Blue Spec helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.
- Blue Spec works with projects in any programming language and supports 37 agents ✨
- 🌱 Get Started
- 📦 Requirements
- 🖖 Acknowledgements
- 🧑⚖️ License
Blue Spec adapts to your environment, whether it is a new project or an existing one.
npx -y blue-spec@latest init- Blue Spec runs on Node.js under the hood, you use whatever language you want 🃏
Once Blue Spec is set up in your project, your AI agent unlocks a set of slash commands:
| # | Command | What it does for you |
|---|---|---|
| 1 | /bluespec.charter | Sets your project's security rules, proposed for you or shaped by what you say |
| 2 | /bluespec.detect | Reads your code and maps what your system does and where the risks are |
| 3 | /bluespec.plan | Turns what detect found into a defense plan, with a fix for each finding |
| 4 | /bluespec.harden | Applies the plan's fixes to your code, safely and one at a time |
| 5 | /bluespec.verify | Proves each applied fix holds and closes out the ones that do |
Each command builds on the previous, so following the list top to bottom is all it takes.
| Command | What it does |
|---|---|
| /bluespec.prove | Turns each detected finding into a runnable proof for responsible disclosure |
| /bluespec.specialize | Specializes Blue Spec in a new security sub-skill from articles, exploits, or topics |
| /bluespec.skills | Loads an on-demand security sub-skill |
| /bluespec.repair | Repairs Blue Spec's internal tracking |
| /bluespec.list | Lists all finding Blue Spec is tracking, by name |
Tip
Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻♂️
Important
See the full documentation for usage examples and more.
You will need these tools installed on your system:
- Node.js (LTS)
- At least one of the Supported Agents
Please check the SECURITY.md.
🚧 Coming Soon.
Help Blue Spec grow by becoming a partner 🖖
Really thanks to everyone who has supported and keeps supporting my work.
Support Blue Spec by becoming a sponsor too ✨
Blue Spec is under the MIT License.
Copyright © 2026-present Weslley Araújo and contributors.
Important
Blue Spec is an independent open-source project and is not affiliated with, endorsed by, or associated with Bluespec, Inc. or the Bluespec Hardware Description Language (HDL) and its compiler (bsc).
The project name "Blue Spec" comes from Blue Team (defensive security) and Spec-Driven Development. It refers to an AI-assisted security hardening tool for software projects, a different domain from Bluespec, Inc., which provides RISC-V processor IP and hardware design tools.
"Bluespec" is a trademark of Bluespec, Inc. All other product names, trademarks, and registered trademarks mentioned are the property of their respective owners and are used for identification purposes only.