# zyx77550/sparda [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/zyx77550/sparda  
**GitHub Stars:** 8  
**npm Downloads (last month):** 941  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/zyx77550-sparda

## Description
Injects a live, reversible MCP server into a running Express / FastAPI / Next.js app — reads safe by default, writes gated behind human confirmation. The same engine also proves deploys and PRs (apocalypse / review).

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "sparda": {
    "command": "npx",
    "args": ["-y","sparda-mcp"]
  }
}
```

## Documentation

## What zyx77550/sparda MCP server does

zyx77550/sparda MCP server provides an optional runtime layer over an application's compiled behavior graph. After scanning an application, it can inject a marked `/mcp` router, then expose the running application's behavior to an MCP client. The runtime is designed for safe inspection first: write operations are gated by human confirmation.

The MCP runtime is only one part of the project. Its CLI also analyzes backend structure, including routes, database queries, state changes, guards, and side effects. Those elements become a language-independent Unified Behavior Graph (UBG), stored at `.sparda/ubg.json` under the SBIR format.

## How it works

Run `init` from the application's directory to parse routes, generate the MCP router, create a backup, and write `sparda.json`. The modification is marked and reversible. Start the application, then run `dev` to start the bridge that serves the graph-backed tools.

The same graph supports commands such as `prove`, `apocalypse`, `gate`, `heal`, `dossier`, `badge`, `timeless`, and `mirror`. These commands inspect or execute the compiled representation rather than relying only on text diffs. For example, `gate` compares behavior graphs before and after an edit and can return exit code 2 when a previously protected route loses its guard.

Compilation is native for Express, FastAPI, Flask, Next.js, NestJS, and Medusa, with OpenAPI available for other stacks. The project describes compilation and safety proof as separate results: a route can compile successfully while the application remains unproven because coverage or premises are incomplete.

## Setup and configuration

Install or run the package through `npx`. From the target application, use:

```bash
npx sparda-mcp init
npx sparda-mcp dev
```

`init` prints a client configuration block containing the application name, an absolute working directory, and the `sparda-mcp dev` command. Claude Desktop can use that block, and Claude Code connects to the same bridge. No API key, cloud account, or separate hosted service is required.

## Tools and capabilities

The zyx77550/sparda MCP server exposes the running application's graph as MCP tools. The available operations depend on what the scanner finds in that application. The broader command set can:

- Prove behavior and coverage, with JSON or Markdown output.
- Check deploy safety and produce SARIF suitable for CI.
- Detect guard removal and other behavior regressions after edits.
- Generate a self-contained HTML dossier or SVG README badge.
- Record and replay production requests, then export a replay as a test.
- Serve the compiled graph over HTTP through `mirror`.
- Attempt fixes only when replay, verification, and safety checks continue to pass through `heal`.

## Limitations and notes

The MCP runtime is optional; the prover and graph compiler are the core functions. A successful compilation does not establish that the complete application is safe. When analysis covers only part of an application, SPARDA reports partial proof, and when the analysis premise is not verified it does not claim a passing result.

The material documents Claude Desktop and Claude Code connection instructions. Other MCP clients may require their own configuration format. Runtime writes are not described as unrestricted: human confirmation is part of the write-safety model.

_Full upstream README: https://allmcps.com/mcp/zyx77550-sparda/readme_