.sh search "cache"

# Log a milestone
bash scripts/script.sh timeline "v2.1 release candidate tagged"

# View overall statistics
bash scripts/script.sh stats

Configuration

Set the DATA_DIR variable (or modify it in the script) to change the storage directory. Default: ~/.local/share/spec-workflow-mcp/

Output

All commands print to stdout. Redirect to a file as needed:

bash scripts/script.sh weekly-review > retro-notes.txt

---

Powered by BytesAgain | bytesagain.com | [e-mail]