Scanner rules
Last updated 7 November 2026
The Spellwarden scanner checks skills, MCP servers, agent configuration and A2A agent cards with 65 baseline rules. The scanner is open source and runs every rule for free except the 3 registry rules, which run only in connected mode on the Enterprise plan. Its code is on GitHub at github.com/spellwarden-ai/spellwarden. Each rule below has a page that says what it detects, why it matters, shows an example, and tells you how to fix it or what to do when the finding is not a problem. The examples were run against the scanner, except 4 that are illustrations because they need a live registry or a remote agent card; their pages say so.
Plans: All plans
How ids and severities work
A rule id is SW, a three-letter area and three digits: SW-SKL-001 for a skill package, SW-MCP-001 for a probed MCP server, SW-CFG-001 for agent configuration, SW-REG-001 for the registry check of connected mode and SW-A2A-001 for an A2A agent card. Some numbers are reserved and unused, so the ids have gaps.
Severity is critical, high, medium or low. The severity in the tables is each rule's worst case. Since scanner 1.9.0 two MCP rules grade a finding by what the probe saw, and their pages say how. By default a scan fails on a high or critical finding that is not accepted.
Five rules are malicious indicators: an open finding from one of them quarantines the package. The OWASP columns use the OWASP Top 10 for Agentic Applications (ASI) and the OWASP MCP Top 10 (MCP). The NIST column is a provisional mapping to SP 800-53 base controls.
Skill package rules
These rules judge a skill package: every file below a directory that holds a SKILL.md.
| Id | Title | Default severity | OWASP | NIST |
|---|---|---|---|---|
| SW-SKL-001 | Prompt-injection phrases in skill instructions | High | ASI01 | SI-10 |
| SW-SKL-002 | Hidden text: zero-width or bidirectional control characters | High | ASI01 | SI-10 |
| SW-SKL-003 | Instructions to skip approvals or disable hooks | High | ASI10 | AC-6 |
| SW-SKL-004 | Encoded payload decoded and executed (malicious indicator) | Critical | ASI04 | SR-3 |
| SW-SKL-005 | Writes to agent configuration | High | ASI10 | AC-6 |
| SW-SKL-006 | Destructive command without a confirmation step | Medium | ASI10 | AC-6 |
| SW-SKL-007 | Remote script piped to a shell | High | ASI04, MCP04 | SR-3 |
| SW-SKL-008 | Sends local file contents to an external host (malicious indicator) | Critical | ASI10 | SC-7 |
| SW-SKL-009 | Unpinned dependency install | Medium | ASI04, MCP04 | SR-3 |
| SW-SKL-010 | Bundled binary or executable file | Medium | ASI04 | SR-3 |
| SW-SKL-011 | Hard-coded credential in the package | Critical | MCP01 | IA-5 |
| SW-SKL-012 | Reads a credential file path without stating purpose | Medium | ASI04 | IA-5 |
| SW-SKL-013 | Network calls to raw IP addresses or URL shorteners | Medium | ASI10 | SC-7 |
| SW-SKL-014 | Obfuscated script code | Medium | ASI04 | SR-3 |
| SW-SKL-015 | Frontmatter missing or invalid (name, description) | Low | ASI04 | SR-3 |
| SW-SKL-019 | Fetches external URL content into context without an allowlist | Medium | ASI01, MCP06 | SI-10 |
| SW-SKL-031 | Missing license and version metadata | Low | ASI04 | SR-3 |
| SW-SKL-032 | Instructions lure the user into running a password-protected download or a pasted script (malicious indicator) | Critical | ASI04, ASI09 | SR-3, SI-3 |
| SW-SKL-036 | Frontmatter pre-approves an unscoped shell or interpreter | Medium | ASI02, ASI03 | AC-6, CM-7 |
| SW-SKL-037 | Executable downloaded from a moving reference and run without an integrity check | Medium | ASI04, ASI05, MCP04 | SR-3, SI-7 |
MCP server rules
These rules judge what an MCP server answered to an unauthenticated probe, from the hosted product or from the scanner's probe option.
| Id | Title | Default severity | OWASP | NIST |
|---|---|---|---|---|
| SW-MCP-001 | Server lists tools without authentication | High | MCP07 | AC-3 |
| SW-MCP-002 | Static key authentication instead of OAuth | Medium | MCP01, MCP07 | IA-5 |
| SW-MCP-003 | OAuth dynamic client registration (deprecated; use Client ID Metadata Documents) | Medium | MCP07 | IA-5 |
| SW-MCP-004 | HTTP+SSE transport (deprecated) | Medium | ASI04 | SR-3 |
| SW-MCP-005 | Spec version older than 2026-07-28 | Low | ASI04 | SR-3 |
| SW-MCP-006 | Protocol sessions (Mcp-Session-Id) in use | Medium | ASI04 | SR-3 |
| SW-MCP-007 | Requires the initialize handshake; no server/discover | Medium | ASI04 | SR-3 |
| SW-MCP-008 | Uses deprecated Roots, Sampling or Logging | Medium | ASI04 | SR-3 |
| SW-MCP-009 | Endpoint not served over HTTPS | High | None | SC-7 |
| SW-MCP-010 | No protected resource metadata, or issuer not validated | Medium | MCP07 | IA-5 |
| SW-MCP-011 | Tool description contains instruction-like text | High | ASI01, MCP03 | SI-10 |
Configuration rules
These rules judge MCP client configurations, Claude Code settings and hooks, and plugin marketplaces in a repository.
| Id | Title | Default severity | OWASP | NIST |
|---|---|---|---|---|
| SW-CFG-001 | Remote MCP server over plain HTTP | High | None | SC-7 |
| SW-CFG-002 | Credential written into an MCP server configuration | Critical | MCP01, MCP07 | IA-5 |
| SW-CFG-003 | MCP server launched from an unpinned package | Medium | ASI04, MCP04 | SR-3 |
| SW-CFG-004 | MCP server at a raw IP address or behind a URL shortener | Medium | ASI10 | SC-7 |
| SW-CFG-005 | Hook pipes remote content to a shell | High | ASI04 | SR-3 |
| SW-CFG-006 | Hook sends local file contents to an external host (malicious indicator) | Critical | ASI10 | SC-7 |
| SW-CFG-007 | Hook decodes and runs an encoded payload (malicious indicator) | Critical | ASI04 | SR-3 |
| SW-CFG-008 | Settings switch off approval prompts | High | ASI10 | AC-6 |
| SW-CFG-009 | Marketplace plugin source not pinned to a commit | Medium | ASI04, MCP04 | SR-3 |
| SW-CFG-010 | Literal value under a secret name in an MCP server configuration | High | MCP01, MCP07 | IA-5 |
| SW-CFG-012 | MCP server configured to approve every tool call automatically | High | ASI02 | AC-6, CM-7 |
| SW-CFG-013 | Database or cluster MCP server with write access although a read-only mode exists | High | ASI03, MCP02 | AC-3, AC-6 |
Private registry rules
These rules run only in connected mode on the Enterprise plan: they check pull and merge requests against an organisation's private registry, and the scanner on its own never reports them.
| Id | Title | Default severity | OWASP | NIST |
|---|---|---|---|---|
| SW-REG-001 | Skill package not admitted in the organisation's private registry | High | ASI04 | SR-3 |
| SW-REG-002 | MCP server not admitted in the organisation's private registry | High | MCP09 | SR-3 |
| SW-REG-003 | Agent content the private registry cannot judge | High | ASI04 | SR-3 |
A2A agent card rules
These rules judge an A2A agent card, found in a repository or fetched from a remote agent when the probe option is on.
| Id | Title | Default severity | OWASP | NIST |
|---|---|---|---|---|
| SW-A2A-001 | Agent card does not follow A2A 1.0 | Medium | ASI07 | SI-10 |
| SW-A2A-002 | Agent card uses a format older than A2A 1.0 | Medium | ASI07 | SI-10 |
| SW-A2A-003 | Agent card at the path used before A2A 0.3 | Medium | ASI07 | SI-10 |
| SW-A2A-004 | Agent endpoint or authentication URL not served over HTTPS | High | ASI07 | SC-8 |
| SW-A2A-005 | OAuth implicit or password flow declared (deprecated in A2A 1.0) | High | ASI03 | IA-5 |
| SW-A2A-006 | OAuth authorization code flow without PKCE required | Medium | ASI03 | IA-5 |
| SW-A2A-007 | Agent declares no authentication | Medium | ASI03 | AC-3 |
| SW-A2A-008 | API key sent in the URL query | Medium | ASI03 | IA-5 |
| SW-A2A-009 | Skill inherits every scope of the agent | Low | ASI03 | AC-6 |
| SW-A2A-010 | Agent card signature does not verify | High | ASI07 | SI-7 |
| SW-A2A-011 | Agent card signature is malformed or uses a refused algorithm | High | ASI07 | SI-7 |
| SW-A2A-012 | Agent card is not signed | Low | ASI07 | SI-7 |
| SW-A2A-013 | Signing key not bound to the card's host | Medium | ASI07 | SI-7 |
| SW-A2A-014 | Agent card text contains injected instructions or hidden characters | High | ASI01 | SI-10 |
| SW-A2A-015 | Credential in the agent card | Critical | ASI03 | IA-5 |
| SW-A2A-016 | Agent card fetched through a redirect to another host | Medium | ASI07 | SC-8 |
| SW-A2A-017 | Agent card signed with a shared secret that only the agent can check | Medium | ASI07 | SI-7 |
| SW-A2A-018 | Agent card cannot be read | High | ASI07 | SI-10 |
| SW-A2A-019 | Agent card member spelled two ways | High | ASI07 | SI-10 |
Coverage by OWASP identifier
Work from the OWASP lists and find the rules that cover each entry. The rule ids are listed here as text; each rule has its page in the tables above.
| Entry | Name | Rules |
|---|---|---|
ASI01 | Agent Goal Hijack | SW-SKL-001, SW-SKL-002, SW-SKL-019, SW-MCP-011, SW-A2A-014 |
ASI02 | Tool Misuse and Exploitation | SW-SKL-036, SW-CFG-012 |
ASI03 | Identity and Privilege Abuse | SW-SKL-036, SW-CFG-013, SW-A2A-005, SW-A2A-006, SW-A2A-007, SW-A2A-008, SW-A2A-009, SW-A2A-015 |
ASI04 | Agentic Supply Chain Vulnerabilities | SW-SKL-004, SW-SKL-007, SW-SKL-009, SW-SKL-010, SW-SKL-012, SW-SKL-014, SW-SKL-015, SW-SKL-031, SW-SKL-032, SW-SKL-037, SW-MCP-004, SW-MCP-005, SW-MCP-006, SW-MCP-007, SW-MCP-008, SW-CFG-003, SW-CFG-005, SW-CFG-007, SW-CFG-009, SW-REG-001, SW-REG-003 |
ASI05 | Unexpected Code Execution (RCE) | SW-SKL-037 |
ASI06 | Memory & Context Poisoning | None tagged |
ASI07 | Insecure Inter-Agent Communication | SW-A2A-001, SW-A2A-002, SW-A2A-003, SW-A2A-004, SW-A2A-010, SW-A2A-011, SW-A2A-012, SW-A2A-013, SW-A2A-016, SW-A2A-017, SW-A2A-018, SW-A2A-019 |
ASI08 | Cascading Failures | None tagged |
ASI09 | Human-Agent Trust Exploitation | SW-SKL-032 |
ASI10 | Rogue Agents | SW-SKL-003, SW-SKL-005, SW-SKL-006, SW-SKL-008, SW-SKL-013, SW-CFG-004, SW-CFG-006, SW-CFG-008 |
| Entry | Name | Rules |
|---|---|---|
MCP01 | Token Mismanagement & Secret Exposure | SW-SKL-011, SW-MCP-002, SW-CFG-002, SW-CFG-010 |
MCP02 | Privilege Escalation via Scope Creep | SW-CFG-013 |
MCP03 | Tool Poisoning | SW-MCP-011 |
MCP04 | Software Supply Chain Attacks & Dependency Tampering | SW-SKL-007, SW-SKL-009, SW-SKL-037, SW-CFG-003, SW-CFG-009 |
MCP05 | Command Injection & Execution | None tagged |
MCP06 | Prompt Injection via Contextual Payloads | SW-SKL-019 |
MCP07 | Insufficient Authentication & Authorization | SW-MCP-001, SW-MCP-002, SW-MCP-003, SW-MCP-010, SW-CFG-002, SW-CFG-010 |
MCP08 | Lack of Audit and Telemetry | None tagged |
MCP09 | Shadow MCP Servers | SW-REG-002 |
MCP10 | Context Injection & Over-Sharing | None tagged |
OWASP Top 10 for Agentic Applications: 8 of 10 entries have at least one tagged rule. OWASP MCP Top 10: 7 of 10 entries have at least one tagged rule.
Each list has its own page with a section for every entry: OWASP MCP Top 10 and Spellwarden rules, OWASP Top 10 for Agentic Applications and Spellwarden rules and, as Spellwarden's own mapping, OWASP Agentic Skills Top 10 and Spellwarden rules.
Enforcement rules of the baseline policy pack
The baseline policy pack has eight enforcement rules. They are not scanner rules and have no pages here: they name a control that an export for Claude Code hooks, Kong or Zuplo can enforce. They are listed with what each export cannot enforce in the policy guide.
- SW-HK-001: Block remote scripts piped to a shell in agent shell tools
- SW-HK-002: Block reads of credential files (~/.aws, ~/.ssh, .env)
- SW-GW-003: Deny MCP upstreams without OAuth
- SW-GW-004: Prompt-injection deny patterns on prompts and tool results
- SW-EG-005: Sandbox egress only to registry-admitted hosts
- SW-GW-006: Destructive tool verbs require human approval
- SW-RG-007: Registry admits only curated, auth-enabled entries on spec 2026-07-28 (or grace-flagged before the deadline) with no open critical or high finding
- SW-OB-008: Emit an audit record for every tool call
Organisation rules
Rules you write yourself are organisation rules, with ids from SW-ORG-001 to SW-ORG-999. A manager promotes a finding into one, and it runs on every scan and in CI. See the policy guide.