Borrowing it
Nothing to install: this file belongs to adrian-d-hidalgo/nestjs-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adrian-d-hidalgo/nestjs-mcp-server/main/.claude/commands/specification.mdgit clone --depth 1 https://github.com/adrian-d-hidalgo/nestjs-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/adrian-d-hidalgo/nestjs-mcp-server/specification)<a href="https://agentmods.dev/commands/adrian-d-hidalgo/nestjs-mcp-server/specification"><img src="https://agentmods.dev/badge/commands/adrian-d-hidalgo/nestjs-mcp-server/specification.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02485 |
| Opus 5 | $0.00039 | $0.01242 |
| Sonnet 5 | $0.00015 | $0.00497 |
| Haiku 4.5 | $0.00008 | $0.00248 |
Grade A, and why
specification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WHERE THE SPECIFICATION GOES — this is the whole point of the stage, so it is stated first:
| Artifact | Written to | Contains |
|---|---|---|
spec.md |
.project/tasks/issue-<N>/ |
The technical analysis — the source of truth |
test-plan.md |
.project/tasks/issue-<N>/ |
The QA / acceptance plan /develop will execute |
The GitHub issue is READ, never written. No pointer, no summary, no comment, no label change — nothing. The issue is the requirement as its author wrote it; the specification is your local analysis of how to satisfy it. Two artifacts, two owners, no synchronisation between them and therefore no way for them to disagree.
You have no GitHub write tool in allowed-tools, deliberately. If you find yourself wanting to
put the SPEC — or a summary of it, or a link to it — into the issue, that is the design saying no.
The specifier agent is the executor — it inspects the code, resolves real names, decides the
Public API and SemVer impact, and records the architecture/security findings. You invoke it; you
never replicate its work inline.
There is no subtask stage. One repository, one published package — Caperifai's work-breakdown stage has no equivalent here. One issue is one unit of work.
For anything unclear — an acceptance criterion that doesn't say what success looks like, a capability whose exported shape was never decided, a bug with no root cause yet — ask. Never invent the scope, the diagnosis, an acceptance criterion, or a dependency.
A bug issue with no root cause is not ready to spec. Point at /debug <#N> first: a SPEC built
on a guessed cause specifies the wrong fix, and does it in a form that looks authoritative.
"Not ready to spec" is a valid, useful outcome. If the requirement admits several materially different designs and the choice was never made, the SPEC says so and names the specific question that must be answered — it does not invent a design that reads as decided. That outcome still gets written: the analysis is worth keeping, and the named question is the deliverable.
-
Read the issue AND its comments (
issue_read,method: "get"then"get_comments") — its requirement and its full acceptance criteria. In this repository the load-bearing constraints frequently live in comments, not the body. Read only; you are not going to write back. -
Check the workspace for prior work —
.project/tasks/issue-<N>/. This is a re-entry check, and getting it wrong discards decisions the user already made:spec.mdexists → report what it says and ask whether to refine it (thespec-drivenskill's Refine action) or leave it. Never blind-overwrite:.project/is gitignored, so there is no diff and no history to recover a dropped section from.notes.mdexists → read it. It holds what was already tried and ruled out; re-proposing a rejected approach is the specific waste it exists to prevent.verification.mdexists → development already ran against the current SPEC. Say so before changing anything underneath it: a refine that moves the approach invalidates evidence already gathered, and the user needs to know which criteria would have to be re-proven.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 153 lines · 77 tokens per session scan A 0e7f601358d0
specification is a command published in the GitHub repository adrian-d-hidalgo/nestjs-mcp-server (38 stars, last pushed 1mo ago), licensed MIT. It adds 77 tokens to every session and 2,485 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
qa-changes
This skill should be used when the user asks to "QA a pull request", "test PR changes", "verify a PR works", "functionally test changes", or when an automated workflow triggers QA validation of code changes. Provides a structured methodology for setting up the environment, exercising changed behavior, and reporting…
verify
Run repository verification using the verification-loop skill.
test-coverage
Analyze test coverage and identify the highest-value gaps to fill.
tdd
A command that follows test-driven development (TDD), a method where you write tests before the code they check. It moves through writing a failing test, adding the smallest implementation, and then improving the code.
check-dev
Type-check a Z specification with fuzz.
laravel-playwright
E2E Playwright patterns; use the laravel:e2e-playwright skill exactly as written.