[{"data":1,"prerenderedAt":379},["ShallowReactive",2],{"-docs-getting-started-mcp":3,"-docs-getting-started-mcp-surround":366},{"id":4,"title":5,"body":6,"description":356,"extension":357,"links":358,"meta":359,"navigation":360,"path":362,"seo":363,"stem":364,"__hash__":365},"docs\u002Fdocs\u002F1.getting-started\u002F5.mcp.md","Use TheSpider through MCP",{"type":7,"value":8,"toc":344},"minimark",[9,18,23,26,63,75,83,90,95,102,109,112,116,162,168,172,205,214,218,221,272,279,283,294,303,307,320,323,331,340],[10,11,12,13,17],"p",{},"The remote Model Context Protocol (MCP) server lets your coding agent run TheSpider without the\n",[14,15,16],"code",{},"thespider-agent"," binary. The coding agent reads your checkout with its own tools and performs each\nslice as the audit model.",[19,20,22],"h2",{"id":21},"connect-your-mcp-client","Connect your MCP client",[10,24,25],{},"Add the server to Claude Code:",[27,28,33],"pre",{"className":29,"code":30,"language":31,"meta":32,"style":32},"language-sh shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","claude mcp add --transport http thespider https:\u002F\u002Fthespider.xyz\u002Fv1\u002Fmcp\n","sh","",[14,34,35],{"__ignoreMap":32},[36,37,40,44,48,51,54,57,60],"span",{"class":38,"line":39},"line",1,[36,41,43],{"class":42},"sBMFI","claude",[36,45,47],{"class":46},"sfazB"," mcp",[36,49,50],{"class":46}," add",[36,52,53],{"class":46}," --transport",[36,55,56],{"class":46}," http",[36,58,59],{"class":46}," thespider",[36,61,62],{"class":46}," https:\u002F\u002Fthespider.xyz\u002Fv1\u002Fmcp\n",[10,64,65,66,70,71,74],{},"In Claude Desktop, open ",[67,68,69],"strong",{},"Settings → Connectors → Add custom connector",", name it ",[14,72,73],{},"TheSpider",", and\nset the connector URL to:",[27,76,81],{"className":77,"code":79,"language":80,"meta":32},[78],"language-text","https:\u002F\u002Fthespider.xyz\u002Fv1\u002Fmcp\n","text",[14,82,79],{"__ignoreMap":32},[10,84,85,86,89],{},"The server uses the stateless MCP ",[14,87,88],{},"2026-07-28"," protocol. Your MCP client opens a browser once for\nOAuth 2.1 authorization. The consent screen shows the requesting application, its return address,\nand the organization whose projects, campaigns, findings, triage, readiness, usage, and PR gates it\ncan read and write. Access tokens expire after one hour; the client rotates refresh tokens in the\nbackground.",[91,92,94],"h3",{"id":93},"what-the-token-can-do","What the token can do",[10,96,97,98,101],{},"The issued token is bound to the MCP endpoint (",[14,99,100],{},"\u002Fv1\u002Fmcp",") and is refused on every other API route,\nso an authorized MCP client can reach only what the 15 tools expose — not the organization,\nmember, invitation, or import surfaces of the REST API.",[10,103,104,105,108],{},"The grant is also tied to the person who approved it. It stops working as soon as that account is\nbanned, deleted, suspended, or removed from the organization, and a role change narrows it at once.\nAn organization admin can end every grant from ",[67,106,107],{},"Settings → Tokens → Revoke",", which also kills the\nrefresh tokens behind them.",[10,110,111],{},"Ending a grant is currently an organization-wide action; there is no per-client revoke screen yet.",[19,113,115],{"id":114},"roles","Roles",[117,118,119,132],"table",{},[120,121,122],"thead",{},[123,124,125,129],"tr",{},[126,127,128],"th",{},"Action",[126,130,131],{},"Role required",[133,134,135,144,151],"tbody",{},[123,136,137,141],{},[138,139,140],"td",{},"Authorize an MCP client for an organization",[138,142,143],{},"member",[123,145,146,149],{},[138,147,148],{},"Enable this host-agent model on an existing project",[138,150,143],{},[123,152,153,159],{},[138,154,155,156],{},"Create a new project from ",[14,157,158],{},"thespider_init",[138,160,161],{},"admin",[10,163,164,165,167],{},"If you are a member and the repository has no project yet, ask an organization admin to create it\nonce. Every later session — including ",[14,166,158],{}," — works at the member role.",[19,169,171],{"id":170},"initialize-a-repository","Initialize a repository",[173,174,175,179,186,191,198],"ol",{},[176,177,178],"li",{},"Open your coding agent in the repository you want to audit.",[176,180,181,182,185],{},"Ask it to call ",[14,183,184],{},"thespider_status",". The agent must do this at the start of every session.",[176,187,181,188,190],{},[14,189,158],{}," with the repository path and its model family.",[176,192,193,194,197],{},"Let the agent write the returned ",[14,195,196],{},".thespider\u002Fmcp.json"," pointer file verbatim.",[176,199,200,201,204],{},"Keep the returned ",[14,202,203],{},"project_handle"," in the conversation. Every project-scoped tool requires it.",[10,206,207,208,210,211,213],{},"The pointer file contains the server, organization, project, profile, and model codes. It contains no\ntoken or opaque handle, is safe to commit, and lets a later session identify the same project. A new\nsession calls ",[14,209,158],{}," again to mint a fresh ",[14,212,203],{},".",[19,215,217],{"id":216},"run-an-audit","Run an audit",[10,219,220],{},"Use this loop:",[173,222,223,233,239,242,256,262],{},[176,224,225,226,229,230,232],{},"Call ",[14,227,228],{},"thespider_start_audit"," with the ",[14,231,203],{}," and current branch, commit, and dirty state.",[176,234,225,235,238],{},[14,236,237],{},"thespider_next_slice"," with the returned campaign ID.",[176,240,241],{},"Analyze the repository against the complete slice prompt with the coding agent's file-reading\ntools. Do not edit the target code during the audit.",[176,243,225,244,247,248,251,252,255],{},[14,245,246],{},"thespider_submit_findings"," with the returned ",[14,249,250],{},"slice_handle"," and the findings array. Submit\n",[14,253,254],{},"findings: []"," when the slice is clean.",[176,257,258,259,261],{},"Repeat steps 2–4 until ",[14,260,237],{}," reports that no claimable slices remain.",[176,263,225,264,267,268,271],{},[14,265,266],{},"thespider_list_findings"," to review results. For an incremental campaign, call\n",[14,269,270],{},"thespider_pr_gate"," to read the gate result.",[10,273,274,275,278],{},"Report campaign progress as ",[67,276,277],{},"completed of total",". Do not call a campaign complete while slices\nremain.",[19,280,282],{"id":281},"keep-handles-with-the-matching-tool-call","Keep handles with the matching tool call",[10,284,285,287,288,290,291,293],{},[14,286,203],{}," identifies the selected organization, project, profile, model, and local workspace\nfor the current session. ",[14,289,250],{}," identifies one claimed lease and carries the prompt hash and\nfinding marker needed by ",[14,292,246],{},". Both handles are opaque and integrity-protected.\nThey do not replace the OAuth token or grant additional access.",[10,295,296,297,299,300,302],{},"If a handle is unreadable, call ",[14,298,158],{}," again for a project handle or\n",[14,301,237],{}," again for a slice handle. Do not edit either value.",[19,304,306],{"id":305},"add-another-model","Add another model",[10,308,309,310,312,313,319],{},"Each MCP session declares one model family because the connected coding agent is the model. To add a\nsecond model's perspective, open the same repository with a different coding agent or model family,\nauthorize the same TheSpider organization, and call ",[14,311,158],{}," again ",[67,314,315,316],{},"with the same\n",[14,317,318],{},"git_remote_url"," — that argument is how the server matches the existing project instead of creating\na second one. It then enables the new model on that project.",[10,321,322],{},"Start an audit at the same commit from the new session. The existing campaign is reused and topped up\nwith slices for the newly enabled model, so both perspectives land in one campaign. Each session\nclaims only its own model's slices, and findings pass through the same server-side parser, scrubber,\nfingerprinting, and deduplication pipeline.",[10,324,325,327,328,330],{},[14,326,158],{}," changes nothing else about the project's model configuration. Enabling a host-agent\nmodel never affects campaigns started by ",[14,329,16],{}," or by a webhook: those plan only the\nmodels a local agent can claim.",[10,332,333,334,339],{},"See ",[335,336,338],"a",{"href":337},"\u002Fdocs\u002Fguide\u002Fdata-handling","Data handling"," for what TheSpider receives and what your coding-agent\nprovider can receive while it reads the checkout.",[341,342,343],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":32,"searchDepth":345,"depth":345,"links":346},2,[347,351,352,353,354,355],{"id":21,"depth":345,"text":22,"children":348},[349],{"id":93,"depth":350,"text":94},3,{"id":114,"depth":345,"text":115},{"id":170,"depth":345,"text":171},{"id":216,"depth":345,"text":217},{"id":281,"depth":345,"text":282},{"id":305,"depth":345,"text":306},"Run complete audits from a coding agent without installing the local agent","md",null,{},{"icon":361},"i-lucide-plug","\u002Fdocs\u002Fgetting-started\u002Fmcp",{"title":5,"description":356},"docs\u002F1.getting-started\u002F5.mcp","L-HTzyR11ctRRh0CWRCmez9xnw3NorOgj1ovAyazHZ0",[367,373],{"title":368,"path":369,"stem":370,"description":371,"icon":372,"children":-1},"Cloud quickstart","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F1.getting-started\u002F4.quickstart","Set up Claude Code and run one bounded Security or Bugs slice","i-lucide-zap",{"title":374,"path":375,"stem":376,"description":377,"icon":378,"children":-1},"Configuration","\u002Fdocs\u002Fguide\u002Fconfiguration","docs\u002F2.guide\u002F1.configuration","XDG user auth store and commit-safe project config","i-lucide-settings",1785902846497]