Skip to content
SDD TemplateSDD TemplateSDD Template

Download SDD Desk

SDD Desk is the visual builder in its own window. It carries its own Node runtime, hosts the SDD server itself, and includes the MCP endpoint your agents connect to.

Before you download: which one suits you

Section titled “Before you download: which one suits you”

There are two ways to use the same builder, and the right one depends on a single question — do you mind authorising an app the first time you open it?

The builder in your browser

No warning at all, nothing to download. One command and it opens:

Terminal window
npx @juanklagos/sdd-mcp@latest --http

Same canvas, same server, same MCP endpoint. Needs Node installed.

SDD Desk

Its own window, its own icon, and Node inside it — nothing to install first.

In exchange: macOS and Windows will ask you to authorise it once, with a warning that sounds alarming. Three clicks, one time, and the steps are right below.

Get it

Section titled “Get it”

Every build, with its version and changelog, is on the releases page.

Why that warning appears

Section titled “Why that warning appears”

Signing a program and publishing it under an open licence are two different things, and they are easy to confuse.

The licence says what you may do with the code. SDD Desk is MIT: use it, read it, modify it, redistribute it, sell it. All of the code is in the repository, including the code that builds these downloads.

The signature says who assembled the file you downloaded. macOS and Windows do not read licences: they check whether a paid certificate vouches for the identity of whoever signed the binary. An unsigned MIT .dmg and an unsigned proprietary one get exactly the same warning.

So the warning is not telling you the app is broken, or dangerous, or that your system detected something. It says, literally, that the system cannot verify who published it. Whether it is reasonable to go ahead depends on whether you trust the source — which is what having the code in the open is for.

And it is unsigned by decision, not by oversight. Apple charges USD 99 a year for the certificate that removes the warning, with no exception for open source. This project is maintained by one person, who chose not to tie the tool to an annual fee: the browser builder already serves anyone who would rather not deal with this, and the code is there to compile.

Windows does have a free route for OSI-approved licences, which MIT satisfies, and it is still to be applied for. Linux asks for no signature at all.

Opening it the first time

Section titled “Opening it the first time”

Open the .dmg and drag SDD Desk to Applications. The first time you open it, macOS will say it “could not verify it is free of malware”: that is what it says about any app that is not notarized. You only have to authorise it once.

On macOS 15 (Sequoia) or later — macOS 26 included:

  1. Double-click it. The warning appears; click Done, not “Move to Trash”.
  2. Go to System Settings → Privacy & Security and scroll to Security.
  3. SDD Desk will be listed as blocked: click Open Anyway and confirm with your password.

Apple removed the right-click → Open shortcut in Sequoia, so on these versions that route no longer exists.

On macOS 14 (Sonoma) or earlier: right-click the app → Open, then confirm.

On any version, one command does the same — only use it on downloads you trust, because it removes the check macOS just made for you:

Terminal window
xattr -dr com.apple.quarantine "/Applications/SDD Desk.app"

Build it yourself

Section titled “Build it yourself”

The app is MIT, like the rest of the project. A binary you compiled on your own machine did not come from the internet, so nothing quarantines it and no warning appears:

Terminal window
git clone https://github.com/juanklagos/spec-driven-development-template.git
cd spec-driven-development-template && npm ci && npm run build
cd builder && npm ci && npm run build && cd ../desk
npm install && npm run dist

The result lands in desk/release/. Node is needed only to build it; the resulting app is not.

What happens when you open it

Section titled “What happens when you open it”
  1. It asks for your project folder — one that has a specs/ directory or a spec/ sidecar. Don’t have one? Create it with npx @juanklagos/create-sdd-project@latest .
  2. The board opens on that project. Your files on disk stay the source of truth; the app never copies them anywhere.
  3. It remembers the folder. File → Open project… switches to another one without a restart.

Connecting an agent

Section titled “Connecting an agent”

The app is your project’s MCP server while it is open. File → Connect an agent… shows the URL and a config snippet you can copy:

{ "mcpServers": { "sdd": { "url": "http://127.0.0.1:3334/mcp" } } }

The port is whatever the app actually bound — it moves to the next free one if 3334 is taken, which is why the dialog shows you the real number instead of you assuming it.

Anything your agent writes through that endpoint appears in the window immediately, without a reload.

What it does not do

Section titled “What it does not do”

It runs entirely on your machine. There is no account, no sync and no server of ours involved — the app opens a port on 127.0.0.1 that nothing outside your computer can reach.

It is also not a replacement for the terminal route. npx @juanklagos/sdd-mcp@latest --http still opens the same builder in your browser, and still works exactly as before.