# SPARDA [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/zakariagharzouli/sparda  
**GitHub Stars:** 8  
**npm Downloads (last month):** 795  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/sparda

## Description
AI writes. SPARDA proves. Deterministic, offline security gate for AI edits.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "sparda": {
    "command": "npx",
    "args": ["-y","sparda-mcp"]
  }
}
```

## Documentation

## What SPARDA MCP server does

SPARDA MCP server is the optional runtime layer of SPARDA's backend analysis system. SPARDA first compiles an application into a Unified Behavior Graph (UBG), stored as `.sparda/ubg.json` under the SBIR specification. The graph represents routes, database queries, state changes, guards, and side effects in a language-agnostic form.

The wider CLI can then inspect that graph before deployment. `prove` produces a combined proof and coverage verdict, `apocalypse` acts as a deployment gate, and `gate` compares the graph before and after an edit. A removed guard can therefore be detected as a behavior regression rather than only as a text diff. `heal` can accept a fix only when replay, verification, and safety checks continue to pass.

The optional MCP mode exposes a running application to AI clients through a generated bridge. It is separate from the core proving workflow: the graph compiler and verification commands do not require an MCP client.

## How it works

Run `init` from the application directory to scan routes, generate a marked `/mcp` router, inject it into the application, create `sparda.json`, and save a backup. The generated changes are reversible. After the application is running, `dev` starts the bridge and serves the graph as MCP tools for a connected client.

For safety checks, SPARDA parses supported backend structures and compiles them into the UBG. Native compilation is documented for Express, FastAPI, Flask, Next.js, NestJS, and Medusa; OpenAPI can be used for other stacks. Each command operates on the compiled graph rather than relying only on source-text patterns.

`gate --arm` records a baseline, while `gate --hook` checks a later edit and returns exit code 2 when the hook detects a regression. Results can also be emitted as JSON, Markdown, SARIF, an HTML dossier, or an SVG badge, depending on the command.

## Setup and configuration

The primary commands run through `npx sparda-mcp`, including `prove`, `apocalypse`, `gate`, `init`, and `dev`. The repository requires Node.js 18 or newer. The documented workflow does not require an API key, cloud account, or external service.

For the MCP runtime, run `npx sparda-mcp init` in the app directory, start the application, then run `npx sparda-mcp dev`. `init` prints a client configuration block using the application path as the working directory. The README specifically documents configuration for Claude Desktop and says Claude Code connects to the same bridge.

## Tools and capabilities

- Compile supported backends into a UBG.
- Prove coverage, premises, guards, invariants, transactions, and aggregate boundaries.
- Compare baseline and edited behavior graphs with `gate`.
- Replay recorded production requests with `timeless` and export bugs as tests.
- Serve the compiled graph over HTTP with `mirror`.
- Generate badges, reports, JSON, Markdown, and SARIF output.

## Limitations and notes

SPARDA reports `PROVEN (PARTIAL)` when it can inspect only part of an application, and reports `PREMISE NOT VERIFIED` when it cannot establish that the whole application was examined.

The MCP bridge is optional and requires a running application after initialization. The system is local and deterministic, but its conclusions depend on the code and application behavior available to the compiler and graph.

_Full upstream README: https://allmcps.com/mcp/sparda/readme_