TheSpider Documentation

Security & bug audit platform — models run on your machine, the brain lives server-side. One image, two modes (SaaS + on-prem).
v2.0 — one image, two modes →

TheSpider

A multi-tenant security & bug audit platform. A thin Rust agent runs models locally on your checkout; a Bun brain-server owns config, prompts, parse/fingerprint/dedupe, triage, and the web UI. Your source code never leaves the machine — only findings sync.
Set up with your AI agentManual setupWhy data stays local

New here? Skip the setup entirely — paste this into Claude Code, Cursor, or any AI agent, answer three questions, and it installs, enrolls, and runs your first audit for you:

one prompt, zero setup
Get me started with TheSpider: https://thespider.xyz/startup.md

What you can do

    Run models on your own machine
    A single Rust binary holds only a server URL, a token, and model_code → command bindings. Your model CLIs and credentials stay local.
    Keep the brain server-side
    Fingerprinting, dedupe, AI adjudication, methodology, and all state live in the brain — never shipped to the agent.
    Gate pull requests before merge
    A persistent runner daemon claims campaigns created by forge webhooks. CI jobs only poll a cheap gate endpoint — no secrets, no model runtime in CI.
    Sync only what the model cited
    Source tree, full files, and local credentials never travel. Only git metadata and the findings block (with cited evidence) sync. An always-on secret scrubber masks values before they hit the database.
    Ship one image, run two modes
    The same Docker image is the multi-tenant SaaS and the single-tenant on-prem install. Bring your own Postgres, object storage, and model keys.
    License, don't lock in
    On-prem entitlements come from a signed license JWT (Ed25519). Past expiry + grace the instance goes read-only — reads and exports keep working, we never hold your data hostage.
The whole client surface
Four commands. One config file. Everything else is brain-side.
run an audit
thespider-agent login        # paste the enrollment code
thespider-agent run --once   # claim → run models → submit
thespider-agent gate --campaign <id>   # pass / fail
Minimal local config
Server, token, project, and model→command bindings. That is the entire client footprint.
~/.thespider/config.toml
server  = "https://thespider.xyz"
token   = "keychain:thespider"
project = "shipstream/thespider"

[[model]]
code    = "sonnet"
command = "bash runners/opencode-runner.sh {prompt_path} anthropic/claude-sonnet-4-6"
timeout_seconds = 900

Introduction

Learn what TheSpider is and why the brain lives server-side