mrkeyoor.com_
Tue 01 Sept 17:40 UTC
Dev Toolsevaluationupdated 26 Aug 2026

BMAD-METHOD review

BMAD-METHOD installs a structured software-delivery process into AI coding tools, including Claude Code. It turns an idea, bug, or specification into planning artifacts, implementation steps, and review passes so decisions survive beyond one chat.

+191stars / 7d
Verdict

Our BMAD-METHOD run installed 786 packages in 26 seconds but failed its tests after 21 seconds, while npm audit reported 8 high-severity vulnerabilities. Try it if your recurring problem is lost context across planning, coding, and review, and you can own the method as part of the repository. Skip it for a low-ceremony assistant setup or unattended review automation until the failed suite and current v6.11.0 review-loop reports are resolved.

We ran it

Lab card: what happened when we ran BMAD-METHODScreenshot of BMAD-METHOD (github.com/bmad-code-org/BMAD-METHOD)
Install✓ · 26s786 packages · 346 MB
Buildn/ano build script
Tests✗ · 21sran, no count parsed
Known vulns100 critical · 8 high · 1 moderate · 1 low (npm audit)
Repo597 files~37,856 lines of source · 6.5 MB · 5 CI workflows · tests dir

Answers from our run

Does BMAD-METHOD build from source?

Dependencies installed in 26 seconds (786 packages), and the project has no separate build step. We cloned commit 11bfd36 into a clean Debian container with 3 CPUs and no project-specific setup.

Do BMAD-METHOD's tests pass?

The test command failed in our container, and its output did not report a pass or fail count.

Does BMAD-METHOD have known vulnerabilities in its dependencies?

npm audit flagged 10 known advisories in the dependency tree at the time of our run.

Who should not use BMAD-METHOD?

Teams that need their clean checkout to pass its own test command today: our commit 11bfd36 run exited 1, and the log only concluded that installation component tests failed.

What are the alternatives to BMAD-METHOD?

Spec Kit, OpenSpec, Task Master. Our BMAD-METHOD run installed 786 packages in 26 seconds but failed its tests after 21 seconds, while npm audit reported 8 high-severity vulnerabilities.

Setup3/5Install passed, but tests failed and build skills also need uv
Docs4/5Clear install and workflow maps, with v6 migration detail
Community5/552,315 stars, an August 26 push, and active issue discussion
Maturity3/5v6.11.0 is substantial, but tests and review-loop reports concern us

Discussed on

  1. hnBMad-Method: Universal AI Agent Framework4 points

Who it’s for

Developers whose AI coding sessions lose product or architecture decisions between prompts.
Teams that want optional PRD, UX, architecture, story, build, and review workflows in the repository.
Claude Code and other supported-tool users willing to learn named skills and keep generated project context under version control.
Maintainers who want the same method for a small change and a planned multi-story project.

Who it’s NOT for

Teams that need their clean checkout to pass its own test command today: our commit 11bfd36 run exited 1, and the log only concluded that installation component tests failed.
Developers avoiding a second runtime toolchain: Node.js 20.12+ installs BMAD, while bmad-build and bmad-build-auto require uv and Python-backed rendering.
Unattended teams relying on v6.11.0's default review loop: issue 2772 reports 21 of 21 passes that patched anything recommended another review, with a reviewer instructed to find at least 10 items.
Projects whose requirements live mainly as pointers to large design files: issue 2767 reports the epic-context compiler dropping those references unless teams add an override.
Groups wanting a quiet, stable workflow vocabulary: v6.11.0 renamed the main build path, consolidated skills, deprecated old IDs, and changed configuration behavior.

Setup reality

Our sandbox installed 786 npm packages in 26 seconds and used 346 MB on disk. There was no build script, so we skipped that step. Tests failed with exit code 1 after 21 seconds, and npm audit found 10 known vulnerabilities: 8 high, 1 moderate, and 1 low.

Installation starts with npx bmad-method install. You still need Node.js 20.12 or later and a supported AI coding tool configured for your work. External or custom modules also need Git; the documented core install does not ask for a BMAD service credential.

The README lists Python 3.10+ and uv as prerequisites. The detailed install guide says a missing uv only produces a warning, even though bmad-build and bmad-build-auto will not work without it. There is no Dockerfile, so container users assemble those runtimes themselves.

BMAD keeps decisions in files across four delivery phases

BMAD-METHOD is for developers who like AI coding but dislike how quickly a chat forgets the reason behind a change. Its workflows create artifacts that carry product intent, UX decisions, architecture, stories, and implementation context forward. The method has 4 phases: optional analysis, planning, solutioning, and implementation. You can enter at bmad-build for a clear fix or use the earlier phases for a larger project. That adjustable depth is the project's best idea.

Installation adds named skills, shared configuration, and supporting scripts to a target repository. bmad-help reads the installed modules and suggests the next available workflow. For an existing codebase, bmad-project-context builds a verified block in AGENTS.md from repository evidence and team rules. This gives agents a durable operating brief without asking every developer to paste the same background into each session.

One build path replaces several v6 workflows

Release v6.11.0 makes bmad-build the official implementation path. Clear work can start there, while PRDs, UX material, architecture, epics, and sprint planning remain optional context for bigger changes. The release also reduces the core catalog from 14 skills to 8, combines several review modes behind bmad-review, and consolidates three research skills into bmad-deep-recon. Old names mostly continue through forwarding shims until v7.

That cleanup has a cost for existing users. Customization files for renamed skills must move, some skills were removed, and layered TOML configuration is replacing older behavior. The release notes are candid about these changes, including cases where legacy customization can halt an unattended run. A team adopting BMAD should pin a version, review release notes before updating, and treat _bmad changes like a framework migration rather than a harmless prompt refresh.

What happened when we ran it

Our sandbox cloned commit 11bfd36 into a fresh unprivileged Debian container with 3 CPUs and 8 GB of RAM. The npm install succeeded in 26 seconds, adding 786 packages and consuming 346 MB on disk. The checkout itself contained 597 files, about 37,856 lines of source, and occupied 6.5 MB. No build script or target existed, so there was no build step to run.

The test command failed with exit code 1 after 21 seconds. Its final output listed installation component suites 43 through 52, then ended with Some installation component tests failed. Those lines do not identify a failing assertion or a cause, so we cannot tell whether the problem is the code, a missing system dependency, or our container environment. The defensible finding is simple: the checked-out commit did not pass its own tests under the stated conditions.

Npm audit reported 10 known vulnerabilities in the installed tree: 0 critical, 8 high, 1 moderate, and 1 low. The repository has 5 CI workflow files and a tests directory, which shows that maintainers have automated checks, but our result still matters to an adopter. There is no Dockerfile to define a known container environment. Before adding BMAD to a company repository, reproduce the test failure and inspect the audit paths rather than accepting 786 dependencies on trust.

The installer can finish before the build skills are usable

The short command is npx bmad-method install, yet the useful path has more prerequisites than that line suggests. Node.js 20.12 or later runs the installer. The main README also lists Python 3.10+ and uv. The detailed guide sharpens the warning: installation can finish without uv, while bmad-build and bmad-build-auto cannot run their Python-backed rendering without it. A green installer summary therefore does not prove that the main implementation skills are ready.

You also need a supported AI coding tool. The installer can list current tool IDs and has a headless example for Claude Code. Core BMAD does not require a hosted BMAD credential, though your chosen assistant has its own account and model setup. Git becomes another prerequisite when external or custom modules are involved. For CI, containers, or locked-down workstations, capture Node, Python, uv, and tool integration in your own bootstrap script.

Open v6.11.0 reports make unattended review a risky choice

BMAD's review design sounds careful: implementation can fan out to adversarial, edge-case, and verification-gap reviewers, then triage their findings. Issue 2772 provides a sobering real-project report. Across 9 stories and 21 triage passes, the reporter recorded 733 findings. Every pass that patched something recommended another review, and the default blind reviewer was instructed to find at least 10 items. That combination can spend time and tokens after useful findings have thinned out.

Issue 2760 identifies a related seam. It says bmad-build and bmad-code-review repeat 3 identical review layers when both run on the same diff, while the former leaves sprint status at review rather than done. We did not reproduce these open reports. They concern the advertised delivery path directly. Teams should begin with supervised runs, inspect the triage log, and decide which review skill owns the final pass.

Reference-heavy design contracts need an explicit override

Structured context only helps when the right material survives compression. Issue 2767 describes a case where epic compilation dropped references to DESIGN.md and EXPERIENCE.md. The implementing agent then missed visual rules because the source pointer had vanished. The reporter fixed that project by loading both files as persistent facts through a team override. If your requirements depend on source documents instead of repeated text, verify the compiled context before implementation.

Activity around those reports is healthy. GitHub showed 52,315 stars, a last push on August 26, 2026, and 128 open issues and pull requests combined. Release v6.11.0 was published on August 10, and current discussions contain specific reproductions rather than empty complaints. BMAD deserves a trial when process drift is costing the team real work. Its own 21-second test failure and the open review-loop reports argue for a controlled project first, with version pinning and human approval still in the loop.

Alternatives

ProjectWhat it isPick it when
Spec Kit gh↗GitHub's toolkit for specification-driven work with coding agents.pick this instead when you mainly want requirements and implementation planning without BMAD's larger set of roles and delivery workflows.
OpenSpec gh↗A specification workflow for proposing and tracking changes with AI coding assistants.pick this instead when change proposals and compact specs are enough, and you do not want a four-phase method installed in the project.
Task Master gh↗An AI-oriented task manager that turns product requirements into tracked development work.pick this instead when task breakdown and status are the main gap, rather than product, architecture, implementation, and review guidance.

What people are saying

  1. [github-trending] bmad-code-org/BMAD-METHOD

Sources

  1. BMAD-METHOD README
  2. BMAD installation guide
  3. BMAD workflow map
  4. BMAD-METHOD v6.11.0 release
  5. Issue 2772: non-convergent build-auto review loop
  6. Issue 2760: duplicate build and code review layers
  7. Issue 2767: reference-only requirements dropped
  8. BMAD-METHOD license

More dev tools reviews

workmux · v2rayNG · SecLists · hashcat · eslint · fastfetch · the whole board →