TheSpider
Get Started

TheSpider Documentation

Run the coding agents you already use against a repo. Findings land in one dashboard. Your source stays on your machine.
What TheSpider is →

TheSpider

Point TheSpider at a repository, pick a local model CLI, and run an audit. Findings show up in one place for your team. The checkout never leaves your machine.
Set up with your AI agentManual setupWhat we receive

New here? Paste this into Claude Code, Cursor, or another AI agent:

one guided setup prompt
Get me started with TheSpider: https://thespider.xyz/startup.md

How it fits together

Models run on your machine. Findings live in TheSpider Cloud. The checkout never crosses.

TheSpider splits an audit in two. On your machine: the checkout, your model CLI, its keys, and thespider-agent. In TheSpider Cloud: slice prompts, parsing, the findings dashboard, and the PR gate. Over HTTPS the agent receives a prompt and sends git metadata plus model stdout. Source files and model keys never leave your machine.

Your machine

CLI environment

  • The checkout

    Read on this machine. Never uploaded.

  • Your model CLI

    Grok, Claude Code, Codex, OpenCode, or another.

  • Model keys

    Stay with that CLI. TheSpider never sees them.

  • thespider-agent

    Claims a slice, runs the CLI, posts the output.

Source tree and API keys stay here.

HTTPS

Prompt

Server → agent

Git + stdout

Agent → server

Never files or keys

TheSpider Cloud

Server and dashboard

  • Slice prompts

    Rendered on the server, sent down to the agent.

  • Parse and de-dupe

    Stdout becomes findings, not a pile of reports.

  • Team dashboard

    Triage and history, Security and Bugs together.

  • PR gate

    CI asks pass or fail. It never runs a model.

Does not receive the checkout.

  1. 1Setup
  2. 2Claim a slice
  3. 3Run locally
  4. 4Post output
  5. 5Triage
One audit, two sides. Your models stay with you. Findings live in TheSpider.

What you can do

    Use the agents you already have
    Bind Grok, Claude Code, Codex, OpenCode, or any other local CLI. Model keys stay with that CLI.
    Audit a repo or a pull request
    Full scans, PR-scoped incrementals, and targeted retests. Findings are de-duplicated so the same bug does not pile up.
    Triage as a team
    Status, notes, and history live on the project. A won't-fix on main stays a won't-fix on the next PR.
    Gate merges without models in CI
    A daemon on a box you control runs the models. CI only asks TheSpider if the campaign passed.
    Keep the checkout local
    TheSpider gets git metadata and model output, not your source tree. Cloud model CLIs still follow their own provider policies.
    Host it yourself if you need to
    Cloud is the default. On-prem is the same product on your infrastructure, for residency or air-gap.
Three commands to a first finding
Setup writes a small config, opens a browser login, and checks that the local CLI is ready. One bounded run is enough to see the dashboard.
first audit
thespider-agent setup --model xai/grok-4.6 --agent grok --profile security
# approve the browser login, then:
thespider-agent run --once --max-slices 1
The only file you commit
Server, project, profile, and which model to run. Tokens live in your user data directory, not in the repo.
.thespider/config.toml
server  = "https://thespider.xyz"
project = "acme/payments"
profile = "security"

[[model]]
code     = "xai/grok-4.6"
agent    = "grok"
timeout_seconds = 1200

Introduction

What TheSpider is, how a first audit works, and where to start

Copyright © 2026