draft

skill
Security Audit
Fail
Health Pass
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 33 GitHub stars
Code Fail
  • rm -rf — Recursive force deletion command in graph/analyze-repo.sh
  • child_process — Shell command execution capability in graph/build.js
  • execSync — Synchronous shell command execution in graph/build.js
  • process.env — Environment variable access in graph/build.js
  • fs module — File system access in graph/build.js
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool provides a context-driven development plugin for AI coding assistants like Claude Code, Cursor, and GitHub Copilot. It runs a three-stage automated review on your code branches to catch bugs, enforce spec compliance, and identify missing test coverage.

Security Assessment
The tool carries a Medium overall risk. It directly executes shell commands via `child_process` and `execSync`, and it contains a recursive force deletion command (`rm -rf`) inside its repository analysis script. While it does not have hardcoded secrets, it accesses the file system and reads environment variables, which are standard requirements for a local code analysis tool. No dangerous explicit permissions are requested, but users should be aware that its active shell execution capabilities could potentially be exploited by malicious inputs. There is no indication of unwanted outbound network requests.

Quality Assessment
The project appears to be actively maintained, with its most recent code push happening today. It uses the permissive and standard MIT license. While it is a relatively new or niche tool with only 33 GitHub stars, the repository is well-documented and provides clear installation instructions for a wide variety of popular development environments.

Verdict
Use with caution — the tool is active and licensed properly, but developers should review the shell execution and file deletion scripts before running them locally.
SUMMARY

Context-Driven Development plugin for Claude Code, Cursor, GitHub Copilot, Gemini

README.md

Draft

Stop shipping AI-generated bugs.
One command runs a three-stage review on your branch — validation, spec compliance, code quality — and writes the missing tests. Free. Open-source. MIT.

GitHub release MIT License Stars

Website · Docs · Methodology · Watch (8 min) · All Videos


The 60-second pitch

Your AI assistant just wrote 200 lines. Some of them are bugs. Some don't match your patterns. Some skip tests.

/draft:review

Three stages, one command:

  1. Validation — runs your tests, lints, type-checks, and surfaces real failures
  2. Spec compliance — checks the diff against the agreed spec, not vibes
  3. Code quality — flags hotspots, blast radius, and missing test coverage using a tree-sitter knowledge graph of your repo

Free. No API keys. No paid tier. No vendor lock-in. Catches the 3 bugs you missed before they hit your reviewer.

Demo coming soon — for now, watch the 8-minute walkthrough.


Install — Claude Code (30 seconds)

/plugin marketplace add mayurpise/draft
/plugin install draft
/draft:init       # 5-phase codebase analysis (one-time)
/draft:review     # ← run this on every branch before you push

That's it. Run /draft for the full command map.

Also works with Cursor, GitHub Copilot, Antigravity, and Gemini →

Cursor

Cursor natively supports the .claude/ plugin structure. Add via Settings > Rules, Skills, Subagents > Rules > New > Add from Github:

https://github.com/mayurpise/draft.git

Then use: @draft init, @draft new-track, @draft implement.

GitHub Copilot

mkdir -p .github && curl -o .github/copilot-instructions.md \
  https://raw.githubusercontent.com/mayurpise/draft/main/integrations/copilot/.github/copilot-instructions.md

Gemini

curl -o .gemini.md https://raw.githubusercontent.com/mayurpise/draft/main/integrations/gemini/.gemini.md

Antigravity IDE

Draft is used globally by installing skills to a central location:

  1. Clone Draft to ~/.gemini/antigravity/skills/draft
  2. Configure ~/.gemini.md to point to the global skills:
**Skill Locations:**
The authoritative Draft implementation skills are located at:
`/Users/mayurpise/.gemini/antigravity/skills/draft/skills`

Beyond /draft:review — 27 more commands

/draft:review is the wedge. Once Draft has indexed your repo, you also get spec-driven planning, TDD-enforced implementation, exhaustive bug hunting, deep architectural audits, and 23 more commands covering the full development lifecycle.


What You Get

Command What It Does
/draft Overview, intent mapping, and command reference
/draft:init Analyze codebase, create context files + state tracking
/draft:index Aggregate monorepo service contexts
/draft:new-track Collaborative spec + plan with AI
/draft:decompose Module decomposition with dependency mapping
/draft:implement TDD workflow with checkpoints
/draft:coverage Code coverage report (target 95%+)
/draft:review 3-stage review (validation + spec compliance + code quality)
/draft:deep-review Enterprise-grade module lifecycle and ACID audit
/draft:bughunt Exhaustive 14-dimension defect discovery with taint tracking
/draft:learn Discover coding patterns, update guardrails
/draft:adr Architecture Decision Records
/draft:status Show progress overview
/draft:revert Git-aware rollback
/draft:change Handle mid-track requirement changes
/draft:debug Structured debugging: reproduce, isolate, diagnose, fix
/draft:quick-review Lightweight 4-dimension code review
/draft:deploy-checklist Pre-deployment verification with rollback triggers
/draft:testing-strategy Test plan design with coverage targets
/draft:tech-debt Technical debt analysis across 6 dimensions
/draft:standup Git activity standup summary (read-only)
/draft:incident-response Incident lifecycle: triage, communicate, mitigate, postmortem
/draft:documentation Technical docs: readme, runbook, api, onboarding
/draft:jira-preview Generate Jira export for review
/draft:jira-create Push issues to Jira via MCP
/draft:tour Interactive architecture mentorship and codebase walk-through
/draft:impact ROI analytics tracking friction and timeline metrics
/draft:assist-review Summarize intent and highlight structural PR risks for reviewers

See full command reference →

Recommended next step after install: run /draft:init to index your repo, then /draft:review on any branch with AI-generated changes. Once you've seen what it catches, explore the rest.


Built-in Code Intelligence

Draft ships with a knowledge graph engine that gives every command precise structural context — module boundaries, call graphs, dependencies, hotspots — without you having to install or configure anything.

graph --repo . --query --file src/auth/login.go --mode impact
# → blast radius: which files, which modules, which tests/docs/configs
Capability What it provides
Multi-language extraction Tree-sitter parsers for Go, Python, TypeScript/JS, C/C++, proto + ctags fallback for Java/Rust/Ruby/Swift
Call graph with confidence Every call edge tagged direct (bare identifier) or inferred (member call) so review/bughunt can weight findings
Impact analysis Blast-radius BFS with file-class dimension (code/test/doc/config) — answers "what breaks if I change this?"
Cycle detection Iterative DFS — flags circular module dependencies before they bite
Hotspot ranking Complexity × fan-in score so high-risk files get extra scrutiny
Atomic incremental builds Per-module SHA-256 hashing; only changed modules re-extract
Track impact memory metadata.json.impact snapshots each completed track's blast radius — /draft:new-track flags overlap with recent work

The graph powers /draft:impact, enriches /draft:bughunt and /draft:review, and is consumed by skills via core/shared/graph-query.md. See graph/ for the engine source.

Deterministic helper tools

Skills also call into 14 shell helpers under scripts/tools/ for mechanical work — git metadata, file classification, test-framework detection, hotspot ranking, freshness checks, ADR indexing. All emit JSON, follow a uniform exit-code contract, and degrade gracefully when their input source is unavailable.


How It Works

┌─────────────────────────────────────────────────────────────┐
│                        /draft:init                          │
│    5-phase codebase analysis + signal detection + state     │
│  architecture.md + .ai-context.md + .state/ (freshness,    │
│                   signals, run memory)                      │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                      /draft:new-track                       │
│            AI-guided spec.md + phased plan.md               │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                     /draft:implement                        │
│              RED → GREEN → REFACTOR (repeat)                │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                      /draft:review                          │
│        Three-stage review (validation + spec + quality)     │
└─────────────────────────────────────────────────────────────┘

         /draft:init refresh  ←── incremental: only re-analyze
                                   files with changed hashes

Full workflow →


Why Draft?

AI tools are fast but unstructured. Draft applies Context-Driven Development to impose clear boundaries: explicit context, phased execution, and built-in verification, ensuring outputs remain aligned, predictable, and production-ready.

product.md       →  "Build a task manager"
tech-stack.md    →  "React, TypeScript, Tailwind"
architecture.md  →  Comprehensive: 28 sections + 5 appendices, Mermaid diagrams (source of truth)
.ai-context.md   →  200-400 lines: condensed from architecture.md (token-optimized AI context)
.state/          →  freshness hashes, signal classification, run memory (incremental refresh)
spec.md          →  "Add drag-and-drop reordering"
plan.md          →  "Phase 1: sortable, Phase 2: persist"

Each layer narrows the solution space. By the time AI writes code, decisions are made.

Incremental refresh: After initial setup, /draft:init refresh uses stored file hashes and signal classification to only re-analyze what changed — no full re-scan needed.

Read methodology →


Contributing

Source of Truth

  1. core/methodology.md — Master methodology
  2. skills/<name>/SKILL.md — Command implementations
  3. integrations/ — Auto-generated (don't edit)

Update Workflow

# 1. Edit core/methodology.md or skills/*/SKILL.md
# 2. Rebuild integrations
./scripts/build-integrations.sh

Full architecture →


Star History

Star History Chart


MIT License

Credits: Inspired by gemini-cli-extensions/conductor

Reviews (0)

No results found