Launching today
Spellwarden
Security checks for agent skills and MCP servers
1 follower
Security checks for agent skills and MCP servers
1 follower
Your AI agents load skills and MCP servers from the internet. Spellwarden checks them first: 65 open-source rules mapped to OWASP and NIST flag prompt injection, tool poisoning, leaked secrets and unpinned packages. Findings become policy for Claude Code hooks, Kong and Zuplo. Evals show whether a skill helps, runtime traces show what agents use, and a private registry admits only what passes. Free Apache-2.0 scanner, EU-hosted, live demo with no signup.
Free Options
Launch Team / Built With
CloudflareYour next app belongs on Cloudflare Workers. Deploy for free
Promoted
Hi Product Hunt, I'm Marius, the founder of Spellwarden. I also run NetBears, a DevOps consultancy in Romania.
This year every team I work with started giving their agents skills and MCP servers the way we once added npm packages: copied from a README, rarely read. A skill is a set of instructions your agent follows with your access, so that worried me. In February, Snyk scanned 3,984 public skills from ClawHub and skills.sh: 36.82% had at least one security flaw, and 76 contained malicious payloads (https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/).
Spellwarden checks them before your agents load them:
- Scan. 65 rules for skills, plugins, MCP servers, Claude Code configuration and A2A agent cards, mapped to the OWASP Agentic Top 10, the OWASP MCP Top 10 and NIST SP 800-53. Every finding shows the rule, the file and line, and the mapping. The scanner reads files and never runs them.
- Enforce. Turn findings into policy packs and export them to Claude Code hooks, Kong or Zuplo MCP Gateway. Each export lists what it cannot enforce.
- Prove. A paired eval run answers the same 40 tasks with and without a skill, so you see whether it helps before you roll it out. Our own Infra Pack measured +15.0 points (95% interval 3.6 to 26.4), published with the method.
- See. OpenTelemetry traces from Claude Code or any OpenTelemetry SDK show which servers, tools and skills your agents actually use, matched to your scans.
- Admit. A private registry, served as an MCP registry and as a Claude Code plugin marketplace, admits only what passes your policy (Enterprise plan).
Try it in two minutes:
- Live demo. A working organisation in the real product, read-only, no account needed: https://dash.spellwarden.ai/live-demo
- On your machine. Inside any repository, run: pipx run spellwarden scan .
A local scan sends nothing anywhere.
- GitHub Actions. In a pull_request workflow, add the step uses: spellwarden-ai/scan@v1.9.1 after actions/checkout, with the permissions contents: read, security-events: write and pull-requests: write. You get code scanning alerts, one pull request comment kept up to date, and a failed check at the severity you choose (fail-on, high by default): https://github.com/spellwarden-ai/scan
- GitLab CI. Add include: [{component: gitlab.com/spellwarden-ai/scan/scan@1.9.1}] to .gitlab-ci.yml for a Code Quality report and a merge request comment: https://gitlab.com/explore/catalog/spellwarden-ai/scan
- Connected to your organisation (Team plan or the trial). Add the input org with your organisation's URL name (and id-token: write on GitHub). The run proves which repository it is with the code host's signed OIDC token, so no secret goes into the repository; it applies your organisation's CI policy and reports to the dashboard. Pin the Action to a commit SHA in production, as its README shows.
Nice to know:
- Every rule has a public page with what it matches and an example: https://spellwarden.ai/docs/rules
- The catalog lists skills and MCP servers we have already checked, free to browse: https://spellwarden.ai/catalog
- Every MCP server is also checked against the 2026-07-28 MCP specification, with a migration checklist. Its deprecation window ends around 28 July 2027: https://spellwarden.ai/docs/mcp-2026-07-28-migration
- You can use Spellwarden from Claude or Claude Code through the connector: https://spellwarden.ai/docs/claude-connector
Questions I expect:
- False positives. fail-on sets the severity that fails a build, and a baseline file accepts a finding with a reason and an expiry date (at most 365 days).
- A skill that changes after approval. Every skill and server is pinned by its hash and rescanned every week, so a changed version is a new version with its own findings.
- Pricing. The scanner is free. Hosted Team is EUR 5 per member per month (minimum 10 members), with a 14-day trial and no card. Hosted in the EU. The code PRODUCTHUNT takes 10% off the first year of Team or Enterprise until 31 December.
The names come from a small magic theme (a skill is a spell, a policy pack is a ward), but every screen shows the plain word first.
I'd value your feedback on two things: which gateway or agent policy should export to next, and which check you expected that is missing. I'm here all day.