spidershield-mcp

SpiderRating MCP Server — security scanning and trust scores for MCP servers and agent skills.

Quick start

# Start as MCP server (no install)
npx spidershield-mcp

# CLI — check a published server
npx spidershield check anthropics/model-context-protocol

# CLI — gate in CI
npx spidershield gate anthropics/model-context-protocol --threshold 70

Claude Desktop setup

{
  "mcpServers": {
    "spidershield": {
      "command": "npx",
      "args": ["spidershield-mcp"],
      "env": {
        "SPIDERRATING_API_KEY": "sr_..."
      }
    }
  }
}

Free tier: no API key needed. get_trust_score and check_vulnerabilities use the public API. Pro tier: set SPIDERRATING_API_KEY for real-time scores, full findings, and priority scan queue.

MCP Tools

get_trust_score

Get the security trust score for an MCP server or skill.

{
  "owner": "anthropics",
  "repo": "model-context-protocol",
  "type": "server"
}

Returns: score (0-10), grade (A-F), verdict (safe/risky/malicious/unknown), risk factors, recommendation.

scan_mcp_server

Submit a GitHub repo for security scanning.

{
  "repo_url": "https://github.com/owner/my-mcp-server"
}

Returns: job ID. Call get_trust_score after ~30s for results.

check_vulnerabilities

Get detailed vulnerability findings.

{
  "owner": "owner",
  "repo": "my-mcp-server"
}

Returns: findings list with severity, file, line, message. Pro tier required for full detail.

evaluate_policy

Pre-screen a tool call against a security policy.

{
  "tool_name": "execute_command",
  "arguments": { "command": "rm -rf /" },
  "policy": "balanced"
}

Returns: ALLOW / DENY / ESCALATE with reason and suggestion.

CLI commands

| Command | Description | |---------|-------------| | npx spidershield-mcp | Start MCP server (stdio) | | npx spidershield check <owner/repo> | Quick trust score lookup | | npx spidershield scan [path] | Local scan (requires Python spidershield) | | npx spidershield gate <owner/repo> | CI gate — exit 1 if score below threshold | | npx spidershield report <owner/repo> | Security report summary |

PreToolUse hook (Claude Code)

Add to ~/.claude/settings.json to check every MCP tool call before execution:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "mcp__*",
      "hooks": [{
        "type": "command",
        "command": "curl -sf --max-time 3 'https://api.spiderrating.com/v1/public/check?tool='\"$TOOL_NAME\" | python3 -c \"import sys,json; d=json.load(sys.stdin); v=d.get('verdict','unknown'); g=d.get('grade',''); s=d.get('score'); sc=f' [{g} {s:.1f}/10]' if s else ''; print(f'[SpiderRating] {v.upper()}{sc}', file=sys.stderr); sys.exit(1 if d.get('block') else 0)\" || true"
      }]
    }]
  }
}

Privacy

• check / report: sends only the owner/repo slug — no code, no tokens
• scan: cloud scanning submits the repo URL; SpiderRating clones from GitHub
• evaluate_policy: sends tool name + arguments to the policy engine only

Links

• SpiderRating Trust Registry
• Docs
• GitHub