nestjs-mcp-server: Command for Claude Code

.claude/commands/specification.md

specification is a command for Claude Code from adrian-d-hidalgo/nestjs-mcp-server. It costs 77 tokens per session (2,485 once invoked), scanned A, original, MIT.

A command that turns an accepted GitHub issue into a local technical specification and QA test plan. It reads the issue and code, then saves both documents under .project/tasks/issue-<number>/ without changing GitHub.

In plain words
What is it for?
Use it to inspect an issue, check public API and versioning effects, review SDK types and architecture or security concerns, and record acceptance tests.
Why use it?
It separates the requested outcome from the implementation details and testing work. This gives developers a written plan before they change code.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md.

This is adrian-d-hidalgo/nestjs-mcp-server's own configuration. It tells Claude Code how to work on nestjs-mcp-server itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything nestjs-mcp-server configures →

Reuse

Borrowing it

Nothing to install: this file belongs to adrian-d-hidalgo/nestjs-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/adrian-d-hidalgo/nestjs-mcp-server/main/.claude/commands/specification.md
Clone the repo
git clone --depth 1 https://github.com/adrian-d-hidalgo/nestjs-mcp-server

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for specification

README.md
[![agentmods](https://agentmods.dev/badge/commands/adrian-d-hidalgo/nestjs-mcp-server/specification.svg)](https://agentmods.dev/commands/adrian-d-hidalgo/nestjs-mcp-server/specification)
Your own site
<a href="https://agentmods.dev/commands/adrian-d-hidalgo/nestjs-mcp-server/specification"><img src="https://agentmods.dev/badge/commands/adrian-d-hidalgo/nestjs-mcp-server/specification.svg" alt="Measured on agentmods" height="20"></a>
Per session 77 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,485 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00077 $0.02485
Opus 5 $0.00039 $0.01242
Sonnet 5 $0.00015 $0.00497
Haiku 4.5 $0.00008 $0.00248

Measured 8d ago against content hash 0e7f601358d0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

specification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/specification.md · 153 lines

How it starts

The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.

WHERE THE SPECIFICATION GOES — this is the whole point of the stage, so it is stated first:

Artifact Written to Contains
spec.md .project/tasks/issue-<N>/ The technical analysis — the source of truth
test-plan.md .project/tasks/issue-<N>/ The QA / acceptance plan /develop will execute

The GitHub issue is READ, never written. No pointer, no summary, no comment, no label change — nothing. The issue is the requirement as its author wrote it; the specification is your local analysis of how to satisfy it. Two artifacts, two owners, no synchronisation between them and therefore no way for them to disagree.

You have no GitHub write tool in allowed-tools, deliberately. If you find yourself wanting to put the SPEC — or a summary of it, or a link to it — into the issue, that is the design saying no.

The specifier agent is the executor — it inspects the code, resolves real names, decides the Public API and SemVer impact, and records the architecture/security findings. You invoke it; you never replicate its work inline.

There is no subtask stage. One repository, one published package — Caperifai's work-breakdown stage has no equivalent here. One issue is one unit of work.

For anything unclear — an acceptance criterion that doesn't say what success looks like, a capability whose exported shape was never decided, a bug with no root cause yet — ask. Never invent the scope, the diagnosis, an acceptance criterion, or a dependency.

A bug issue with no root cause is not ready to spec. Point at /debug <#N> first: a SPEC built on a guessed cause specifies the wrong fix, and does it in a form that looks authoritative.

"Not ready to spec" is a valid, useful outcome. If the requirement admits several materially different designs and the choice was never made, the SPEC says so and names the specific question that must be answered — it does not invent a design that reads as decided. That outcome still gets written: the analysis is worth keeping, and the named question is the deliverable.

  1. Read the issue AND its comments (issue_read, method: "get" then "get_comments") — its requirement and its full acceptance criteria. In this repository the load-bearing constraints frequently live in comments, not the body. Read only; you are not going to write back.

  2. Check the workspace for prior work.project/tasks/issue-<N>/. This is a re-entry check, and getting it wrong discards decisions the user already made:

    • spec.md exists → report what it says and ask whether to refine it (the spec-driven skill's Refine action) or leave it. Never blind-overwrite: .project/ is gitignored, so there is no diff and no history to recover a dropped section from.
    • notes.md exists → read it. It holds what was already tried and ruled out; re-proposing a rejected approach is the specific waste it exists to prevent.
    • verification.md exists → development already ran against the current SPEC. Say so before changing anything underneath it: a refine that moves the approach invalidates evidence already gathered, and the user needs to know which criteria would have to be re-proven.

Read the full file on GitHub · 153 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 153 lines · 77 tokens per session scan A 0e7f601358d0

Subscribe to this mod's changes

specification is a command published in the GitHub repository adrian-d-hidalgo/nestjs-mcp-server (38 stars, last pushed 1mo ago), licensed MIT. It adds 77 tokens to every session and 2,485 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.