agentmods.dev

sdlc-spec-status

sdlc-spec-status is a command for Claude Code from MCKRUZ/claude-code-sdlc. It costs 0 tokens per session (1,126 once invoked), scanned A, original, MIT.

A command that reports where a software specification is in its pull request. A pull request is a proposed code change on a code-hosting service; the report includes checks, grading, security review, approvals, and merge state.

In plain words
What is it for?
Use it to inspect whether a specification has a pull request, whether checks and reviews passed, whether it was approved, and whether it merged.
Why use it?
It provides the status recorded by the code host without manually changing the status or making a gate decision.

Command for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the claude-code-sdlc plugin — 10 skills, 32 commands, 21 agents, 1 hook shipped together

not rated 8repo changed 9d ago A scan 0 tokens original MIT

Good fit Use it to inspect whether a specification has a pull request, whether checks and reviews passed, whether it was approved, and whether it merged.

Compare 6 commands from other repositories ↓
View source ↗ MCKRUZ/claude-code-sdlc
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add MCKRUZ/claude-code-sdlc
Claude Code
/plugin install claude-code-sdlc

Made for: Claude Code.

Or install claude-code-sdlc, the plugin that ships this one along with the rest of its 10 skills, 32 commands, 21 agents, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sdlc-spec-status

README.md
[![agentmods](https://agentmods.dev/badge/commands/mckruz/claude-code-sdlc/sdlc-spec-status/github.svg)](https://agentmods.dev/commands/mckruz/claude-code-sdlc/sdlc-spec-status)
Your own site
<a href="https://agentmods.dev/commands/mckruz/claude-code-sdlc/sdlc-spec-status"><img src="https://agentmods.dev/badge/commands/mckruz/claude-code-sdlc/sdlc-spec-status/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for sdlc-spec-status

Your own site · 80×15
<a href="https://agentmods.dev/commands/mckruz/claude-code-sdlc/sdlc-spec-status"><img src="https://agentmods.dev/badge/commands/mckruz/claude-code-sdlc/sdlc-spec-status.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,126 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.01126
Opus 5.5 $0.00000 $0.00450
Sonnet 5.5 $0.00000 $0.00225
Haiku 4.5 $0.00000 $0.00113

Measured 9d ago against content hash 6660534d8e6b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sdlc-spec-status scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/sdlc-spec-status.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/sdlc-spec-status — Where a Spec Actually Is

Report a spec's status read from its pull request — checks, whether the grader ran and its verdict, whether a security review was required and its result, approvals, and whether it merged. This reads the code host — GitHub through gh or Azure DevOps through az, whichever the repository's origin remote is on; it never sets a status by hand and never votes on a gate.

Instructions

  1. Resolve mode and repo root:

    • Workflow mode (default): look for .sdlc/state.yaml. The repo root is the directory containing .sdlc/.
    • Standalone mode (--repo <path>, or no .sdlc/ found): operate on the given repo.

  2. Run the report (the command owns the script — the user never calls it directly):

    uv run --project ${CLAUDE_PLUGIN_ROOT}/scripts ${CLAUDE_PLUGIN_ROOT}/scripts/spec_status.py \
  --repo <repo-root> --spec <repo-root>/specs/NNNN-name.md

    In workflow mode pass --state .sdlc/state.yaml instead of --repo.

    The host is detected from origin (then SDLC_CODE_HOST, then .sdlc/code-host.yaml). Pass --host github|azure-devops|none only when the user asks to override it for this run; none tries gh, as every repository did before the Azure DevOps provider existed.

  3. Read the result, don't re-interpret it:

    • No pull request found — the spec hasn't been handed off, or the branch hasn't been pushed yet. Not an error; say so plainly.
    • Code-host data unavailable — report exactly that, with the local status the spec file itself carries, and say the rest is unavailable. Never present this as "no PR yet" or "not started" — those are a different, more definite claim than "couldn't check". The report's host block says which CLI was tried and why it could not answer (not_installed, extension_missing, signed_out, or unknown when nothing could be determined); repeat that, and never tell an Azure DevOps project to sign in to gh.
    • On Azure DevOps, a reviewer shown by email rather than handle — Azure DevOps names people by sign-in identity (UPN). A reviewer resolves to an @handle only when their roster entry in .sdlc/team.yaml carries a matching email:; otherwise the UPN is shown as-is. That is the honest reading, not a bug — suggest adding the email: rather than guessing who it is from the name. updatedAt and vote times read null on Azure DevOps because the host does not record them.
    • Grader ran, but no readable verdict — report this as-is (likely still running, or the block is malformed). Don't guess a verdict from the prose above the block; if the machine-readable ## Acceptance Check Verdicts block and the prose ever disagree, the block is authoritative, per the grader's own rubric.
    • Waiting on — this is the one line to lead with when a human asks "where is this." Repeat it verbatim; don't paraphrase it into a different claim.
    • status: merged committed — mention it happened; this is the tool's one write, and it only fires once the PR actually merged.

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago Changed · +18 lines 6660534d8e6b
  2. 21d ago First seen · 54 lines · 0 tokens per session scan A 73ce360fedee

Subscribe to this mod's changes

sdlc-spec-status is a command published in the GitHub repository MCKRUZ/claude-code-sdlc (8 stars, last pushed 9d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,126 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.

Git and workflowProject management
Related

Other commands, from other repositories

project

Manage projects: register repos, inspect, configure per-project settings, and remove.

Untrivial-ai/agent-orchestrator · 0 tokens

land

Resolve and squash merge one named, currently authorized pull request.

gmickel/flow-next · 13 tokens

standup

Review my git commits from the past workday and generate a standup summary.

vvedantb/eva · 0 tokens

repo-architect

Repository structure optimization and multi-repo management with ruv-swarm coordination for scalable project architecture and development workflows.

ruvnet/ruflo · 0 tokens

sync

Synchronizes your local swarm state with the latest GitHub repository state, updating task statuses and detecting changes.

ruvnet/ruv-FANN · 0 tokens

claim

Claims a GitHub issue for your swarm to work on, preventing conflicts with other swarms.

ruvnet/ruv-FANN · 0 tokens