Comments
>log in to comment
Hi DevHunt, I'm Marius, the solo founder of Spellwarden. At my DevOps consultancy, teams started adding skills and MCP servers to their agents straight from a README, without reading them. A skill runs with your shell and your keys, so I built a scanner for exactly those files. Try it in a minute, no account: - pipx run spellwarden scan . in any repository with skills, Claude Code plugins, hooks or .mcp.json - the GitHub Action spellwarden-ai/scan or the GitLab component, with SARIF output - the live demo, a working organisation: https://dash.spellwarden.ai/live-demo The scanner is open source (Apache-2.0, 65 rules mapped to OWASP and NIST) and never runs the files it reads. The hosted plans add policy export to Claude Code hooks, Kong and Zuplo, paired evals, runtime traces and a private registry. What I'd most like from you: a false positive, a rule you'd expect that isn't there, or an agent config format I should read next.
More AI tools →74 free dev tools →
Looking for MCP servers to install? MCP servers list: 289 servers by category, official and community →
- Scan repositories in CI via GitHub Action or GitLab component
- Open‑source scanner licensed under Apache 2.0
- Catalog of curated skills, plugins and MCP servers
- Policy packs enforce security rules at gateways and hooks
- Enterprise plan adds private registry checks for MCP servers
Spellwarden scans AI agent skills and MCP servers for security issues and enforces policies.
- for
- Teams building or operating AI agents and MCP gateways.
- pricing
- freemium · free trial
- license
- Apache-2.0
- v1.10.0spellwarden 1.10.02 days ago
- v1.9.1spellwarden 1.9.12 days ago
- v1.9.0spellwarden 1.9.03 days ago
Key features
- Skill & Server Scanning — Scans SKILL.md packages, MCP servers and A2A agent cards with 65 static rules.
- Policy Packs — Exports enforcement rule packs to Claude Code hooks, Kong and Zuplo MCP Gateway.
- Eval Suites — Runs paired evaluations and grades skill impact before deployment.
- Runtime Tracing — Matches OpenTelemetry traces to scans to show what agents actually use.
- Private MCP Registry — Curates and admits only vetted, auth-enabled entries for MCP servers.
- CI Integration — GitHub Action and GitLab component add code-scanning alerts to PRs/MRs.
Use cases
- Validate third-party skill packages before agents load them.
- Enforce security policies on Claude Code, Kong or Zuplo gateways.
- Measure the security impact of new skills with paired eval runs.
- Monitor live agent usage via OpenTelemetry to detect unexpected loads.
Spellwarden vs alternatives
 Spellwarden |  Snyk |  Zitadel |  Semgrep | ||
|---|---|---|---|---|---|
| Best for | Static security scanning for AI agents | General code vulnerability scanning | Container and config scanning | Identity and SSO | Code static analysis |
| Pricing | Freemium | Subscription | Free | Free | Subscription |
| DevHunt upvotes | 1 | 0 | 0 | 0 | 0 |
| Launched | Nov 2026 | — | — | — | — |
- Spellwarden vs Snyk: Focuses on code, dependencies and containers, not AI agent skills or MCP servers.
- Spellwarden vs Trivy: Open-source vulnerability scanner for containers and configs, not agent skill policies.
- Spellwarden vs Zitadel: Identity infrastructure, unrelated to security scanning of AI agents.
- Spellwarden vs Semgrep: Static analysis for code bugs, not specialized AI agent skill and MCP security.
Spellwarden FAQ
Does Spellwarden execute code during scanning?+
No, it only reads files and configurations without executing them.
What output format does the scanner produce?+
Findings are reported in SARIF and can be viewed in CI as alerts or comments.
Can I run Spellwarden locally?+
Yes, the scanner is open-source (Apache-2.0) and can be run via pipx or in any CI pipeline.
How are policies enforced?+
Policy packs are exported to Claude Code hooks, Kong or Zuplo MCP Gateway where they enforce the defined rules.
Is there a hosted dashboard?+
Yes, an EU-hosted dashboard provides a unified view of findings, policy, evals and runtime data.
What integrations are available for CI?+
Spellwarden provides a GitHub Action and a GitLab component that add scanning alerts to pull/merge requests.
Summarized by DevHunt from spellwarden.ai · Nov 9, 2026. Details may change; check the official site.
