The Spellwarden catalog

What the catalog is

Each entry is its publisher's work, under its publisher's licence or terms. Spellwarden does not sell, license or host that content: installing an entry fetches it from where its publisher publishes it, at the version the catalog shows. An entry is one of these:

• A skill: one skill directory in a public GitHub or GitLab repository, pinned to a commit.
• A plugin: the skills of one Claude Code plugin, installed together, pinned to a commit of its marketplace.
• A remote MCP server, reached over HTTPS with streamable HTTP or SSE, pinned to the exact endpoint we probed. A remote server cannot be pinned to a version: it can change after our check, and its entry says so.

Anyone can browse the catalog, with no account. Installing an entry in one step, re-checks and alerts are part of the Team and Enterprise plans and of the 14-day trial (see pricing).

What we check

An entry is listed only when the version shown passes every check below. For skills and plugins:

• The scan of the pinned commit, with the open-source scanner's rules, passed, and every skill is Curated: a curation score of at least 8.0 out of 12, no open critical or high finding, not quarantined.
• No accepted critical finding. A high finding we accepted as a false positive, or as the skill's intended behaviour, carries our note, and the entry shows it.
• A permissive licence, with its licence file in the repository: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Unlicense or 0BSD.
• The repository is public, not archived and not a fork, and had a commit in the last 365 days.
• For a plugin, every plugin of its marketplace sits in the same repository or names a full commit, so what Claude Code loads is what we checked.

For remote MCP servers: the endpoint uses HTTPS; the server is published by the organisation that runs it; the probe found no open critical or high finding; any high finding we accepted carries our note (for example a public documentation server that needs no sign-in by design); no tool description reads like an instruction to the agent; and the service's terms allow public use. The migration status to the 2026-07-28 MCP specification is shown, not required.

We then review each version ourselves, helped by an AI model that reads the public files at the pinned commit: whether the skill does what its name and description say and nothing more, whether any text steers an agent away from its user, whether commands it asks an agent to run are destructive or fetch and run code, what scripts or binaries come with it, and whether a server's tools reach further than its purpose. Spellwarden approves each batch of entries before it is listed.

Eval results, stars, downloads and install counts are never part of the checks, and never decide the order of entries.

What checked does not mean. Checked and vetted mean that the version shown passed these checks on the date shown. They are not a promise that the content is safe, free of defects or fit for your purpose, and not an endorsement by or of the publisher. Review what your agents load, as for any skill or server (see the terms).

Re-checks and alerts

We check every listed entry again: when its upstream repository or endpoint changes, which we look for about once a day; after every release of the scanner's rules; and for earlier versions while an organisation still has them installed.

When a re-check finds a quarantine, a malicious indicator or an open critical finding, or the source is gone, the entry is suspended at once: it cannot be installed, and organisations that installed it are told. Other problems mark the entry for our review within two working days. An upstream change is never applied by itself: a new version is checked and approved like the first.

An organisation that installed a suspended or removed entry gets a notice on the Catalog page of the dashboard. For a safety reason its owners and managers also get an email, and Spellwarden adds a finding to each copy the organisation installed, so the copy is no longer Curated and, on Enterprise, leaves the private registry under the registry's own policy. A manager or owner can accept that finding with a note. Each person can turn the Catalog alerts emails off in their profile's notification settings.

The public page of a suspended entry says only that it is not available for new installs at the moment. The reason is shown only to the organisations that installed it.

Install on Team and Enterprise

In the dashboard, open Catalog, choose an entry and select Install. Owners, managers and members can install; viewers can browse. Install in Spellwarden on an entry's public page opens the same entry in your organisation, after you sign in.

Installing a skill or plugin imports it into your organisation at the catalog's commit and scans it with your organisation's own rules, like any skill you import. Installing a remote MCP server adds it by the endpoint we probed. Each install counts toward your organisation's usual limits.

After installing, the entry page shows ready-made configuration: for a server, the commands and files for Claude Code, Cursor and VS Code; for a plugin, the Claude Code commands that add its publisher's marketplace; for a skill, where to download it, with the reminder to keep the repository's licence file with it.

On Enterprise, an installed skill or server joins your private registry when it meets your registry's policy, as any skill or server does. For a plugin, a manager or owner can also allow the plugin at that commit in the registry check of pull and merge requests.

Stop following removes the install record and anything it allowed in the registry. The skills and servers it added stay in Spellwarden, with their scans and findings.

Updates and collections

When a newer version of an installed entry is approved, your organisation gets a notice with the new version's check results beside the installed one's, and Update installs it. Nothing is updated unless a person in your organisation chooses it: an organisation that never updates keeps its pinned version, and still gets an alert if that version is later suspended. The previous version stays in Spellwarden after an update.

A collection is a list of entries on one theme, such as cloud and infrastructure. Follow a collection on the Catalog page to be told when it gains an entry or one of its entries gets a new version. Install all installs each entry of the collection that your organisation has not installed, one after another.

What we publish about an entry

For each entry, spellwarden.ai shows its name, its publisher's public name and source address, the publisher's own description of at most 300 characters, quoted and attributed, our one-line summary, the licence, the paths of its skills, the pinned commit or the probed endpoint, and our check results with their date and the scanner rules used. The same data is at spellwarden.ai/catalog/catalog.json.

We never publish the content of a file, publishers' logos, why an entry was suspended or removed, or anything about the organisations that install entries: no names, members, installs or counts. A removed entry keeps a page that says only the date it was removed; an entry removed at its publisher's request keeps no page at all.

Removal and correction requests

A publisher or rights holder can have an entry removed without giving a reason. Email hello [at] spellwarden [dot] ai with the subject Catalog removal, from an address at the publisher's domain or with a link to an issue or commit by the repository's owner, so we can confirm that you speak for the publisher. We remove the entry within five working days and reply to you. Organisations that installed it are told that their copy is unchanged.

To correct a wrong name, category or description, or to question a finding shown on an entry, email the same address. If a finding is a false positive, we accept it with a note, which the entry then shows.

If a publisher is a person, their public name is personal data; the privacy policy says how we handle it.

Related guides

• Scan skills
• The private registry
• Spellwarden connector for Claude