Skip to content
SDD TemplateSDD TemplateSDD Template

Open the builder

The builder is the visual board for your specs. There are two ways to open it, and both run entirely on your machine: same canvas, same server, same MCP endpoint.

Section titled “The recommended way: in your browser”

From your project’s main folder, in a terminal:

Terminal window
npx @juanklagos/sdd-mcp@latest --http

That is all. The builder opens, and with it the server your agent connects to.

Why this one comes first:

  • Nothing to download. npx fetches the published version at that moment, so you always open the latest without updating by hand.
  • No system warning. There is no file to authorise, because there is no file.
  • It is the most used route and the first to get fixes, since it does not depend on packaging and publishing a binary per operating system.

The only requirement: Node installed. Check with node --version; if it prints a number, you are set.

If you prefer its own window: SDD Desk

Section titled “If you prefer its own window: SDD Desk”

SDD Desk is the very same builder packaged as a desktop app: its own icon, no terminal, and Node inside it — handy if you do not have Node installed, or if you would rather not leave a terminal open.

In exchange, macOS and Windows will ask you to authorise it once, with a warning that sounds alarming. Three clicks, one time, and the steps are right below.

Get it

Section titled “Get it”

Every build, with its version and changelog, is on the releases page.

Why that warning appears

Section titled “Why that warning appears”

Signing a program and publishing it under an open licence are two different things, and they are easy to confuse.

The licence says what you may do with the code. SDD Desk is MIT: use it, read it, modify it, redistribute it, sell it. All of the code is in the repository, including the code that builds these downloads.

The signature says who assembled the file you downloaded. macOS and Windows do not read licences: they check whether a paid certificate vouches for the identity of whoever signed the binary. An unsigned MIT .dmg and an unsigned proprietary one get exactly the same warning.

So the warning is not telling you the app is broken, or dangerous, or that your system detected something. It says, literally, that the system cannot verify who published it. Whether it is reasonable to go ahead depends on whether you trust the source — which is what having the code in the open is for.

And it is unsigned by decision, not by oversight. Apple charges USD 99 a year for the certificate that removes the warning, with no exception for open source. This project is maintained by one person, who chose not to tie the tool to an annual fee: the browser builder already serves anyone who would rather not deal with this, and the code is there to compile.

Windows does have a free route for OSI-approved licences, which MIT satisfies, and it is still to be applied for. Linux asks for no signature at all.

Opening it the first time

Section titled “Opening it the first time”

Open the .dmg and drag SDD Desk to Applications. The first time you open it, macOS will say it “could not verify it is free of malware”: that is what it says about any app that is not notarized. You only have to authorise it once.

On macOS 15 (Sequoia) or later — macOS 26 included:

  1. Double-click it. The warning appears; click Done, not “Move to Trash”.
  2. Go to System Settings → Privacy & Security and scroll to Security.
  3. SDD Desk will be listed as blocked: click Open Anyway and confirm with your password.

Apple removed the right-click → Open shortcut in Sequoia, so on these versions that route no longer exists.

On macOS 14 (Sonoma) or earlier: right-click the app → Open, then confirm.

On any version, one command does the same — only use it on downloads you trust, because it removes the check macOS just made for you:

Terminal window
xattr -dr com.apple.quarantine "/Applications/SDD Desk.app"

Build it yourself

Section titled “Build it yourself”

The app is MIT, like the rest of the project. A binary you compiled on your own machine did not come from the internet, so nothing quarantines it and no warning appears:

Terminal window
git clone https://github.com/juanklagos/spec-driven-development-template.git
cd spec-driven-development-template && npm ci && npm run build
cd builder && npm ci && npm run build && cd ../desk
npm install && npm run dist

The result lands in desk/release/. Node is needed only to build it; the resulting app is not.

What happens when you open it

Section titled “What happens when you open it”
  1. It asks for your project folder — one that has a specs/ directory or a spec/ sidecar. Don’t have one? Create it with npx @juanklagos/create-sdd-project@latest .
  2. The board opens on that project. Your files on disk stay the source of truth; the app never copies them anywhere.
  3. It remembers the folder. File → Open project… switches to another one without a restart.

Connecting an agent

Section titled “Connecting an agent”

The app is your project’s MCP server while it is open. File → Connect an agent… shows the URL and a config snippet you can copy:

{ "mcpServers": { "sdd": { "url": "http://127.0.0.1:3334/mcp" } } }

The port is whatever the app actually bound — it moves to the next free one if 3334 is taken, which is why the dialog shows you the real number instead of you assuming it.

Anything your agent writes through that endpoint appears in the window immediately, without a reload.

What it does not do

Section titled “What it does not do”

It runs entirely on your machine. There is no account, no sync and no server of ours involved — the app opens a port on 127.0.0.1 that nothing outside your computer can reach.

And it is neither the only nor the main way to open the builder: npx @juanklagos/sdd-mcp@latest --http opens the same canvas in your browser, with nothing to download and no warning at all.