Spellwarden

Your AI agents load skills and MCP servers from the internet. Spellwarden checks them first: 65 open-source rules mapped to OWASP and NIST flag prompt injection, tool poisoning, leaked secrets and unpinned packages. Findings become policy for Claude Code hooks, Kong and Zuplo. Evals show whether a skill helps, runtime traces show what agents use, and a private registry admits only what passes. Free Apache-2.0 scanner, EU-hosted, live demo with no signup.