Spellwarden connector for Claude
Last updated 30 October 2026
The Spellwarden connector lets Claude work with your Spellwarden organisation for you: scan skills, read findings and your trust score, add and check MCP servers, export policy packs, and run and export evals. It is Spellwarden's own MCP server at https://dash.spellwarden.ai/api/v1/mcp, and it acts as you, with the role you have in each organisation.
Before you start
- A Spellwarden account. Sign up at dash.spellwarden.ai. Every new organisation starts with a 14-day trial of the Team plan.
- Membership of at least one organisation, with the role Owner, Manager, Member or Viewer. The Billing role cannot use connectors.
- Claude on the web, desktop or mobile, or Claude Code.
Connect it
In Claude on the web or the desktop app:
- Open Settings, then Connectors.
- Find Spellwarden in the connector directory and select Connect. To add it by hand instead, add a custom connector with the URL
https://dash.spellwarden.ai/api/v1/mcp. - Sign in to Spellwarden in the window that opens.
- Read the consent screen. It names the app, lists your organisations with your role in each, and says which ones the connector cannot reach and why. Select Allow.
In Claude Code, add the server, then run /mcp in a session and choose spellwarden to sign in:
claude mcp add --transport http spellwarden https://dash.spellwarden.ai/api/v1/mcpNothing is connected until you allow it on the consent screen.
What Claude can do
The connector offers these tools. Read tools only fetch data. Write tools start or create something: a scan, a new MCP server, an export or an eval run.
| Tool | What it does | Access |
|---|---|---|
list_organisations | Lists the organisations you can reach through the connector, with each one's URL name, plan and billing state. Claude calls it first. | Read |
get_organisation | Shows one organisation: its name, plan, billing state, member count, whether single sign-on is on, and who is calling. | Read |
list_api_keys | Lists an organisation's API keys by name, access, last four characters and dates. It never returns a key's value. | Read |
list_skills | Lists the organisation's scanned skills with their curation score, their state (Curated or Quarantined) and their open findings. | Read |
get_skill | Shows one skill and the findings of its latest scan, most severe first. | Read |
scan_skill | Starts a scan of a skill in a public GitHub or GitLab repository. The scan runs in the background, and Claude reads the result with get_skill. | Write |
list_findings | Lists the findings of the latest scan of every skill, MCP server and repository, newest first, filtered by severity, status or target. | Read |
add_mcp_server | Adds an MCP server by its endpoint URL, its repository URL or its name in the official MCP registry, and starts its first scan. | Write |
get_migration_report | Shows an MCP server's migration report: its classification, its findings, the ordered migration checklist and the days left to the MCP deprecation deadline. | Read |
list_registry_entries | Lists the organisation's private registry and the skills and MCP servers it admits. Enterprise plan only. | Read |
list_policy_packs | Lists the organisation's policy packs, the Spellwarden baseline first, with their latest version and how many rules each one includes. | Read |
export_policy_pack | Exports a published policy pack version for Claude Code hooks, Kong or Zuplo and returns a download link that works for 15 minutes. | Write |
get_trust_score | Shows the organisation's trust score and its parts: security, migration and eval coverage, and how many assets carry an accepted critical or high risk. | Read |
start_eval_run | Starts an eval run in the background: a task suite (Infra-Ops 40, AppSec 40, Agent-Sec 40 or Data-Ops 40) with and without the skills you choose, or a grade of an MCP server's tool descriptions. Each run counts against the organisation's eval runs: 20 a month, or 3 during a trial. | Write |
get_eval_run | Shows one eval run and its progress. Eval results are informational and do not change scores. | Read |
export_eval | Exports Spellwarden's eval rubrics, with a practice suite's 20 sample tasks or an MCP server's graded tools, as files for AWS AgentCore Evaluations, Microsoft Foundry or Outcomes in Claude Managed Agents, and returns a download link that works for 15 minutes. | Write |
get_runtime_inventory | Lists what the organisation's agents used at runtime, from their OpenTelemetry traces: MCP servers, tools, skills, models and agents, with calls, errors and latency. | Read |
When you belong to more than one organisation, Claude names the organisation in each call. Scans and eval runs take from seconds to minutes, so Claude starts them and then reads their status.
Organisations and roles
- The connector acts as you in every organisation you belong to, and your role there decides what it may do. Owners, Managers and Members can use every tool. A Viewer can use the read tools only.
- Your membership is checked on every call. If you leave an organisation or are removed from it, the connector loses access to it at its next call.
- An organisation that requires single sign-on or two-factor sign-in is reachable only if you were signed in that way when you allowed the connection. Otherwise sign in that way and connect again.
- An organisation that is read-only because its subscription ended refuses every connector call until billing is added.
- Plan limits apply as they do in the dashboard: the private registry is on the Enterprise plan, and eval runs count against the organisation's monthly runs.
Sign-in and security
- You connect with OAuth 2.1 and PKCE (S256). Claude registers itself with Spellwarden by dynamic client registration and asks for the single scope
mcp. - Access tokens are valid for 1 hour. Refresh tokens are valid for 7 days and are replaced each time they are used. A connection lasts at most 30 days, then you allow it again, which checks again how you signed in.
- Spellwarden stores authorisation codes and refresh tokens only as SHA-256 hashes, never in plain text.
- You can have up to 5 connected apps at once. At that limit, connecting the same app again replaces its oldest connection, and any other app is refused until you disconnect one.
- No tool returns an API key's value or a password.
Disconnect
In Spellwarden, open your account menu, then Connected apps (dash.spellwarden.ai/account/connected-apps), and disconnect the app. Its tokens stop working at once. You can also remove the connector in Claude's settings.
Data handling
- Claude receives only what a tool returns when you ask for it, and processes it under Anthropic's terms. The app you connect is your tool, not Spellwarden's processor.
- Spellwarden stores and processes your organisation's data in the EU, in AWS eu-central-1 (Frankfurt).
- An eval run sends Spellwarden's test tasks, with the chosen skills' instructions or a server's tool descriptions, to AI models on Amazon Bedrock in EU regions. Their answers are kept for 30 days.
- Spellwarden never sees your conversation with Claude, only the tool calls Claude makes. Calls that change something, such as starting a scan, are recorded in the organisation's audit log, as they are from the dashboard.
The full details are in the privacy policy, Connected apps (MCP) and Evals.
Technical details
- Endpoint:
https://dash.spellwarden.ai/api/v1/mcp, stateless Streamable HTTP: one JSON-RPC message per POST, answered as JSON, with no sessions and no server-sent events. - MCP versions: 2025-06-18, 2025-11-25 and 2026-07-28, including
server/discover. - Discovery:
https://dash.spellwarden.ai/.well-known/oauth-protected-resourceandhttps://dash.spellwarden.ai/.well-known/oauth-authorization-server. - Without a valid token the endpoint answers 401 with a
WWW-Authenticateheader that names the protected resource metadata.
Support
Write to hello.invalid [at] spellwarden [dot] ai. Security reports go to the same address.