Knowledge graph CLI for managing features, ADRs, and test criteria as MCP-discoverable artifacts.
SaferSkills independently audited product-cli (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A CLI and MCP server for the Product Framework — specify software as a verifiable What/How graph.
The Product Framework is an open standard for describing a software product as one connected, machine-readable graph: the What (domain model + event model — entities, commands, events, read models, UI steps typed against Abstract Interaction Objects, systems, triggers, Deciders, Projectors), the How (contracts, the screen-composition / reification model, delivery slices), and the typed links between them. The graph can drive generation, gate verification, and explain itself — so "describe this system" is a query, not a stale document.
This repo is the reference tooling: a single Rust binary (product) plus an MCP server that lets an agent author and verify the graph directly. No database, no service — the graph lives as YAML/Turtle under .product/.
$ product init --demo # scaffold + seed the bookstore What model
$ product domain new system sys-shop --system-kind application \
--purpose "consumer e-commerce" --target-classes gui
$ product domain validate --strict # per-node shapes + graph-level completeness
$ product decider derive Order # derive an aggregate's executable signature
$ product decider validate Order-decider
$ product mcp --http # MCP server + a live Event-Modeling web view at /# from source
cargo install --path product-cliproduct init --demo # a worked What model to explore
product domain list # the captured nodes, by kind
product domain show Order # one node and its links
product domain export # the graph as RDF/Turtle
product domain validate # §3.1/§3.2 per-node conformance shapes
product domain validate --strict # + §3.2.0/§3.2.5/§3.4/§4.5 completeness checks
product decider derive Order # §3.3 — derive decide/evolve signature
product decider simulate Order-decider # run its flow-derived scenarios
product guide # where you are + the next stepproduct domain … captures the domain + event model; `productdecider … (§3.3) and product projector … (§3.4) make behaviour and read models executable; product primitive …` (§3.5) names irreducible algorithms.
product how, product slice, product build, product seam,product preview cover the How contract, delivery slices, the screen seam, and the §11/§12 design-system / content-store preview profiles.
the captured What serializes to Turtle (product domain export).
product mcp --http starts the MCP server (framework tools: product_domain_*, product_decider_*, product_projector_*, …) and serves a live web view at / that renders the active What graph as an Event-Modeling swimlane timeline (triggers / commands / views over per-aggregate event streams), with a two-lane structural mode and live SSE refresh.
cargo build
cargo t # full suite (alias: test --no-fail-fast)
cargo clippy -- -D warnings -D clippy::unwrap_usedSee CLAUDE.md for the architecture and contributor workflow, and docs/product-framework-open.md for the spec.
See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.