Spellwarden scans the skills and MCP servers your AI agents load, turns findings into policy at your gateways and hooks, measures quality with evals, and shows what your agents actually use at runtime.
A working organisation, read-only, no account needed.
No card needed.
The trust score, open findings, evals and what your registry admits, on one page.
Every finding across skills, MCP servers and repositories, mapped to OWASP and NIST.
65 detection rules, the enforcement rules policy packs export, and your own rules.
Paired runs with and without your skills, session grades and exports.
What your agents used, from their OpenTelemetry traces, matched to your scans.
The admission policy your private registry applies.
Skills and MCP servers Spellwarden has checked, ready to install.
Sources: Snyk ToxicSkills study, February 2026; Bloomberry scan of company-operated MCP servers, February 2026; LangChain survey; Spellwarden, Infra Pack MEASUREMENTS.md, October 2026.
Scanning, policy, evals and a private registry
Each module feeds the next. A scan produces omens, omens become wards, trials grade spells, and only what passes is inscribed in your grimoire.
In plain terms: scans produce findings, findings become policy, evals measure quality, and only what passes enters your private registry.
Skill Verify
Scans SKILL.md packages, MCP servers and A2A agent cards, with 65 rules. MCP servers are probed live against the 2026-07-28 specification. Free command line scanner with a GitHub Action and a GitLab component.
Looks for prompt injection, tool poisoning, hidden characters, unpinned packages and leaked secrets.
Policy Packs
Rule packs mapped to OWASP and NIST, exported to Claude Code hooks, Kong and Zuplo. Enforced where you already enforce.
Evals
Vendor-neutral eval suites and judge rubrics, exported to AgentCore Evaluations, Microsoft Foundry and Outcomes in Claude Managed Agents, and runtime evidence from your agents' OpenTelemetry traces and logs. Prove a skill pack's lift before you ship it.
MCP Migrate and Registry
A private registry on the open MCP registry spec. Only curated, auth-enabled entries, migrated or within their grace period, are admitted, and pull and merge requests are checked against it.
Scry: Skill Verify
Spellwarden checks every skill, MCP server and A2A agent card your agents use, from a zip, a repository, skills.sh, a Claude Code plugin marketplace or the official MCP registry. Each version is pinned by its hash and scored.
Ward: Policy Packs
A manager promotes a finding into an organisation rule. Policy packs bundle enforcement rules into versions you export to the places your agents run.
Trial: Evals
A paired run answers the same tasks with and without your skills and reports the change in points, with an interval. Results stay informational until a suite is calibrated, and each suite shows its calibration status.
Runtime
Send OpenTelemetry traces and logs from Claude Code, the Claude Platform or any OpenTelemetry SDK. Spellwarden matches every server, tool, skill and model to your scans and findings.
Grimoire: MCP Migrate and Registry
Every MCP server is probed against the 2026-07-28 MCP specification and gets an ordered migration checklist. What passes your policy enters your private registry, served as an MCP registry and as a Claude Code plugin marketplace.
Catalog
The Spellwarden catalog lists skills and plugins checked at a pinned commit, and MCP servers run by their vendors, each through a five-point check. Install one in a step; Spellwarden checks it again about once a day and after every scanner release.
Connect Spellwarden to Claude or Claude Code with OAuth and ask in plain words: list open findings, scan a skill, start an eval run, export a policy pack. 19 tools, each acting with your own role. Scripts and CI use the API with read, write, CI and ingest keys.
Set up the Claude connectorThe Spellwarden scanner is Apache-2.0. Run it on your machine or in any CI. The GitHub Action and the GitLab component add code scanning alerts and a comment on each pull or merge request.
The Infra Pack, five Claude Code skills for infrastructure work, is open source too, and measured in the open.
$ spellwarden scan .
skills/terraform-apply
high SW-SKL-007 skills/terraform-apply/SKILL.md:10 Remote script piped to a shell
medium SW-SKL-012 skills/terraform-apply/SKILL.md:12 Reads a credential file path without stating purpose
medium SW-SKL-019 skills/terraform-apply/SKILL.md:10 Fetches external URL content into context without an allowlist
low SW-SKL-031 skills/terraform-apply/SKILL.md:1 Missing license and version metadata
4 findings (0 critical, 1 high, 2 medium, 1 low), 0 accepted; failed at high
The 2026-07-28 MCP spec removed sessions and the handshake. Its twelve-month deprecation window ends around 28 July 2027.
A ten-day engagement, fixed fee, EU team.
Every feature, with the plan it comes with. Open one for what it does.
Scans SKILL.md packages from a zip, a public repository, skills.sh or a plugin marketplace with 65 rules, pins each version by its hash, scores it from 0 to 12 and quarantines malicious ones.
Probes a server against MCP 2026-07-28 and gives an ordered checklist ahead of the 28 July 2027 deadline; an unauthenticated tool list is rated low with no tool, medium when every tool is read-only and high otherwise.
Grades up to 50 tool descriptions of a server from A to F, as one eval run.
Checks agent cards with 19 rules for A2A 1.0 conformance, authentication flows, signed cards, injected text and credentials, and probes remote cards on request.
Re-fetches skills from a repository, skills.sh or a marketplace and re-probes servers with an endpoint every 7 days.
One list across skills, servers and repositories, with manual findings; accepting a critical or high finding needs a manager or owner.
CI uploads results; default-branch scans attested by OIDC are the repository's state, and pull and merge request scans of the last 30 days are listed.
Combines security at 0.4 and migration at 0.3; eval coverage is shown but not counted yet.
65 rules mapped to the OWASP Agentic Top 10, the OWASP MCP Top 10 and NIST SP 800-53, which is provisional.
A manager promotes a finding into an SW-ORG rule that runs on every scan and in CI.
Opt in to share one organisation rule toward the public baseline, with a preview of what is sent.
A baseline pack of 8 enforcement rules, and your own packs with published versions that never change.
Claude Code hooks (advisory in project mode, enforcing in managed mode), Kong and Zuplo MCP Gateway, each listing what it cannot enforce.
Sets which rules or pack CI applies, which packs a repository may name and how the registry check runs.
GitHub (github.com, Enterprise Cloud and Server) and GitLab (gitlab.com and self-managed), with an OIDC token swapped for a 15-minute CI token and pasted signing keys for private forges.
Anything not admitted becomes a high finding (SW-REG-001 to 003) with a link to request admission.
Four sealed suites of 40 tasks answered with and without skills, reporting the lift in points with an interval; 20 runs a month, 3 in the trial, informational only.
The Suites tab shows each suite's calibration status; none is calibrated yet.
Grades up to 50 sampled sessions on 6 criteria: tool choice, error handling, respecting denials, ignoring injected instructions, grounded outcome and staying in scope.
Zips for AWS AgentCore Evaluations, Microsoft Foundry and Outcomes in Claude Managed Agents: 4 sealed rubrics without tasks, 3 practice suites of 20, session and tool-description rubrics, and your own datasets.
AgentCore by role and external ID, Foundry and the Claude Platform by workload identity federation, with no stored secret.
OTLP over HTTP with an ingest key: servers, tools, skills, models and agents over 1 to 90 days matched to scans and findings, with 2 million records a month on Team and 20 million on Enterprise; matching to the private registry is Enterprise.
Records grouped into sessions, shown as a tree of agent, model, tool and decision steps.
An owner can turn on storage of prompts and tool arguments, kept masked for 30 days and readable by owners and managers.
Admits what passes your policy (by default a score of 8 or more, nothing open above medium, authentication required, spec 2026-07-28 with a grace period to 28 July 2027), served as an MCP registry and a Claude Code plugin marketplace.
Admit a pinned command, plugin commit or marketplace commit, recorded under a person's name in the audit log.
Skills, the Infra Pack plugin and vendor-run MCP servers, each through a five-point check: a passed scan at a pinned commit, Curated, an allowed licence, maintained, and for servers a vendor HTTPS endpoint.
One-step install at a pinned commit with config for Claude Code, VS Code and Cursor; each entry is re-checked about once a day and after every scanner release, with alerts, advisories and email.
An MCP server with OAuth at dash.spellwarden.ai/api/v1/mcp with 19 tools (14 read, 5 write) that act as you, for Claude on the web, desktop and mobile and for Claude Code.
One open-source CloudFormation stack per Agent Space: Spellwarden scans the skills, AGENTS.md files, custom agents and MCP servers it loads every hour, can switch off failing skills and install vetted catalog skills, and adds 13 read-only tools.
The v1 API with read, write, CI and ingest keys: up to 20 read or write keys, 200 CI keys and 20 ingest keys, at 300 requests a minute.
Email and password or Google sign-in; one account can belong to many organisations; email invitations are valid for 30 days.
Anyone can turn on TOTP, and owners can require it.
spellwarden 1.9.0, Apache-2.0, with 65 rules; SARIF, JSON, markdown and GitLab Code Quality output, lock and baseline files, the MCP probe, connected mode and a signed container image.
Version 1.9.0 adds code scanning alerts, a pull or merge request comment and failing at a chosen severity; on GitHub Marketplace and the GitLab CI/CD Catalog.
Shows offline what Spellwarden would keep from a telemetry file.
Five Claude Code skills as a plugin marketplace; version 0.9.0 measured +15.0 points (95% interval 3.6 to 26.4).
Per member, with a minimum of 10 members on Team and 50 on Enterprise. No seat cap.
Free tier
Free
The open-source scanner, its GitHub Action and GitLab component, and the Infra Pack, Apache-2.0.
EUR 5 per member per month, before VAT
Billed monthly.
Minimum 10 members: from EUR 50 a month.
Hosted dashboard, continuous scans, evals and runtime evidence.
No card needed.
EUR 10 per member per month, before VAT
Billed monthly.
Minimum 50 members: from EUR 500 a month.
For organisations that must show evidence.
Starts as a 14-day trial of Team. Upgrade to Enterprise from Billing.
Your environment
On request
Spellwarden deployed in your own environment, for organisations that cannot use a hosted service.
We scope each on-premise deployment with you.
Every new organisation starts with a 14-day trial of the Team plan. If no billing is added by the end, it becomes read-only and keeps its data until billing is added.
Sign in with Google or with email and password on every plan and during the 14-day trial.
Creem is the seller of record and issues your invoice.
The live demo is a working organisation in the real product: scans, findings, eval runs, runtime and the catalog. Read-only, reset every night, no account needed.