If you open up the "DigitalPointSpy/ControllerPublic/Spy.php" file and change this:
PHP:
public function actionIndex()
{
return $this->responseView('DigitalPointSpy_ViewPublic_Spy_Index', 'spy_index', array());
}
to this:
PHP:
public function actionIndex()
{
$visitor = XenForo_Visitor::getInstance();
if (!$visitor->get('is_admin') && !$visitor->get('is_moderator'))
{
return $this->responseNoPermission();
}
return $this->responseView('DigitalPointSpy_ViewPublic_Spy_Index', 'spy_index', array());
}
That should do it.
It doesn't prevent the link from showing in the member tab, but you could do the same sort of thing to get it to not show to non-mods/admins.