What is speclock CLAUDE.md?

Project instructions for developing and releasing the speclock package. They require version changes, publishing, deployment, and health checks after source changes.

Use them when changing speclock source code and preparing a release through npm, Git, Railway, and the production health check.

They help prevent releases where public package files, the deployed service, and version information do not match.

speclock CLAUDE.md — Instructions file by sgroy10

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/sgroy10/speclock/claude-md

Clone the repo

git clone --depth 1 https://github.com/sgroy10/speclock

Per session 521 This file is loaded in full into every session.

When invoked 521 The same file — it is already loaded in full.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00521	$0.00521
Opus 5	$0.00260	$0.00260
Sonnet 5	$0.00104	$0.00104
Haiku 4.5	$0.00052	$0.00052

Measured 2d ago against content hash db16488a9c95, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

speclock CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s https://speclock-mcp-production.up.railway.app/health

CLAUDE.md · 72 lines

What it actually says

SpecLock Development Rules

MANDATORY RELEASE PROCESS

EVERY code change that touches src/ files MUST follow this exact sequence. NO EXCEPTIONS. Do NOT push without completing ALL steps.

Step 1: Version Bump (ALL 7 files)

package.json
src/mcp/http-server.js      → const VERSION = "X.Y.Z"
src/mcp/server.js            → const VERSION = "X.Y.Z"
src/core/compliance.js       → const VERSION = "X.Y.Z"
src/cli/index.js             → SpecLock vX.Y.Z
src/dashboard/index.html     → TWO places (header + footer)

Step 2: Commit + Push

git add <files>
git commit -m "vX.Y.Z — description"
git push origin main

Step 3: npm Publish

npm publish

Step 4: Git Tag

git tag vX.Y.Z
git push origin vX.Y.Z

Step 5: Railway Deploy

railway up

Step 6: Verify

curl -s https://speclock-mcp-production.up.railway.app/health
# Must show new version
npm view speclock version
# Must show new version

If you skip ANY step, the release is INCOMPLETE and users will get stale code.

Version File Quick Reference

File	What to change
`package.json`	`"version": "X.Y.Z"`
`src/mcp/http-server.js`	`const VERSION = "X.Y.Z"`
`src/mcp/server.js`	`const VERSION = "X.Y.Z"`
`src/core/compliance.js`	`const VERSION = "X.Y.Z"`
`src/cli/index.js`	`SpecLock vX.Y.Z` in printHelp
`src/dashboard/index.html`	`vX.Y.Z` in header AND footer

SpecLock Context

Always call speclock_session_briefing at start of session and speclock_session_summary before ending.

Key Facts

npm package: speclock
Railway: https://speclock-mcp-production.up.railway.app
GitHub: sgroy10/speclock
Smithery: sgroy10/speclock
Author: Sandeep Roy

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 72 lines · 521 tokens per session scan A db16488a9c95

Subscribe to this mod's changes

speclock CLAUDE.md is an instructions file published in the GitHub repository sgroy10/speclock (25 stars, last pushed 15d ago), licensed MIT. It adds 521 tokens to every session, about $0.0026 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

ai-coding claude-code cursor developer-tools mcp mcp-server

speclock CLAUDE.md