🌊 Blue Spec: Security-Driven Hardening

Blue Spec helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.

• Blue Spec works with projects in any programming language and supports 37 agents ✨

Table of Contents

• 🌱 Get Started
  • Install
  • Commands
• 📦 Requirements
• 🖖 Acknowledgements
• 🧑‍⚖️ License

Get Started

Install

Blue Spec adapts to your environment, whether it is a new project or an existing one.

npx -y blue-spec@latest init

• Blue Spec runs on Node.js under the hood, you use whatever language you want 🃏

Commands

Once Blue Spec is set up in your project, your AI agent unlocks a set of slash commands:

| # | Command | What it does for you | | --- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | 1 | /bluespec.charter | Sets your project's security rules, proposed for you or shaped by what you say | | 2 | /bluespec.detect | Reads your code and maps what your system does and where the risks are | | 3 | /bluespec.plan | Turns what detect found into a defense plan, with a fix for each finding | | 4 | /bluespec.harden | Applies the plan's fixes to your code, safely and one at a time | | 5 | /bluespec.verify | Proves each applied fix holds and closes out the ones that do |

Each command builds on the previous, so following the list top to bottom is all it takes.

Special commands

| Command | What it does | | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | /bluespec.specialize | Specializes Blue Spec in a new security sub-skill from articles, exploits, or topics | | /bluespec.skills | Loads an on-demand security sub-skill | | /bluespec.repair | Repairs Blue Spec's internal tracking | | /bluespec.list | Lists all finding Blue Spec is tracking, by name |

[!TIP]

Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻‍♂️

[!IMPORTANT]

See the full documentation for usage examples and more.

Requirements

You will need these tools installed on your system:

• Node.js (LTS)
• At least one of the Supported Agents

Security Policy

Please check the SECURITY.md.

Contributing

🚧 Coming Soon.

Acknowledgements

Partners

Help Blue Spec grow by becoming a partner 🖖

Supporters

Really thanks to everyone who has supported and keeps supporting my work.

Support Blue Spec by becoming a sponsor too ✨

License

Blue Spec is under the MIT License. Copyright © 2026-present Weslley Araújo and contributors.