catalog / devtools

Package Manager

Resolve, install and lock dependencies so two machines agree.

17 capabilities 1 sections reference specification

Build against it

# give your agent the catalog — no account, no install
claude mcp add provespec -- npx -y provespec-mcp

# then, from any agent session
spec_get(slug: "package-manager")                → the capability tree
spec_checklist(slug: "package-manager")          → the questions to answer
spec_grade(slug: "package-manager", grades: [...])  → parity % + the gap list

# or just fetch it
curl https://provespec.com/catalog/package-manager/spec.json

Grade every capability below as yes · partial · no · na, with a file reference as evidence. Whatever you leave ungraded counts as missing — the gap list is the work queue.

Or just paste this to your agent

Use the ProveSpec MCP server. Fetch the "package-manager" spec with
spec_get, then walk spec_checklist and grade this repository against it —
one verdict per capability, each with a file reference as the note.
Call spec_grade with the results and give me the gap list as the plan.

If the server is not registered, add it first:
  claude mcp add provespec -- npx -y provespec-mcp

The specification

AI 17

Manifest
  • ✓ Declared dependencies with version ranges runtime, dev, peer, optional
  • ✓ Scripts with a documented lifecycle
Resolution
  • ✓ Semver range resolution
  • ✓ Conflict resolution strategy stated hoisting or isolation
  • ✓ Peer dependency checking
  • ✓ Overrides to force a transitive version
Lockfile
  • ✓ Exact resolved versions with integrity hashes
  • ✓ Reproducible install from the lockfile alone the whole point
  • ✓ Frozen-lockfile mode for CI fails rather than updates
Install
  • ✓ Content-addressed cache; offline install
  • ✓ Parallel fetch and extraction
  • ✓ Lifecycle scripts opt-in for untrusted packages the supply-chain surface
Workspaces
  • ✓ Multiple packages in one repository with internal linking
  • ✓ Run a script across workspaces in dependency order
Trust
  • ✓ Audit against a vulnerability database
  • ✓ Provenance or signature verification
Publish
  • ✓ Publish with a dry-run and a file allowlist ship what you meant to ship
Open in Parity → Download spec.json All 102 specs