Introduction

TheSpider is a team dashboard for security and bug audits. You run the coding-agent CLIs you already have (Grok, Claude Code, Codex, OpenCode, or another) against a checkout. TheSpider collects the results, de-duplicates them, and lets the team triage in one place.

Your source tree stays on the machine that runs the model. TheSpider receives git metadata and the model's output. If that CLI talks to a cloud provider, that provider's data policy still applies.

How a first audit works

1. You install thespider-agent (or connect through MCP and skip the binary).
2. Setup logs you in through the browser and writes .thespider/config.toml in the repo.
3. You approve one bounded run. The agent claims a slice, runs your local CLI, and posts the output.
4. You open the project URL and look at findings.

The server owns prompts, parsing, de-duplication, triage, and history. The agent is a small local binary that claims work and runs commands.

Two audit profiles

Every project has Security and Bugs. Pick one as the default for a checkout. Findings still live at the project level, so a triage decision carries across both profiles and across branches.

Cloud or on-prem

These docs are for TheSpider Cloud. We host the server and the UI. You install the client, pick a local model CLI, and go.

If you need to run the server yourself (data residency, private network, air-gap), see the on-prem overview. That edition is Business yearly.

Where to go next

• AI setup: let a coding agent walk you through it.
• Install the agent: Linux, macOS, or Windows (git-bash).
• Cloud quickstart: type the commands yourself.
• Data handling: exactly what crosses the wire.