spawn-mcp (wfbcargo/wfbcargo_spawn_mcp) is an MCP server listed on the M8ven Trust Index. It scores 73 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.

C
Caution
73/100

spawn-mcp

Local MCP server for the Spawn Games agent API, enabling LLMs to manage game projects, push updates, and interact with live games via a Playwright Chromium client.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

wfbcargo

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — spawn_init (line 192: mkdirSync(p, { recursive: true }))
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes41 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

spawn_asset_sync

Sync the asset bank with your Spawn ACCOUNT: list every game you own, fetch each one's current server-side spec, and harvest the cdn/ assets it actually uses. This is the authoritative fill — it covers games you have no local checkout of, and assets a teammate or Savi added that never landed on your

spawn_asset_scan

Harvest every cdn/ asset path used in a project (or any directory) into the local cross-project asset bank, recording which files and which game use it. Spawn generates an asset on first fetch of its path and keeps it there forever, so the same path in another game is the same asset — but there is n

spawn_asset_search

Search the local asset bank for assets you (or your other projects) have already used. Call this BEFORE inventing a new cdn/ asset name: a path that already produced good art is reusable across games verbatim, and a path marked bad tells you what not to spell. Every result reports how many distinct

spawn_asset_note

Name, categorize, describe or judge an asset in the bank — including a path that has not been scanned or even used yet. A name is a short handle you can use in place of the path in every other asset tool. This is the memory the platform does not keep: a Spawn asset is generated once from its path an

spawn_asset_preview

Check whether an asset actually exists on Spawn's CDN, and LOOK AT IT if it is an image (returned inline, so you can judge it rather than guess from the filename). Use it on an unfamiliar path before building around it, and after generating a new one to see what the name produced. Safe to call: it q

spawn_audit_scan

List a game's exported functions and say which can be audited locally. Engine-coupled functions take objectApi as a parameter (the engine injects it, never imports it), so the signature alone decides: no api parameter and no engine-only require means the function is pure and runnable in plain Node.

spawn_audit_math

Run declared numeric invariants over the game's pure functions, locally: no browser, no live room, no push, no credentials. Sweeps each function across its declared input domain and reports the exact arguments that broke a rule. Catches what playing the game catches slowly and unreliably — NaN and I

spawn_play_open

Open the live Spawn play URL in a local Chromium (Playwright). Headed by default so you can watch. Use this as the agent's eyes/hands on the game — Spawn is WebGPU/canvas, so screenshot + input beat accessibility trees. Resolves play URL from the variant if omitted. Keep it HEADED: headless Chromium

spawn_play_screenshot

Screenshot the open play session. Primary visual check after spawn_push — look at the image before calling the change done. Judge it as a player would: if it reads as grey boxes, flat untextured shapes, or default browser UI, that is a missing skill rather than a missing feature — load the relevant

spawn_play_input

Send keyboard/mouse actions to the play session (WASD, jump, click UI, etc.). Clicks the canvas center ONCE per session to give it keyboard focus — later batches send only the actions you list, so no stray clicks fire your weapon or dismiss UI. This is also the ONLY way to click your game's UI (ui.j

spawn_play_reload

Reload the play tab (e.g. if a push didn't hot-apply to this client). Prefer waiting ~1s after spawn_push first — rooms usually reshape in place.

spawn_play_console

Return recent browser console / pageerror messages from the play session. Pair with spawn_logs for server-side script errors.

spawn_play_eval

Evaluate JavaScript in the play page's TOP frame (browser context — not the Spawn room api). Use it for page-level diagnostics: WebGPU support, network state, document title. It CANNOT see or click the game's UI: Spawn renders the UI in a cross-origin sandboxed iframe, so document.querySelector find

spawn_savi_status

How many sub-agents Savi is running right now, and what they are doing. Savi's fan-out is EIGHT lanes wide, and this is the only way to see how much of it is spoken for — no API endpoint reports it. Call it BEFORE spawn_savi to size a handoff, and after one to see whether it was picked up. Idle lane

spawn_play_close

Close the Playwright Chromium session.

spawn_play_status

Whether a play browser session is open, its URL, headed mode, recent error count, and a one-line read of Savi's fleet (spawn_savi_status has the detail).

spawn_team_init

Create the team ledger if it does not exist and register THIS worktree in it under a label. Run once per agent, from that agent's own worktree. The ledger lives in the shared .git, so every worktree of the repo finds it with no config. Each agent still needs its own bootstrap key and its own .env —

spawn_team_add

Stand up a new agent's worktree in one call: write its variant, trade its one-time bootstrap key for its own token, scaffold the project, and register it in the ledger. Call it once WITHOUT the worktree existing to get the exact `git worktree add` command to run (this server never executes git), the

spawn_team_brief

Emit a ready-to-paste opening prompt for a builder: who it is, its worktree, what it owns, what teammates own, whether it is behind head, and the working rules. Pass a label for one agent, or omit it for the whole team. Returns text for a human or an orchestrating model to hand to a session started

spawn_team_claim

Claim the parts of the game this agent owns, so teammates are warned before they edit them. Two shapes: a dotted game.json key path ('entities.player', 'world.terrain') or a script glob under scripts/ ('scripts/terrain/**', 'scripts/hud.js'). Claims are ADVISORY — they warn on push, they never block

spawn_team_release

Release this agent's claims when it is done with an area, so a teammate can take it over without a stale warning. Omit patterns to release everything this agent holds.

spawn_team_status

The whole team at a glance: every registered agent, how far behind head each one's local rail is, whose worktree has unresolved conflict receipts, and the current head vs published versions. Read-only and safe to call from any worktree. Use it before pushing to see whether a teammate has moved head

spawn_getting_started

START HERE before any other spawn tool. The whole workflow in one call: setup order, the art/UI skills to load BEFORE building anything visual, the push → screenshot → fix loop, and the multi-agent rules. Also reports what this project already has (token, variant, game.json, docs) so you know which

spawn_bootstrap

Trade a one-time setup bootstrap key (sbk_…) for a durable agent token. Writes SPAWN_AGENT_KEY to the project .env. The full token is NEVER returned — only a masked prefix. Bootstrap keys expire in ~5 minutes and work once.

spawn_me

Whoami — returns { userId, username } for the connected Spawn agent token.

spawn_list_games

List games this token can push to: { games: [{ appId, variantId, name, playUrl }] }. Ask the creator which one by name.

spawn_create_game

Create a new game in the creator's account. Optionally writes SPAWN_VARIANT_ID to .env. Creator should open the play URL and keep it open.

spawn_set_variant

Set SPAWN_VARIANT_ID in the project .env (join an existing game from spawn_list_games).

spawn_init

Scaffold a Spawn game project: gitignore secrets, world/ + scripts/, pull current spec → game.json, materialize scripts, fetch docs into .spawn/ (guide.md, tome-api.md, skills.json).

spawn_docs

Fetch engine guide, tome API reference, and skills index. Optionally save under .spawn/. For just the skill menu with descriptions, spawn_skills is cheaper.

spawn_skills

The menu of skill ids to pass to spawn_skill, each with what it covers. Browse it when planning a build so the spawn_skill call can carry every domain the work touches — mechanic and look together. Reads .spawn/skills.json when present (no network, no credentials) and falls back to the API. If you a

spawn_skill

Load the craft for what you are about to build — pass EVERY skill the work touches, not one. This is where the engine's real technique lives (how a HUD is actually built, how a material is written, how terrain is sculpted); the API reference only lists fields, so code written without the skills work

spawn_latest

Pull a saved spec: head (mode=dev, default), published live (mode=live), an exact version, or a published updateSlug. Head pulls sync scripts (untouched fast-forward; both-changed → <file>.theirs) and update the base-version rail — use after version_conflict. Non-head pulls are read-only unless appl

spawn_validate

Compile the project (game.json + world/*.json + scripts/**) and run authoritative server-side schema validation. Schema-valid is not the same as good: it says nothing about how the result looks or feels, which comes from the skills you loaded (spawn_skill) before writing the code.

spawn_push

Compile + push the project live (~1s in the creator's browser). Every push rebuilds the live room. On 409 version_conflict, call spawn_latest then merge .theirs receipts and push again. In team mode pushes are serialised and rebased onto head first, so a 409 is rare and a clean teammate push costs y

spawn_exec

Run a read-only JavaScript snippet against the live room (e.g. query objects, read an object's state). Pushing is the only write path. Needs a LIVE ROOM — rooms exist only while a player is connected, so open spawn_play_open first or you get a 5xx. `api.sql` is NOT available here at all (the endpoin

spawn_logs

Variant logs + live room script logs. Use when behavior doesn't match what you pushed.

spawn_rooms

Active rooms + player counts for the current variant.

spawn_savi

Write into the creator's studio chat, where Savi (their in-game AI companion) reads it. Two uses, and the second is the valuable one. (1) Context after a meaningful push, so you don't fight over the world. (2) HAND OFF WORK: pass `task` and Savi can take it on, fanning it out across its own sub-agen

spawn_revoke

Revoke the durable agent token (disconnect). Removes SPAWN_AGENT_KEY from project .env after success.

spawn_status

Local project status plus optional remote head/published versions: env (masked), base version, conflict receipts, docs present, headVersion vs publishedVersion when credentials allow.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configSPAWN_ASSET_BANKCross-project asset catalog directory
configSPAWN_HTTP_TIMEOUT_MSAbort API calls that hang
configSPAWN_PLAY_HEADED0 forces headless (see the warning below); games will not render
configSPAWN_PROJECT_DIRGame project holding game.json / .env
configSPAWN_TEAM1 enables team mode: adds spawn_team_ and the session latch
configSPAWN_TEAM_DIRLedger location, for agents that are not worktrees of one repo
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

41/41 tools missing one or more hints — spawn_asset_sync (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); spawn_asset_scan (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); spawn_asset_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +38 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — spawn_init (line 192: mkdirSync(p, { recursive: true }))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

16/41 tools referenced in tests (39%)

Write tests that reference each tool by name so every tool has at least one test.

Tool description accuracy

spawn_init: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/wfbcargo/wfbcargo_spawn_mcp?variant=verified)](https://m8ven.ai/mcp/wfbcargo/wfbcargo_spawn_mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 14f6c4f477d899342e7b3a88f8fadef35800c6d0
code hash: e5f30939ea066599f8f69dc03c4d1208bf9d3cd5a1cdb2b904b41059033f1e5b
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client