Spellwarden

Spellwarden checks the skills and MCP servers your coding agents load before they run. Core capabilities: • 65 open-source detection rules mapped to OWASP and NIST • Prompt injection and tool poisoning detection • Leaked secret and unpinned package findings • Policy enforcement through Claude Code hooks, Kong and Zuplo gateways • Eval scores showing whether a skill helps, plus runtime traces of what agents use Findings become enforceable policy rather than a one-off report. Pass or fail results feed a private registry that admits only vetted skills and MCP servers, so teams control what reaches their agents. Evals measure real benefit, and runtime traces reveal which tools are actually called. Built for security engineers, platform teams and developers who adopt MCP servers and third-party skills. The Apache-2.0 scanner is free to use, the platform is hosted in the EU, and a live demo is available without signup. Works with Claude Code, Cursor and VS Code.