Built for Cursor & Claude Code users

Your AI agent forgot the auth check three commits ago.

As your codebase grows, AI-generated changes silently drop requirements you set on day one — auth guards, input validation, tenant scoping. SpecLock remembers your intent and re-verifies every change against it, flagging constraint decay before you merge.

Start free — 20 checks/mo See a live check

No credit card. 1 repo free forever. Runs offline-first — works even without an LLM key.

speclock check · PR #214

✓ validate-request-bodypass

✓ rate-limit-public-routespass

✗ auth-required-on-writesDECAYED

L42 touches a DELETE handler but is missing an authentication check. This constraint was honored 38 commits ago.

- const session = await auth()

1 of 3 constraints decayed — merge blocked.

Generic linters can't help

ESLint checks style, not whether your delete endpoint still requires auth. Intent isn't a lint rule.

Reviews miss the slow drift

Each diff looks fine in isolation. The decay only shows up across 40 commits — exactly what humans skim past.

The agent doesn't remember

Your spec lived in one prompt weeks ago. The model has no memory of it. SpecLock does.

Three steps to lock your spec

1. Write your constraints

Capture the rules that must always hold: 'every write verifies the session', 'all bodies are zod-validated', 'queries scope by userId'. Plain English.

2. Connect your code

Paste a file or diff, or wire the GitHub Action / CI webhook. SpecLock re-checks the change against every constraint.

3. Catch the decay

Get a per-constraint verdict with the exact line of evidence. Block the merge when a guard goes missing.

CI-native

Block constraint decay in the PR

Drop the SpecLock GitHub Action into any repo. It runs on every pull request, fails the check when a constraint decays, and (on Team) comments the exact diff that broke your intent.

Get the Action

# .github/workflows/speclock.yml
name: SpecLock
on: [pull_request]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: speclock/verify-action@v1
        with:
          api-key: ${{ secrets.SPECLOCK_API_KEY }}
          repo-id: ${{ vars.SPECLOCK_REPO_ID }}
          fail-on: decayed

Start free. Pay when it saves you.

One caught auth regression pays for a year of Pro.

Free

For solo experiments

$0USD/month

1 repository
20 constraint checks / month
Manual checks in dashboard
Heuristic + LLM engine

Start free

Pro

Team

For small dev shops

$49USD/month

Everything in Pro
Automatic PR comments with decay diff
Up to 10 seats
Shared spec library
Priority support

Start team trial

“I shipped a refactor my agent generated. Three endpoints quietly lost their auth guard. SpecLock caught all three before the PR merged.”

— Early access user, 2-person SaaS

(Beta testimonial. Be the next one — first 50 Pro users get founder pricing.)

Lock your spec in two minutes

Create a constraint, paste a diff, watch SpecLock catch the drift. Free tier, no card.

Start free