Security-Driven Hardening: Blue Spec
Blue Spec helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.
- Blue Spec works with projects in any programming language and supports 37 agents
Table of Contents
Get Started
Install
Blue Spec adapts to your environment, whether it is a new project or an existing one.
npx -y blue-spec@latest init- Blue Spec runs on Node.js under the hood, you use whatever language you want
Commands
Once Blue Spec is set up in your project, your AI agent unlocks a set of slash commands:
| # | Command | What it does for you |
|---|---|---|
| 1 | /bluespec.charter | Sets your project's security rules, proposed for you or shaped by what you say |
| 2 | /bluespec.detect | Reads your code and maps what your system does and where the risks are |
| 3 | /bluespec.plan | Turns what detect found into a defense plan, with a fix for each finding |
| 4 | /bluespec.harden | Applies the plan's fixes to your code, safely and one at a time |
| 5 | /bluespec.verify | Proves each applied fix holds and closes out the ones that do |
Each command builds on the previous, so following the list top to bottom is all it takes.
Special commands
| Command | What it does |
|---|---|
| /bluespec.prove | Turns each detected finding into a runnable proof for responsible disclosure |
| /bluespec.specialize | Specializes Blue Spec in a new security sub-skill from articles, exploits, or topics |
| /bluespec.repair | Repairs Blue Spec's internal tracking |
Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have
See the full documentation for usage examples and more.
Requirements
You will need these tools installed on your system:
- Node.js (LTS)
- At least one of the Supported Agents
Security Policy
Please check the SECURITY.md.
Contributing
Coming Soon.
Acknowledgements
Partners
Help Blue Spec grow by becoming a partner
Supporters
Really thanks to everyone who has supported and keeps supporting my work.
Support Blue Spec by becoming a sponsor too
License
Blue Spec is under the MIT License.
Copyright 2026-present Weslley Araújo and contributors.
Disclaimer
Blue Spec is an independent open-source project and is not affiliated with, endorsed by, or associated with Bluespec, Inc. or the Bluespec Hardware Description Language (HDL) and its compiler (
bsc).The project name "Blue Spec" comes from Blue Team (defensive security) and Spec-Driven Development. It refers to an AI-assisted security hardening tool for software projects, a different domain from Bluespec, Inc., which provides RISC-V processor IP and hardware design tools.
"Bluespec" is a trademark of Bluespec, Inc. All other product names, trademarks, and registered trademarks mentioned are the property of their respective owners and are used for identification purposes only.