Speclock

Rules files tell AI what not to change. SpecLock enforces them.

Stop Claude Code, Cursor, Codex, Windsurf, and other AI coding tools from crossing project constraints you already wrote in CLAUDE.md , AGENTS.md , and .cursorrules .

Install · See a block · Claude Code plugin · Website · Saves Wall

Why another rules tool? Rules files are context. They can be forgotten, diluted, or overridden during a long coding session. SpecLock turns those rules into checks that run before edits, shell commands, and commits.

See the difference

CLAUDE.md:  Never modify the authentication system.

You: Add social login to the login page.

Without SpecLock Claude: I'll update the auth flow and add an OAuth provider...

With SpecLock (strict mode) SpecLock: BLOCKED — conflicts with "Never modify the authentication system" Match: login → auth → authentication The action was denied before the files changed.

SpecLock uses semantic conflict detection rather than simple keyword matching. It catches indirect actions such as “clean up old patient data,” “streamline checkout,” or “temporarily disable MFA” when they violate an active constraint.

60-second setup

Run this from the project you want to protect:

npx speclock@latest protect          # reads existing AI rule files; advisory by default

npx speclock@latest doctor # confirms rules, hooks, and integration

When the advisory output looks right, enable blocking:

npx speclock@latest protect --strict

No account is required. SpecLock runs locally by default, and advisory mode never blocks a change.

Install as a Claude Code plugin

Inside Claude Code, run:

/plugin marketplace add sgroy10/speclock

/plugin install speclock@speclock-marketplace

Then protect the current project once:

npx speclock@latest protect          # warnings only

npx speclock@latest protect --strict # block confirmed conflicts

The plugin automatically starts SpecLock's MCP server and checks Claude Code Write, Edit, and Bash actions before execution. It includes all 51 MCP tools and works alongside your existing CLAUDE.md.

Install on other coding agents

SpecLock is packaged for multiple agent ecosystems, but the enforcement level depends on what each host exposes:

MCP-assisted means the agent can call SpecLock before acting; it does not guarantee interception. Use speclock protect --strict and CI when a constraint must be enforced regardless of the client.

SpecLock has a different job from memory and skills: memory recalls context, skills provide procedures, and SpecLock verifies planned actions against explicit constraints. It reduces constraint drift; it cannot guarantee factual correctness or make a model hallucination-free.

Repository installs supported by current clients:

gemini extensions install https://github.com/sgroy10/speclock

copilot plugin marketplace add sgroy10/speclock copilot plugin install speclock@speclock-marketplace

What you get

Proven in the open

• 10,000+ npm downloads before the native Claude Code plugin release.
• 1,043 automated tests across 24 suites, including adversarial conflicts, false-positive cases, patch analysis, enforcement, auth, and compliance.
• MIT licensed and inspectable end to end.
• Local-first defaults with optional remote features clearly separated.

Commands you will use most

speclock protect                      # extract constraints and install project protection

speclock protect --strict # enable hard enforcement speclock doctor # verify the complete setup speclock check "action description" # preview whether an action conflicts speclock add-lock "rule" # add a constraint explicitly speclock list-locks # inspect active constraints speclock enforce hard|advisory # switch enforcement mode speclock mcp install # Claude Code, Cursor, Windsurf, Cline, or Codex speclock wins # create a shareable save receipt

Full reference: npx speclock@latest help

New in v5.8.0

• Portable Agent Plugin packaging for Cursor-compatible discovery.
• Gemini CLI extension packaging with MCP startup and constraint context.
• Codex plugin with a $speclock-guardrails skill and pinned MCP server.
• GitHub Copilot CLI compatibility through the repository marketplace.
• Explicit per-platform enforcement labels: native hook, MCP-assisted, or Git/CI.

More links and project badges

Smithery · Badge gallery · Sandeep Roy

The Problem

AI coding tools have memory now. Claude Code has CLAUDE.md. Cursor has .cursorrules. Mem0 exists.

But memory without enforcement is useless.

Your AI *remembers* you use PostgreSQL — then switches to MongoDB because it "seemed better." Your AI *remembers* your auth setup — then rewrites it while "fixing" a bug. You said "never touch the payment logic" 3 sessions ago — the AI doesn't care.

Remembering is not respecting. No existing tool stops the AI from breaking what you locked.

How It Works

You set constraints. SpecLock enforces them — across sessions, across tools, across teams.

speclock lock "Never modify auth files"           → auto-guards src/auth/*.ts

speclock lock "Database must stay PostgreSQL" → catches "migrate to MongoDB" speclock lock "Never delete patient records" → catches "clean up old data" speclock lock "Don't touch the payment flow" → catches "streamline checkout"

The semantic engine doesn't do keyword matching. It understands:

• "clean up old data" = deletion (euphemism detection)
• "streamline checkout" = modify payment flow (synonym + concept mapping)
• "temporarily disable logging" = disable logging (temporal evasion detection)
• "Update UI and also drop the users table" = hidden violation (compound splitter)

And it knows what's safe:

• "Enable audit logging" when the lock says "Never *disable* audit logging" → no conflict (intent alignment)

Quick Start by Platform

Bolt.new / Aider / Any npm Platform

npx speclock setup --goal "Build my app" --template nextjs

Creates SPECLOCK.md, injects rules into package.json, generates .speclock/context/latest.md. The AI reads these automatically.

Claude Code

Install the plugin using the commands above. For MCP-only setup without the plugin hooks, add this to .mcp.json:

{

"mcpServers": { "speclock": { "command": "npx", "args": ["--yes", "speclock@5.8.0", "serve", "--project", "."] } } }

Cursor / Windsurf / Cline

Same config — add to .cursor/mcp.json or equivalent.

Lovable (No Install)

1. Go to Settings → Connectors → New MCP server
2. Enter URL: https://speclock-mcp-production.up.railway.app/mcp
3. Paste project instructions into Knowledge

---

Why SpecLock Over Alternatives?

Other tools remember. SpecLock enforces.

---

Semantic Engine

Not keyword matching — semantic analysis with an optional Gemini Flash hybrid for grey-zone and cross-domain cases. The repository includes adversarial, false-positive, question-framing, patch-gateway, and diff-analysis test suites.

Category Detection Example Direct violations 100% "Delete the auth module" vs lock "Never modify auth" Euphemistic attacks 100% "Clean up old patient data" = deletion Temporal evasion 100% "Temporarily disable MFA" = disable MFA Dilution attacks 100% Violation buried in multi-part request Compound sentences 100% "