MCP deprecation deadline: about 28 July 2027

Your agents cast spells they found on the internet. Someone should check them.

Spellwarden scans skills and MCP servers your AI agents load, turns findings into policy enforced at your gateways and hooks, and proves quality with evals.

The agent trust platform

Scan a skill, free Book a migration ritual

Apache-2.0 scanner
Works with Claude Code, Cursor, Copilot
EU-hosted

$ spellwarden scry ./skills/terraform-apply
Scrying 1 spell, 14 files
omen  high    SW-SKL-007  remote script piped to shell
omen  medium  SW-SKL-012  reads ~/.aws without consent
trial Infra-Ops 40: 28/40 passed (+17.5 pp with Infra Pack)
sigil withheld: 2 open omens
$ spellwarden ward export --target claude-code-hooks
wrote .claude/settings.json (3 rules)

Example scan output

36.8% of public skills scanned had at least one issue
76 confirmed malicious skills in one registry sweep
38.7% of production MCP servers run with no authentication
29.5% of teams run no evals at all

Sources: Snyk ToxicSkills study, February 2026; Bloomberry scan of company-operated MCP servers, February 2026; LangChain survey.

Four modules, one grimoire

Each module feeds the next. A scan produces omens, omens become wards, trials grade spells, and only what passes is inscribed in your grimoire.

In plain terms: scans produce findings, findings become policy, evals measure quality, and only what passes enters your private registry.

Scry

Skill Verify

Static scan of SKILL.md packages and MCP servers: injection, credential reads, egress, auth mode, spec version. Free CLI, runs in CI.

Ward

Policy Packs

Rule packs mapped to OWASP and NIST, exported to Claude Code hooks and Kong, with Zuplo, AgentCore Policy and Cloudflare to follow. Enforced where you already enforce.

Trial

Evals

Vendor-neutral eval suites and judge rubrics. Prove a skill pack's lift before you ship it.

Grimoire

MCP Migrate and Registry

A private registry on the open MCP registry spec. Only curated, migrated, auth-enabled entries are inscribed, and agents load only from it.

The migration ritual

The 2026-07-28 MCP spec removed sessions and the handshake. Its twelve-month deprecation window ends around 28 July 2027.

A ten-day engagement migrates up to five servers to the stateless spec with OAuth, delivers a migration report, and admits the result to your private registry. Fixed fee, EU team.

Ends about 28 July 2027

Fixed-fee MCP migration

Book the ritual