Spider Claude Plugin
The Spider Claude Plugin gives Claude Code the ability to autonomously query Spider-captured network traffic data. It wraps the Spider CLI with purpose-built skills and agents for common investigation workflows.
Prerequisites
The Spider CLI must be installed and a profile configured.
Install
Claude Code plugins come from marketplaces. The plugin repo is its own marketplace — add it first, then install the spider plugin from it:
# Inside Claude Code
/plugin marketplace add https://gitlab.com/spider-analyzer/tools/spider-claude-plugin.git
/plugin install spider@spider-analyzer
info
The org/repo shorthand only works for GitHub. For GitLab, pass the full HTTPS (or SSH) git URL.
Skills
| Skill | When to use |
|---|---|
troubleshoot | Diagnosing errors, auth failures, unexpected behaviour |
verify-test | Checking that expected traffic was captured after a test or deployment |
performance | Investigating slow requests, latency percentiles, bottleneck identification |
security | Detecting anomalous access patterns, high-frequency callers, scanning |
discover | Mapping service interactions, finding unknown callers/callees |
spider-models | Reference for writing --aggs ES DSL and --query Lucene strings |
Agents
| Agent | What it does |
|---|---|
spider-investigator | Given a symptom + target, autonomously diagnoses and returns a structured report with evidence link |
spider-performance | Given a service + time window, returns a full performance report with slow-call patterns |
What the plugin teaches Claude
On top of skill and agent registration, the plugin's CLAUDE.md primes Claude with:
- The Spider data model (HTTP comms, PSQL comms, TCP sessions, packets) and how they are scoped to whisperers
- Profile management (
spider add profile,spider list/show/use/delete profiles) - The full verb-first CLI command tree —
search,get,stats,outliers,aggs,show,attach,add link - How to generate private vs public shareable links (endpoints,
accessFilters, expiry, OTP) - The capture-attach discovery workflow:
show namespaces→show collection→attach - Client-side body decompression for
spider get http <id> req|res body