[agents](https://carteblanche.com/index.md?kind=agent) / [code](https://carteblanche.com/index.md?category=code) # spec-compliance-checker what it does Checks one documented requirement against the code that should implement it, and returns a verdict with the lines that evidence it. Writes its analysis to disk and returns a compact record. Use for a single requirement; use the spec-compliance workflow for a whole document. tools it asks for Reads files · Edits files by trailofbits · version 1 · license CC-BY-SA-4.0 We imported this agent from its author’s repository. Is this yours? [Claim this listing](https://carteblanche.com/claim/spec-compliance-checker) Verified · Before and after: 2 models · 1 try per case · [View source](https://github.com/trailofbits/skills/blob/e4dd0bb5b15535f7c5a0834187dffba6ac37e4ff/plugins/spec-to-code-compliance/agents/spec-compliance-checker.md) · [Install from your agent](https://carteblanche.com/connect.md) · [Download .zip](https://carteblanche.com/skills/spec-compliance-checker/download) ## Compare the answers Answers from Claude Sonnet 5.5 and GPT-6.1 Sol · try 1 of 1 Same request, same model, once with the agent’s instructions as its system prompt and once without. Neither could use a tool. Read both and judge for yourself. [Compare the answers](https://carteblanche.com/skills/spec-compliance-checker/compare) ## The models 2 models Claude Sonnet 5.5 made by Anthropic claude-sonnet-5-5 · revision not reported by the provider 1 try per case · tested 7 Nov 2026 GPT-6.1 Sol made by OpenAI gpt-6.1-sol · revision not reported by the provider 1 try per case · tested 7 Nov 2026 ## The tasks written by Carte Blanche **example-1** “Check this requirement: "Password reset tokens must expire 30 minutes after creation and be single-use." Here's the code: def create\_reset\_token(user): token = secrets.token\_urlsafe(32) db.save(ResetToken(user\_id=user.id, token=token, created\_at=now(), used=False)) return token def redeem\_token(token): t = db.get(ResetToken, token=token) if t is None or t.used: raise InvalidToken() t.used = True db.save(t) return t.user\_id Does it comply? Give me a verdict and the lines that back it up.” **example-2** “Single requirement from our API doc: "All list endpoints must return at most 100 items per page, and requests with a limit above 100 must be rejected with HTTP 400." The handler is: @app.get('/orders') def list\_orders(limit: int = 50, offset: int = 0): limit = min(limit, 100) rows = db.query(Order).offset(offset).limit(limit).all() return rows Is this compliant? Please give a verdict and cite the evidence lines.” ## Install Download the .zip and unzip it. Put `spec-compliance-checker.md` here: Claude Code · `~/.claude/agents/` · Every project. For one project only, use .claude/agents/ inside it. It gives the agent the tools it asks for, and no others. Cursor · `~/.cursor/agents/` · Cursor also reads the Claude Code folder above. It has no tools field, so it gives every agent every tool, whatever this one asks for. Codex · Codex’s custom agents are TOML files, not Markdown, so this agent doesn’t install there. Keep its license file beside it, as `spec-compliance-checker.LICENSE`: a name that doesn’t end in .md, since every .md file there is read as an agent. Then start a new session and ask for it by name. Folders checked 6 November 2026. Or [install from your agent](https://carteblanche.com/connect.md): ask it to install `spec-compliance-checker` from Carte Blanche. ## Badge for your README Carte Blanche: Verified Paste this into the agent’s README. It links to this page, and shows how the listing stands whenever it’s loaded. ``` [![Carte Blanche](https://carteblanche.com/badge/spec-compliance-checker.svg)](https://carteblanche.com/skills/spec-compliance-checker) ``` ## About this test - **tested**: 7 Nov 2026 - **version tested**: v1 - **cases**: 2 - **tries per case**: 1 try per case - **run without the agent**: yes - **cases written by**: Carte Blanche - **size**: 5467 characters What this shows, and what it doesn’t How 2 models answered these 2 requests, with and without the agent. It says nothing about other models, and it doesn’t limit what your own agent can do. The answers were written without tools: the agent’s instructions were the system prompt, and it read no file and ran nothing. [How we test](https://carteblanche.com/how-it-works.md)