spawn-mcp (wfbcargo/wfbcargo_spawn_mcp) is an MCP server listed on the M8ven Trust Index. It scores 73 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.
Local MCP server for the Spawn Games agent API, enabling LLMs to manage game projects, push updates, and interact with live games via a Playwright Chromium client.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
wfbcargo
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
spawn_asset_syncSync the asset bank with your Spawn ACCOUNT: list every game you own, fetch each one's current server-side spec, and harvest the cdn/ assets it actually uses. This is the authoritative fill — it covers games you have no local checkout of, and assets a teammate or Savi added that never landed on your…
spawn_asset_scanHarvest every cdn/ asset path used in a project (or any directory) into the local cross-project asset bank, recording which files and which game use it. Spawn generates an asset on first fetch of its path and keeps it there forever, so the same path in another game is the same asset — but there is n…
spawn_asset_searchSearch the local asset bank for assets you (or your other projects) have already used. Call this BEFORE inventing a new cdn/ asset name: a path that already produced good art is reusable across games verbatim, and a path marked bad tells you what not to spell. Every result reports how many distinct …
spawn_asset_noteName, categorize, describe or judge an asset in the bank — including a path that has not been scanned or even used yet. A name is a short handle you can use in place of the path in every other asset tool. This is the memory the platform does not keep: a Spawn asset is generated once from its path an…
spawn_asset_previewCheck whether an asset actually exists on Spawn's CDN, and LOOK AT IT if it is an image (returned inline, so you can judge it rather than guess from the filename). Use it on an unfamiliar path before building around it, and after generating a new one to see what the name produced. Safe to call: it q…
spawn_audit_scanList a game's exported functions and say which can be audited locally. Engine-coupled functions take objectApi as a parameter (the engine injects it, never imports it), so the signature alone decides: no api parameter and no engine-only require means the function is pure and runnable in plain Node. …
spawn_audit_mathRun declared numeric invariants over the game's pure functions, locally: no browser, no live room, no push, no credentials. Sweeps each function across its declared input domain and reports the exact arguments that broke a rule. Catches what playing the game catches slowly and unreliably — NaN and I…
spawn_play_openOpen the live Spawn play URL in a local Chromium (Playwright). Headed by default so you can watch. Use this as the agent's eyes/hands on the game — Spawn is WebGPU/canvas, so screenshot + input beat accessibility trees. Resolves play URL from the variant if omitted. Keep it HEADED: headless Chromium…
spawn_play_screenshotScreenshot the open play session. Primary visual check after spawn_push — look at the image before calling the change done. Judge it as a player would: if it reads as grey boxes, flat untextured shapes, or default browser UI, that is a missing skill rather than a missing feature — load the relevant …
spawn_play_inputSend keyboard/mouse actions to the play session (WASD, jump, click UI, etc.). Clicks the canvas center ONCE per session to give it keyboard focus — later batches send only the actions you list, so no stray clicks fire your weapon or dismiss UI. This is also the ONLY way to click your game's UI (ui.j…
spawn_play_reloadReload the play tab (e.g. if a push didn't hot-apply to this client). Prefer waiting ~1s after spawn_push first — rooms usually reshape in place.
spawn_play_consoleReturn recent browser console / pageerror messages from the play session. Pair with spawn_logs for server-side script errors.
spawn_play_evalEvaluate JavaScript in the play page's TOP frame (browser context — not the Spawn room api). Use it for page-level diagnostics: WebGPU support, network state, document title. It CANNOT see or click the game's UI: Spawn renders the UI in a cross-origin sandboxed iframe, so document.querySelector find…
spawn_savi_statusHow many sub-agents Savi is running right now, and what they are doing. Savi's fan-out is EIGHT lanes wide, and this is the only way to see how much of it is spoken for — no API endpoint reports it. Call it BEFORE spawn_savi to size a handoff, and after one to see whether it was picked up. Idle lane…
spawn_play_closeClose the Playwright Chromium session.
spawn_play_statusWhether a play browser session is open, its URL, headed mode, recent error count, and a one-line read of Savi's fleet (spawn_savi_status has the detail).
spawn_team_initCreate the team ledger if it does not exist and register THIS worktree in it under a label. Run once per agent, from that agent's own worktree. The ledger lives in the shared .git, so every worktree of the repo finds it with no config. Each agent still needs its own bootstrap key and its own .env — …
spawn_team_addStand up a new agent's worktree in one call: write its variant, trade its one-time bootstrap key for its own token, scaffold the project, and register it in the ledger. Call it once WITHOUT the worktree existing to get the exact `git worktree add` command to run (this server never executes git), the…
spawn_team_briefEmit a ready-to-paste opening prompt for a builder: who it is, its worktree, what it owns, what teammates own, whether it is behind head, and the working rules. Pass a label for one agent, or omit it for the whole team. Returns text for a human or an orchestrating model to hand to a session started …
spawn_team_claimClaim the parts of the game this agent owns, so teammates are warned before they edit them. Two shapes: a dotted game.json key path ('entities.player', 'world.terrain') or a script glob under scripts/ ('scripts/terrain/**', 'scripts/hud.js'). Claims are ADVISORY — they warn on push, they never block…
spawn_team_releaseRelease this agent's claims when it is done with an area, so a teammate can take it over without a stale warning. Omit patterns to release everything this agent holds.
spawn_team_statusThe whole team at a glance: every registered agent, how far behind head each one's local rail is, whose worktree has unresolved conflict receipts, and the current head vs published versions. Read-only and safe to call from any worktree. Use it before pushing to see whether a teammate has moved head …
spawn_getting_startedSTART HERE before any other spawn tool. The whole workflow in one call: setup order, the art/UI skills to load BEFORE building anything visual, the push → screenshot → fix loop, and the multi-agent rules. Also reports what this project already has (token, variant, game.json, docs) so you know which …
spawn_bootstrapTrade a one-time setup bootstrap key (sbk_…) for a durable agent token. Writes SPAWN_AGENT_KEY to the project .env. The full token is NEVER returned — only a masked prefix. Bootstrap keys expire in ~5 minutes and work once.
spawn_meWhoami — returns { userId, username } for the connected Spawn agent token.
spawn_list_gamesList games this token can push to: { games: [{ appId, variantId, name, playUrl }] }. Ask the creator which one by name.
spawn_create_gameCreate a new game in the creator's account. Optionally writes SPAWN_VARIANT_ID to .env. Creator should open the play URL and keep it open.
spawn_set_variantSet SPAWN_VARIANT_ID in the project .env (join an existing game from spawn_list_games).
spawn_initScaffold a Spawn game project: gitignore secrets, world/ + scripts/, pull current spec → game.json, materialize scripts, fetch docs into .spawn/ (guide.md, tome-api.md, skills.json).
spawn_docsFetch engine guide, tome API reference, and skills index. Optionally save under .spawn/. For just the skill menu with descriptions, spawn_skills is cheaper.
spawn_skillsThe menu of skill ids to pass to spawn_skill, each with what it covers. Browse it when planning a build so the spawn_skill call can carry every domain the work touches — mechanic and look together. Reads .spawn/skills.json when present (no network, no credentials) and falls back to the API. If you a…
spawn_skillLoad the craft for what you are about to build — pass EVERY skill the work touches, not one. This is where the engine's real technique lives (how a HUD is actually built, how a material is written, how terrain is sculpted); the API reference only lists fields, so code written without the skills work…
spawn_latestPull a saved spec: head (mode=dev, default), published live (mode=live), an exact version, or a published updateSlug. Head pulls sync scripts (untouched fast-forward; both-changed → <file>.theirs) and update the base-version rail — use after version_conflict. Non-head pulls are read-only unless appl…
spawn_validateCompile the project (game.json + world/*.json + scripts/**) and run authoritative server-side schema validation. Schema-valid is not the same as good: it says nothing about how the result looks or feels, which comes from the skills you loaded (spawn_skill) before writing the code.
spawn_pushCompile + push the project live (~1s in the creator's browser). Every push rebuilds the live room. On 409 version_conflict, call spawn_latest then merge .theirs receipts and push again. In team mode pushes are serialised and rebased onto head first, so a 409 is rare and a clean teammate push costs y…
spawn_execRun a read-only JavaScript snippet against the live room (e.g. query objects, read an object's state). Pushing is the only write path. Needs a LIVE ROOM — rooms exist only while a player is connected, so open spawn_play_open first or you get a 5xx. `api.sql` is NOT available here at all (the endpoin…
spawn_logsVariant logs + live room script logs. Use when behavior doesn't match what you pushed.
spawn_roomsActive rooms + player counts for the current variant.
spawn_saviWrite into the creator's studio chat, where Savi (their in-game AI companion) reads it. Two uses, and the second is the valuable one. (1) Context after a meaningful push, so you don't fight over the world. (2) HAND OFF WORK: pass `task` and Savi can take it on, fanning it out across its own sub-agen…
spawn_revokeRevoke the durable agent token (disconnect). Removes SPAWN_AGENT_KEY from project .env after success.
spawn_statusLocal project status plus optional remote head/published versions: env (masked), base version, conflict receipts, docs present, headVersion vs publishedVersion when credentials allow.
SPAWN_ASSET_BANKCross-project asset catalog directorySPAWN_HTTP_TIMEOUT_MSAbort API calls that hangSPAWN_PLAY_HEADED0 forces headless (see the warning below); games will not renderSPAWN_PROJECT_DIRGame project holding game.json / .envSPAWN_TEAM1 enables team mode: adds spawn_team_ and the session latchSPAWN_TEAM_DIRLedger location, for agents that are not worktrees of one repoTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
41/41 tools missing one or more hints — spawn_asset_sync (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); spawn_asset_scan (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); spawn_asset_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +38 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — spawn_init (line 192: mkdirSync(p, { recursive: true }))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool test coverage
16/41 tools referenced in tests (39%)
Write tests that reference each tool by name so every tool has at least one test.
Tool description accuracy
spawn_init: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/wfbcargo/wfbcargo_spawn_mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check