Skip to main content

Make the spec the artifact. Then gate CI on it.

Requirements Markup Language is an XML format for software requirements with a deterministic toolchain: validate the spec, trace it to the code and tests that realize it, and fail the build when they drift apart. Built for codebases where an agent writes much of the code — and someone still has to know what the system is supposed to do.

One command scaffolds a spec and an AGENTS.md — works with any coding agent:

npx @rqml/cli init

The whole idea, in one terminal session

fish — ~/myproject
# the agent implements REQ-AUTH-001, then records the link — no hand-edited XML~/myproject  rqml link REQ-AUTH-001 src/auth.ts#verifyToken✓ REQ-AUTH-001 ← src/auth.ts#verifyToken (E-IMPL-AUTH-001, implements, baseline recorded) ~/myproject  rqml check✓ check pass (standard) — requirements.rqml # six weeks later, someone refactors auth without touching the spec…~/myproject  rqml check  error (drift) [changed-implementation]: implements edge "E-IMPL-AUTH-001"    points at "src/auth.ts#verifyToken", which has changed since approval.✗ check fail (standard) — requirements.rqml      (exit 2)

No language model is involved in any of those verdicts. rqml check is a pure function of your repository — same input, same answer, on your laptop and in CI. The model proposes; the toolchain disposes.

Yes, XML. Requirements are documents — prose with structure woven through it — and mixed content is the problem XML actually solves; JSON and YAML cannot represent it. It is also what the model vendors already tell you to do: Anthropic, Google, and AWS all recommend XML tags for structuring LLM context. RQML is that advice taken seriously — a schema-validated vocabulary instead of ad-hoc tags — so you get validation, namespaces, comments, and clean diffs. The closing tags cost tokens once; the structure pays rent for the life of the project.

Not just a format — a deterministic toolchain.

One engine powers a CLI, an MCP server for your agent, and the VS Code extension. Open source (Apache‑2.0), published on npm, fully offline, no telemetry, and no language model in the verdict path.

rqml — the CLI

init, validate, status, and the check gate — plus the agent loop: show, impact, link, skeleton.

npm i -g @rqml/cli

@rqml/core — the engine

Parse, validate (XSD + referential integrity), lint, trace, impact, coverage, drift, and comment-preserving spec edits — embed it in your own tools.

npm i @rqml/core

@rqml/mcp — for agents

Eight Model Context Protocol tools backed by the same engine. Reads specs by file path (no pasting 30k tokens into a tool call); writes only on explicit intent.

npx @rqml/mcp

The loop an agent actually runs — read one requirement, check the blast radius, implement, record the link, pass the gate:

rqml show REQ-PAY-001     # one requirement: statement, acceptance criteria, trace neighborhood
rqml impact REQ-PAY-001 # what is affected, transitively, if this changes?
rqml link REQ-PAY-001 src/payments/capture.ts # implements edge + content-hash baseline
rqml check # validation + coverage + drift; exit 0 or it isn't done

It eats its own dog food.

The RQML repository is specified in RQML. requirements.rqml defines the language and the toolchain as requirements; every shipped feature was specified before it was built, is linked to the code that implements it and the tests that verify it, and the repo gates its own CI with rqml check.

The name is older than you might guess: RQML began as an XML DTD in a 2000 MSc thesis at the University of York. 2.x is a ground-up redesign of that idea for coding agents.

What RQML is not

  • Not a code generator. It never writes your code — your agent does that. RQML is what keeps the agent honest.
  • Not AI-powered. No model runs anywhere in the toolchain. Verdicts are reproducible functions of your repo.
  • Not DOORS. A text file in your repo and a small npm package — not an enterprise requirements suite.
  • Not ceremony. meta plus one requirement is a valid spec. Everything else is optional and added when it earns its keep.

Eleven sections. Two are mandatory.

A useful spec fits in 15 lines; a serious one scales to thousands of requirements with goals, scenarios, state machines, and a typed traceability graph. Explore the vocabulary:

<meta>
<meta>
<title>DriveEasy Car Rental Platform - Software Requirements Specification</title>
<system>DriveEasy</system>
<summary>
A web-based system for searching, reserving, picking up, and returning
rental vehicles across multiple branch locations.
</summary>
<authors>
<author>
<name>Anna Sigurdsson</name>
<role>Product Owner</role>
<org>DriveEasy ehf.</org>
</author>
</authors>
<dates>
<created>2026-01-15</created>
<updated>2026-02-20</updated>
<targetRelease>v1.0.0 - 2026-Q3</targetRelease>
</dates>
<profiles>
<profile id="PROF-GDPR" type="compliance">
<description>GDPR compliance for personal data processing.</description>
</profile>
</profiles>
</meta>

Start right now

  1. Scaffoldnpx @rqml/cli init drops a requirements.rqml and an AGENTS.md in your project root

  2. Checknpx @rqml/cli check validates the schema, coverage, and implementation drift (deterministic, offline)

  3. Develop with your coding agent of choice — it works from the spec, records trace links with rqml link, and you gate CI with rqml check

Tip: Don't write RQML from scratch. Your agent drafts it, rqml skeleton keeps the structure valid, and the VS Code extension adds authoring support, real-time validation, spec browsing, and export.

A complete, valid spec

<rqml xmlns="https://rqml.org/schema/2.1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://rqml.org/schema/2.1.0
https://rqml.org/schema/rqml-2.1.0.xsd"
version="2.1.0" docId="DOC-HELLO-001" status="draft">
<meta>
<title>Hello World CLI</title>
<system>hello</system>
</meta>
<requirements>
<req id="REQ-HELLO-001" type="FR" title="Print greeting"
status="draft" priority="must">
<statement>
The program MUST print "Hello, world!" to standard output
and exit with status code 0.
</statement>
</req>
</requirements>
</rqml>

Put the intent in the repo.

One file, one gate, any agent. Apache-2.0, offline, no telemetry.