[{"data":1,"prerenderedAt":348},["ShallowReactive",2],{"-docs-getting-started-introduction":3,"-docs-getting-started-introduction-surround":338},{"id":4,"title":5,"body":6,"description":328,"extension":329,"links":330,"meta":331,"navigation":332,"path":334,"seo":335,"stem":336,"__hash__":337},"docs\u002Fdocs\u002F1.getting-started\u002F1.introduction.md","Introduction",{"type":7,"value":8,"toc":320},"minimark",[9,18,44,49,56,81,87,97,101,127,131,134,166,170,268,288,292],[10,11,12,13,17],"p",{},"TheSpider helps you audit a codebase for security vulnerabilities and bugs using the ",[14,15,16],"strong",{},"coding-agent \u002F LLM CLIs you already run locally",", while a central service handles config, prompts, parsing, dedupe, triage, and collaboration.",[19,20,21,24,25,29,30,35,36,39,40,43],"note",{},[14,22,23],{},"Setup in one prompt:"," tell your AI agent ",[26,27,28],"code",{},"Get me started with TheSpider: https:\u002F\u002Fthespider.xyz\u002Fstartup.md"," and it runs the whole setup for you — see the ",[31,32,34],"a",{"href":33},"\u002Fdocs\u002Fgetting-started\u002Fai-setup","AI Setup Wizard",". These docs are AI-native throughout: an MCP server (",[26,37,38],{},"\u002Fmcp",") and automatic ",[26,41,42],{},"llms.txt"," generation, compatible with AI tools out of the box.",[45,46,48],"h2",{"id":47},"what-is-thespider","What is TheSpider?",[10,50,51,52,55],{},"TheSpider is a ",[14,53,54],{},"multi-tenant security & bug audit platform"," built around a strict split:",[57,58,59,75],"ul",{},[60,61,62,63,66,67,70,71,74],"li",{},"A ",[14,64,65],{},"thin Rust agent"," (",[26,68,69],{},"thespider-agent",") runs on the machine that has the source tree. It claims audit slices, runs your model CLIs locally via a POSIX shell, and POSTs the ",[14,72,73],{},"raw model stdout"," back.",[60,76,62,77,80],{},[14,78,79],{},"Bun brain-server"," owns everything else: orgs, projects, RBAC, the versioned methodology corpus, prompt rendering, parsing, fingerprinting, dedupe (heuristics + AI adjudication), triage, reporting, billing, and the web UI.",[10,82,83,84],{},"The differentiator versus cloud scanners: ",[14,85,86],{},"your source code stays on your machine; only the findings the model chose to report — with the evidence it chose to cite — sync to the server.",[88,89,95],"pre",{"className":90,"code":92,"language":93,"meta":94},[91],"language-text","  thespider-agent (Rust)          HTTPS \u002F bearer          server (Bun + Hono)\n  • enroll + token (keychain)  ── claim \u002F results ──▶    • orgs \u002F projects \u002F RBAC\n  • model → command bindings   ◀── rendered prompts ──   • Postgres + object storage\n  • git detect + local models                            • Nuxt SPA (same origin)\n         source stays local                               never sees the source tree\n","text","",[26,96,92],{"__ignoreMap":94},[45,98,100],{"id":99},"what-you-can-do","What you can do",[57,102,103,109,115,121],{},[60,104,105,108],{},[14,106,107],{},"Audit a whole repo"," — kick off a full campaign; the brain renders prompts, the agent runs your models slice by slice, and findings are parsed, deduped, and triaged centrally.",[60,110,111,114],{},[14,112,113],{},"Scan a pull request"," — a forge webhook creates an incremental campaign scoped to the changed paths; the runner daemon runs it and CI polls a cheap gate.",[60,116,117,120],{},[14,118,119],{},"Triage as a team"," — multi-user web UI, project-level finding identity that carries across branches and merges, statuses with actor attribution.",[60,122,123,126],{},[14,124,125],{},"Run on-prem"," — the same image runs single-tenant inside your network. Bring your own Postgres, S3-compatible storage, and model keys.",[45,128,130],{"id":129},"when-to-use-thespider","When to use TheSpider",[10,132,133],{},"Use TheSpider when you need to:",[57,135,136,142,148,154,160],{},[60,137,138,141],{},[14,139,140],{},"Keep source code private."," A cloud scanner can't see your tree; TheSpider's agent never sends it.",[60,143,144,147],{},[14,145,146],{},"Use your own model credentials."," Your API keys and CLI auth are used by the local runner and never leave the host.",[60,149,150,153],{},[14,151,152],{},"Collaborate on audit data across a team and across branches."," Project-level finding identity + branch attribution means \"show only NEW issues on this PR\" is first-class.",[60,155,156,159],{},[14,157,158],{},"Gate merges"," without putting model runtime or secrets into CI.",[60,161,162,165],{},[14,163,164],{},"Run fully air-gapped."," The on-prem image validates its license against embedded public keys; no phone-home required.",[45,167,169],{"id":168},"the-two-deployment-modes","The two deployment modes",[171,172,173,188],"table",{},[174,175,176],"thead",{},[177,178,179,182,185],"tr",{},[180,181],"th",{},[180,183,184],{},"SaaS (multi-tenant)",[180,186,187],{},"On-prem (single-tenant)",[189,190,191,206,217,231,242,253],"tbody",{},[177,192,193,197,203],{},[194,195,196],"td",{},"Server",[194,198,199,202],{},[26,200,201],{},"thespider.xyz",", run by us",[194,204,205],{},"customer-run Docker Compose (bundled Postgres or BYO)",[177,207,208,211,214],{},[194,209,210],{},"Orgs",[194,212,213],{},"many",[194,215,216],{},"exactly one, created at first boot",[177,218,219,222,225],{},[194,220,221],{},"Entitlements",[194,223,224],{},"subscription + plan limits",[194,226,227,228],{},"claims in the signed ",[14,229,230],{},"license JWT",[177,232,233,236,239],{},[194,234,235],{},"Object storage",[194,237,238],{},"our S3\u002FR2",[194,240,241],{},"your S3-compatible creds (MinIO works)",[177,243,244,247,250],{},[194,245,246],{},"AI dedup key",[194,248,249],{},"platform key",[194,251,252],{},"your key\u002Fendpoint (env)",[177,254,255,258,263],{},[194,256,257],{},"Client config",[194,259,260],{},[26,261,262],{},"server = \"https:\u002F\u002Fthespider.xyz\"",[194,264,265],{},[26,266,267],{},"server = \"https:\u002F\u002Fspider.corp.example\"",[10,269,270,271,274,275,278,279,282,283,287],{},"The agent is ",[14,272,273],{},"mode-agnostic"," — the ",[26,276,277],{},"server"," URL in ",[26,280,281],{},"config.toml"," is its only coupling. There is no second client code path. See ",[31,284,286],{"href":285},"\u002Fdocs\u002Fdeploy\u002Fdeployment-modes","Deployment modes",".",[45,289,291],{"id":290},"where-to-go-next","Where to go next",[57,293,294,299,306,313],{},[60,295,296,298],{},[31,297,34],{"href":33}," — let your AI agent do the entire setup from one prompt.",[60,300,301,305],{},[31,302,304],{"href":303},"\u002Fdocs\u002Fgetting-started\u002Finstallation","Installation"," — prerequisites and how to boot the server + build the agent.",[60,307,308,312],{},[31,309,311],{"href":310},"\u002Fdocs\u002Fgetting-started\u002Fquickstart","Quickstart"," — run your first audit end-to-end in minutes.",[60,314,315,319],{},[31,316,318],{"href":317},"\u002Fdocs\u002Fguide\u002Fdata-handling","Data handling"," — exactly what crosses the boundary and how secrets are protected.",{"title":94,"searchDepth":321,"depth":321,"links":322},2,[323,324,325,326,327],{"id":47,"depth":321,"text":48},{"id":99,"depth":321,"text":100},{"id":129,"depth":321,"text":130},{"id":168,"depth":321,"text":169},{"id":290,"depth":321,"text":291},"Learn what TheSpider is and why the brain lives server-side","md",null,{},{"icon":333},"i-lucide-house","\u002Fdocs\u002Fgetting-started\u002Fintroduction",{"title":5,"description":328},"docs\u002F1.getting-started\u002F1.introduction","gusnACOC8uDrz3c8KUhS-1o8tr6lOFHafNDUbToLfO8",[339,344],{"title":340,"path":341,"stem":342,"description":343,"children":-1},"TheSpider Documentation","\u002Fdocs","docs\u002Findex","Security & bug audit platform — models run on your machine, the brain lives server-side. One image, two modes (SaaS + on-prem).",{"title":34,"path":33,"stem":345,"description":346,"icon":347,"children":-1},"docs\u002F1.getting-started\u002F2.ai-setup","Let your AI agent set up TheSpider for you — one prompt, zero manual steps","i-lucide-sparkles",1783955417315]