🌊 Security-Driven Hardening: Blue Spec
Blue Spec helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.
- Blue Spec works with projects in any programming language and supports 37 agents ✨
Love Blue Spec? Give us a ⭐ on GitHub!
Table of Contents
- 🌊 Get Started
- 📦 Dashboard | CLI
- 💬 Slash Commands
- 💽 Requirements
- 🔐 Security
- 🖖 Acknowledgements
- 🧑⚖️ License (MIT)
Get Started
Blue Spec adapts to your environment, whether it is a new project or an existing one.
[!TIP]
No API keys are needed, it runs directly through your own agent (Claude, Codex, and more).
Dashboard
For an interactive live view, follow-up, and maintenance, run:
npx -y blue-spec@latest
It serves a dashboard and opens it in a random port:
- Live Reload
- Private and Local
- Install, Pull, Update, and Manage all Blue Spec features directly from your browser
- No
node_modulesorpackage.jsonis needed 📦
[!TIP]
- 🚪 Use
--portor-pto specify a custom port.- ⏏️ Press
Ctrl+Cto stop.
CLI
› Install
npx -y blue-spec@latest init
- 🃏 Blue Spec runs on Node.js under the hood, you use whatever language you want.
› Update
To update Blue Spec's own files and its commands to their latest versions, run:
npx -y blue-spec@latest update
[!TIP]
Your charter, the phase artifacts, and any custom specializations stay untouched.
› Pull
When you clone or fork a project that already has Blue Spec, run pull to install its files from the manifest:
npx -y blue-spec@latest pull
[!TIP]
💡 Think of it as the Blue Spec equivalent of
npm i,pip install -r requirements.txt, and the like.
Slash Commands
Once Blue Spec is set up in your project, your AI agent unlocks a set of slash commands:
› Development flow
Secure the work as you build it, guided by the charter, with no flow to follow:
| Command | What it does for you |
|---|---|
| /bluespec | Enforces security along with your development, on any prompt, at any time |
- Pull in the on-demand specializations in real time while your agent works.
- Combine it with the /bluespec.charter command to shape every build around your project's own security rules.
› The Blue Team flow
These five run in order. Each builds on the previous, so following the list top to bottom is all it takes:
| # | Command | What it does for you |
|---|---|---|
| 1 | /bluespec.charter | Sets your project's security rules, proposed for you or shaped by what you say |
| 2 | /bluespec.detect | Reads your code and maps what your system does and where the risks are |
| 3 | /bluespec.plan | Turns what detect found into a defense plan, with a fix for each finding |
| 4 | /bluespec.harden | Applies the plan's fixes to your code, safely and one at a time |
| 5 | /bluespec.verify | Proves each applied fix holds and closes out the ones that do |
› Special commands
| Command | What it does |
|---|---|
| /bluespec.specialize | Specializes Blue Spec in a new security sub-skill from articles, exploits, or topics |
| /bluespec.prove | Turns each detected finding into a runnable proof for responsible disclosure |
[!TIP]
Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻♂️
[!IMPORTANT]
See the full documentation for usage examples and more.
Requirements
You will need these tools installed on your system:
- Node.js (LTS)
- At least one of the Supported Agents
Security
To details, report a vulnerability, and see the supported versions, see the Security Policy.
Contributing
🚧 Coming Soon.
Acknowledgements
Partners
Partners get an exclusive logo across the repositories and landing pages, plus a spot on a dedicated partners page.
Help my work grow by becoming a partner 🖖
Supporters
Really thanks to everyone who has supported and keeps supporting my work.
Support my work by becoming a sponsor too ✨
License
Blue Spec is under the MIT License. Copyright © 2026-present Weslley Araújo and contributors.
[!IMPORTANT]
Disclaimer
Security-Driven Hardening: Blue Spec is an independent open-source project and is not affiliated with, endorsed by, or associated with Bluespec, Inc. or the Bluespec Hardware Description Language (HDL) and its compiler (
bsc).The project name "Blue Spec" comes from Blue Team (defensive security) and Spec-Driven Development. It refers to an AI-assisted security hardening tool for software projects, a different domain from Bluespec, Inc., which provides RISC-V processor IP and hardware design tools.
"Bluespec" is a trademark of Bluespec, Inc. All other product names, trademarks, and registered trademarks mentioned are the property of their respective owners and are used for identification purposes only.