Catalog
Skills and MCP servers that Spellwarden has checked: scanned with the open-source scanner's rules, reviewed, and checked again when they change. Each entry shows what was checked and when.
How the catalog works, what we check and how to ask for a correction or removal are in the catalog guide.
What the checks found across the listed entries is in the catalog checks report.
Cloud platforms
aws-savings
Audits an AWS account for idle spend with a read-only boto3 scanner and writes a tiered cut list with proof, risk and undo commands.
No open critical or high findings. 1 open medium or low finding.
Curated
cloud-platforms
Reference notes and Terraform examples for AWS, Azure, GCP and Cloudflare: IAM, Kubernetes, networking, serverless and security checklists.
No open critical or high findings. 3 open medium or low findings.
Curated
DigitalOcean
Lets an agent build, deploy, manage and troubleshoot apps and infrastructure in a DigitalOcean account. Requires an OAuth sign-in.
No open critical or high findings. 1 open medium or low finding.
aws-best-practices
Local Markdown catalog of AWS best practices for 208 services and 9 cross-service topics, each item linked to an official AWS page.
No open critical or high findings. 1 open medium or low finding.
Curated
agent-platform-debugger
Diagnoses 403s and startup failures on Google Cloud Agent Platform gateways, registry, identity and IAP from logs and IAM, then reports fixes.
No open critical or high findings. 1 open medium or low finding.
Curated
Neon
Neon's hosted MCP server for managing Neon projects and Postgres databases. Requires a Neon sign-in before it lists its tools.
No open critical or high findings.
ngrok
ngrok's hosted MCP server for managing endpoints, domains and traffic policy. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings.
cloud-architect
Read-only cloud architecture advisor for AWS and GCP: reviews a stack, finds bottlenecks, proposes changes as diffs and compares tradeoffs.
No open critical or high findings. 1 open medium or low finding.
Curated
gcp
Checklist of Google Cloud best practices for IAM, secrets, networking, security, compute, infrastructure as code and operations.
No open critical or high findings. 1 open medium or low finding.
Curated
Supabase
Supabase's hosted MCP server for working with your Supabase projects. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings. 1 open medium or low finding.
Upstash
Upstash's hosted MCP server for Redis, QStash, Workflow, Vector and Search accounts. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings. 1 open medium or low finding.
Vercel
Vercel's own hosted MCP endpoint for working with your Vercel account. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings.
Infrastructure as code
Infra Pack
Five review and triage skills for Terraform plans, Kubernetes incidents, AWS IAM policies, CI pipelines and infrastructure change approval.
No open critical or high findings.
Curated
terraform-plan-analyzer
Reads terraform plan JSON and reports destructive changes, IAM and network risks, cost impact and drift with a verdict before apply.
No open critical or high findings. 1 open medium or low finding.
Curated
terraform-test-coverage
Reviews Terraform .tftest.hcl files for coverage gaps across six dimensions and reports a scored assessment with mock_provider examples.
No open critical or high findings. 1 open medium or low finding.
Curated
stack-terraform
Guides an agent through read-only review of Terraform changes: plans, state, modules and providers, with validate and static checks and no apply.
No open critical or high findings.
Curated
opentofu-iac
Rules for writing and reviewing OpenTofu or Terraform code: safe for_each keys, imports over re-creation, lean bootstraps, DNS validation, secrets
No open critical or high findings. 1 open medium or low finding.
Curated
pulumi-review
Reviews Pulumi programs and preview output for risky replacements, secret leaks, state and provider issues, then gives an update verdict.
No open critical or high findings. 1 open medium or low finding.
Curated
terraform
Opinionated style rules for Terraform and OpenTofu code: variables, modules, outputs, descriptions, and handing plan and import to the user.
No open critical or high findings. 1 open medium or low finding.
Curated
Kubernetes and containers
cilium-network
Reference for Cilium CNI on Kubernetes: CRD table, network policy YAML, LB IPAM, L2 and BGP announcements, encryption, Hubble and common mistakes.
No open critical or high findings. 1 open medium or low finding.
Curated
cnpg
Reference notes for CloudNativePG on Kubernetes: Cluster spec fields, bootstrap and backup methods, scheduling, image catalogs and a version map.
No open critical or high findings. 1 open medium or low finding.
Curated
analyze-repo
Reads manifest files in a repo and reports languages, frameworks, build tools, databases and env vars to prepare for Dockerfile or Kubernetes work.
No open critical or high findings. 1 open medium or low finding.
Curated
kubernetes-cost-review
Reviews Kubernetes manifests for cost waste: requests and limits, replicas, HPA, PVC sizing, EKS options, and writes a sizing report.
No open critical or high findings. 1 open medium or low finding.
Curated
kubernetes-security-audit
Static security review of Kubernetes manifests, Helm and Kustomize: RBAC, pod security, network policies, secrets, images, EKS, with a report template.
No open critical or high findings. 1 open medium or low finding.
Curated
kubernetes-kustomize-review
Reviews Kustomize base and overlay layouts for patch hygiene, resource references, generators and label safety, with 25 pass or fail checks.
No open critical or high findings. 1 open medium or low finding.
Curated
kubernetes-manifest-author
Writes hardened Kubernetes manifests (Deployment, Service, Ingress, probes, limits, security context) and ships a local YAML lint script.
No open critical or high findings. 3 open medium or low findings.
Curated
Pipelines and delivery
CircleCI
Remote MCP server for reading CircleCI projects, pipelines, workflows, jobs, logs, tests and artifacts. Needs a CircleCI sign-in via OAuth.
No open critical or high findings. 1 open medium or low finding.
GitLab
GitLab's own hosted MCP endpoint for working with your GitLab resources. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings. 1 open medium or low finding.
github-actions-reviewer
Reviews GitHub Actions workflows for version drift, permissions, concurrency and path filters, then writes a graded analysis and a fix plan
No open critical or high findings. 1 open medium or low finding.
Curated
ci-cd
Reference for GitHub Actions pipelines: caching, matrix tests, quality gates, OIDC cloud auth, publishing and staged deploys
No open critical or high findings. 1 open medium or low finding.
Curated
Observability
victoriametrics-operator
Reference for VictoriaMetrics Operator CRDs: what each kind does, key fields, example manifests and common mistakes.
No open critical or high findings. 1 open medium or low finding.
Curated
prometheus
Guidance for writing Prometheus scrape configs, recording and alert rules, and PromQL, with rules to keep label cardinality bounded.
No open critical or high findings. 1 open medium or low finding.
Curated
Axiom
Lists Axiom datasets and schemas and runs APL queries against them, with prompts for log exploration, anomaly hunting and monitoring.
No open critical or high findings.
azure_managed_grafana
Guides an agent through Azure Managed Grafana MCP tools to query metrics, logs, traces, KQL, SQL and Resource Graph and find dashboards.
No open critical or high findings. 2 open medium or low findings.
Curated
observability
Guidance for designing and reviewing production logging, metrics, SLOs, tracing, alerts and telemetry pipelines, with reference checklists.
No open critical or high findings. 1 open medium or low finding.
Curated
prometheus-cardinality-troubleshooter
Diagnoses live Prometheus cardinality problems using tsdb status endpoints, PromQL drill-downs, churn checks and safe whole-metric drop configs.
No open critical or high findings. 2 open medium or low findings.
Curated
prometheus-label-strategy
Guidance for auditing and designing Prometheus label schemas to limit cardinality at the source, with example relabel and recording rule configs.
No open critical or high findings. 1 open medium or low finding.
Curated
prometheus
PromQL reference with alerting, Alertmanager routing and recording rule examples, plus promtool and amtool validation commands
No open critical or high findings. 2 open medium or low findings.
Curated
promql
Query patterns and checks for PromQL on Prometheus, Mimir and Grafana Cloud: rates, histograms, SLO burn rates, recording rules, cardinality
No open critical or high findings. 1 open medium or low finding.
Curated
Honeycomb
Hosted MCP endpoint for querying Honeycomb traces, events, metrics, SLOs, triggers and boards; requires OAuth sign-in.
No open critical or high findings.
incident-postmortem
Guides a blameless incident postmortem (timeline, root cause, owned action items) with a local script that sorts events and computes TTD, TTM and TTR.
No open critical or high findings. 2 open medium or low findings.
Curated
observability-setup
Adds OpenTelemetry logs, metrics and traces to a service, defines SLOs and generates Prometheus burn-rate alerts with two offline scripts.
No open critical or high findings. 3 open medium or low findings.
Curated
New Relic
Queries New Relic observability data (metrics, logs, traces, entities) over a hosted MCP endpoint; requires a New Relic OAuth sign-in.
No open critical or high findings. 1 open medium or low finding.
Rootly
Remote MCP server for Rootly incident management: incidents, on-call schedules and incident analysis. Requires OAuth sign-in.
No open critical or high findings. 1 open medium or low finding.
Sentry
Sentry's hosted MCP server for looking up errors, issues and debugging data. Requires an OAuth sign-in before it lists its tools.
No open critical or high findings.
Security operations
external-secrets
Reference notes for External Secrets Operator: SecretStore, ExternalSecret, PushSecret, templates, Vault auth, Helm values and common mistakes.
No open critical or high findings. 1 open medium or low finding.
Curated
okta
Playbook for running Okta Workforce Identity: SSO apps, sign-on policies, SCIM rollout, IdP migration, login debugging, key rotation and admin audits.
No open critical or high findings. 1 open medium or low finding.
Curated
workload-identity
Playbook for service-to-service identity: pick SPIFFE or SPIRE versus cloud IAM, deploy SPIRE on EKS, federate trust domains, bridge to clouds via OIDC.
No open critical or high findings. 1 open medium or low finding.
Curated
sc-iac
Reviews Dockerfiles, Kubernetes manifests, Terraform and GitHub Actions workflows for security misconfigurations and reports findings by severity.
No open critical or high findings.
Curated
secrets-manager
Reference for creating, reading, updating and rotating AWS Secrets Manager secrets via CLI, boto3 and CloudFormation, with rotation Lambda examples.
No open critical or high findings. 3 open medium or low findings.
Curated
opa
Writes, tests, lints, explains and debugs OPA Rego policies for Conftest, using conftest and regal commands and placing the check as a CI gate.
No open critical or high findings. 1 open medium or low finding.
Curated
Documentation servers
Cloudflare documentation
Searches Cloudflare's public product documentation and returns the matching pages. Read only, no sign-in needed.
No open critical or high findings. 2 open medium or low findings. 1 accepted high finding, with our note.
Collections
- Cloud and infrastructure
Skills and MCP servers for cloud platforms, infrastructure as code, Kubernetes, delivery pipelines, observability and security operations.
- Documentation servers
Remote MCP servers that answer questions from a vendor's public documentation.
- Spellwarden
Spellwarden's own Infra Pack, with its measurements published next to it.