Spec Kitty AI Agent

by spec-kitty• 1.7k•• Scanned•Claim this listing•Request removal
Productivity & Workflowagentic codingai agentsai coding workflowai development dashboardai progress tracking

Spec-Driven Development with organizational governance. Specs tell AI agents what to build; Charter governs how they build it. Git-native missions, enforceable workflows, and consistent engineering standards across AI coding agents and harnesses.

Spec Kitty is an open-source ai agent by spec-kitty, written mainly in Python, with 1,711 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 9815a18. Seen able to run dynamic code. Scan policy

Scanned
Full scan at 9815a18 · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit17 known vulnerabilitieswarn
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (164)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    .kittify/overrides/missions/action_index.py:45
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    .kittify/overrides/missions/repository.py:243
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    .kittify/overrides/missions/repository.py:286
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    .kittify/overrides/missions/repository.py:309
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/activation_ledger.py:422
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/catalog.py:245
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/charter_yaml_io.py:618
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/compiler.py:867
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/compiler.py:966
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/compiler.py:1958
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/consistency_check.py:345
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/evidence/corpus_loader.py:45
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/evidence/orchestrator.py:127
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/interview.py:386
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/interview.py:444
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/interview.py:592
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/interview.py:797
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/kind_vocabulary.py:156
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/language_authority.py:402
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/language_vocabulary.py:72
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/org_expected_artifacts.py:112
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/org_pack_discovery.py:447
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/pack_manager.py:435
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/pack_manager.py:748
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/synthesizer/generated_artifact_adapter.py:64
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/synthesizer/provenance.py:89
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/hasher.py:85
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/agent_profiles/repository.py:525
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/agent_profiles/repository.py:1109
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/agent_profiles/validation.py:43
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/drg/loader.py:61
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/drg/project_scan.py:82
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/missions/action_index.py:95
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/missions/repository.py:338
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/missions/repository.py:385
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/missions/repository.py:420
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/packs/builtin_manifest.py:64
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/packs/pack_manifest.py:239
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/spdd_reasons/activation.py:279
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/charter/offering/versioning.py:195
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/glossary/entity_pages.py:85
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/glossary/scope.py:81
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/glossary/scope.py:152
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/glossary/strictness.py:103
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/kernel/schema_utils.py:71
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/kernel/yaml_io.py:76
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/kernel/yaml_io.py:77
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/analysis_report.py:351
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/bulk_edit/occurrence_map.py:217
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/calibration/walker.py:357
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/calibration/walker.py:402
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/charter_pack_synthesizer/provenance.py:95
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/charter_runtime/freshness/computer.py:376
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/charter_runtime/lint/_drg.py:37
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/charter_runtime/lint/checks/org_layer.py:374
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/charter_runtime/preflight/config.py:66
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/_bytecode_doctor.py:126
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/_charter_pack_collect.py:118
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/_charter_pack_collect.py:164
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/agent/tasks_move_task_gates.py:170
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/charter/_status_collectors.py:155
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/glossary.py:804
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/glossary.py:898
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/cli/commands/init.py:862
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/compat/config.py:129
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/compat/registry.py:74
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/config/path_conventions.py:73
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/consolidation/config.py:59
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/context/resolver.py:51
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/contracts/registry.py:187
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/core/agent_config.py:87
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/core/agent_config.py:171
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/core/wps_manifest.py:110
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/doc_analysis/gap_analysis.py:131
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/git/protection_policy.py:385
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/identity/project.py:464
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/identity/project.py:560
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/migration/verdict_provenance_backfill.py:262
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/policy/config.py:135
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/retrospective/gate.py:171
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/retrospective/mode.py:176
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/retrospective/policy.py:295
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/retrospective/policy.py:506
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/retrospective/reader.py:127
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/review/artifacts.py:335
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/review/baseline.py:197
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/review/lock.py:430
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/status/dup_key_repair.py:203
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/tracker/config.py:313
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/tracker/config.py:330
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/tracker/config.py:365
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_0_9_4_roo_deprecation.py:45
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_0_9_4_roo_deprecation.py:163
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_2_0_1_tool_config_key_rename.py:28
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_2_0_1_tool_config_key_rename.py:57
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_0rc35_activate_builtin_mission_types.py:124
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_0rc35_activate_builtin_mission_types.py:188
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_0rc35_strip_selection_config.py:51
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_0rc35_strip_selection_config.py:105
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_8_provision_kitty_env.py:218
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_2_8_provision_kitty_env.py:229
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_3_1_context_sources_consolidation.py:162
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_3_3_1_context_sources_consolidation.py:196
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_4_0_0rc7_pack_level_backfill.py:124
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_unify_charter_activation.py:91
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_unify_charter_activation.py:242
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_unify_charter_activation_finalize.py:199
  • medium
    Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/upgrade/migrations/m_unify_charter_activation_finalize.py:209
  • medium
    filelock@3.29.0: 9 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
    uv.lock
  • medium
    mcp@1.29.0: 4 known vulnerabilities
    GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23
    uv.lock
  • medium
    msgpack@1.2.1: 1 known vulnerability
    GHSA-j586-36cw-2gc2
    uv.lock
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    scripts/docs/_inventory.py:65
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    scripts/docs/_inventory.py:157
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    scripts/docs/rename_reconcile.py:122
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    scripts/docs/touched_set_gates.py:137
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    src/charter/activation/synthesizer/fixture_adapter.py:115
  • low
    In tests/examples/docs: Deserializes data with pickle/marshal, which can execute code.
    src/specify_cli/docs/index_model.py:217
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/041-mission-glossary-semantic-integrity/data-model.md:197
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/080-browser-mediated-oauth-cli-auth/contracts/api-ws-token-endpoint.md:51
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/080-browser-mediated-oauth-cli-auth/contracts/oauth-token-endpoint.md:129
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/080-browser-mediated-oauth-cli-auth/data-model.md:312
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/080-browser-mediated-oauth-cli-auth/spec.md:485
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/ci-nightly-interpreter-matrix-45min-timeout-01M3G17F/tasks/WP01-interpreter-matrix-shard-split.md:491
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/ci-nightly-interpreter-matrix-45min-timeout-01M3G17F/plan.md:265
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/cli-boundary-robustness-01M2NQCB/review-evidence/final-provenance-manifest.md:28
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/glossary-seed-file-schema-validation-01KSN752/tasks/WP03-runtime-integration.md:53
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/isolated-home-pin-guard-r1a-01KZNMA3/tasks/WP05-frozen-census/review-cycle-1.md:172
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/reports/test-sanitation/assertive-test-suite-sanitation-01KZME3P/raw/head-census.json:1
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/reports/test-sanitation/assertive-test-suite-sanitation-01KZME3P/raw/base-census.json:1
  • low
    Possible example credential in docs/tests: generic-api-key
    kitty-specs/upgrade-preview-mission-health-01M1V6E1/reviews/ops-review.md:264
  • low
    Possible example credential in docs/tests: generic-api-key
    6 matches in this file
    tests/architectural/_interpreter_shard_roster.py:201
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/architectural/spec_kitty_home_pin_baseline.yaml:4
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/architectural/test_performance_marker_guard.py:783
  • low
    Possible example credential in docs/tests: jwt
    tests/migration/test_mission_state_repair.py:987
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/migration/test_mission_state_repair.py:983
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/specify_cli/context/test_models.py:162
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    site/pnpm-lock.yaml
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    site/pnpm-lock.yaml
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    site/pnpm-lock.yaml
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Spec Kitty alternatives

View more →

Similar ai agents in Productivity & Workflow, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Spec Kitty (this page)
spec-kitty
1.7kMITNov 1, 2026Scanned, no flagged issues
Paperclip
paperclipai
110kMITNov 1, 2026Scanned, no flagged issues
Ppt Master
hugohe3
72kMITOct 30, 2026Scanned, no flagged issues
Llama Index
run-llama
53kMITOct 26, 2026Scanned, see report
Nanobot
HKUDS
50kMITOct 31, 2026Scanned, no flagged issues
Sim
simstudioai
30kApache-2.0Nov 1, 2026Scanned, see report