Spellwarden

Spellwarden scans the skills and MCP servers your AI agents load before they run them. It looks for prompt injection, tool poisoning, leaked secrets, and specification violations. Every finding maps to OWASP and NIST frameworks, so you know what you're dealing with and why it matters.

The tool is built for teams running Claude Code, Cursor, VS Code, or other AI agents in production. You need visibility into what your agents can actually do, proof that new skills help before you deploy them, and a way to enforce security policy where your agents run.

What it does:

• Scan, 65 detection rules check SKILL.md packages, MCP servers and agent cards. Each skill gets a curation score from 0 to 12; servers are probed live against the MCP 2026-07-28 specification. Rescans happen weekly and after every CI run.
• Policy, Findings become enforcement rules you export to Claude Code hooks, Kong, or Zuplo MCP Gateway. You set baselines (eight rules included) and add your own. CI policy controls which rules apply in pipelines.
• Evals, Four sealed suites of 40 tasks each measure whether a skill actually helps. Paired runs show the lift in points with confidence intervals. Grades also cover tool descriptions and real agent sessions from your OpenTelemetry traces.
• Runtime, Send OTLP traces from Claude or any agent. Spellwarden matches every server, tool and skill used to your scans and findings, showing you what actually ran and what issues it had.
• Registry, A private MCP registry admits only what passes your policy. Pull and merge requests are checked against it; anything not admitted becomes a high finding with a request path.

Spellwarden runs on EU infrastructure (AWS Frankfurt). The scanner is open-source (Apache-2.0) and works in GitHub Actions and GitLab CI. The Infra Pack, five Claude Code skills for infrastructure tasks, is also open and measured in the open; version 0.9.0 scored +15.0 points across 40 infrastructure tasks.

You can try it free with the command-line scanner, GitHub Action, or GitLab component. Team and Enterprise plans add the hosted dashboard, continuous scanning, evals, runtime evidence, and integrations. Enterprise adds single sign-on, a private registry with allow entries, 20 million runtime records a month, and an audit log.