Log inSubmit server
Sparda logo

Sparda

by zyx77550

Compiles backend behavior into a local graph for proof, regression gates, replay, and optional MCP access to running applications.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Sparda

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "zyx77550-sparda": {
      "command": "npx",
      "args": [
        "-y",
        "sparda-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y sparda-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 20d ago.

Overview

zyx77550/sparda MCP server turns a running Express, FastAPI, or Next.js application into a live MCP interface, with reads enabled by default and writes requiring human confirmation. Its broader CLI compiles routes, queries, guards, mutations, and side effects into a Unified Behavior Graph for deterministic proof and coverage checks. Use it when an agent needs application-specific tools or when CI must detect removed guards, broken invariants, and unsafe deploy changes. Everything runs locally without an API key or cloud account.

Use cases

  • Expose a running backend as MCP tools for an AI client
  • Block edits that remove guards from protected routes
  • Gate deployments on deterministic backend safety checks
  • Replay production requests as regression tests
  • Generate coverage, risk, and verification artifacts for review

Key features

  • Injects a reversible MCP router into supported applications
  • Compiles backend behavior into a Unified Behavior Graph
  • Gates runtime writes behind human confirmation
  • Detects guard-removal regressions with graph diffs
  • Runs locally without an API key or cloud account
  • Produces proof, coverage, SARIF, HTML, and badge outputs

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

18/19 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · sparda-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars8Stargazers on the source repository.
npm downloads941Package downloads in the last 30 days.
Last commit1mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Sparda works

What zyx77550/sparda MCP server does

zyx77550/sparda MCP server provides an optional runtime layer over an application's compiled behavior graph. After scanning an application, it can inject a marked /mcp router, then expose the running application's behavior to an MCP client. The runtime is designed for safe inspection first: write operations are gated by human confirmation.

The MCP runtime is only one part of the project. Its CLI also analyzes backend structure, including routes, database queries, state changes, guards, and side effects. Those elements become a language-independent Unified Behavior Graph (UBG), stored at .sparda/ubg.json under the SBIR format.

How it works

Run init from the application's directory to parse routes, generate the MCP router, create a backup, and write sparda.json. The modification is marked and reversible. Start the application, then run dev to start the bridge that serves the graph-backed tools.

The same graph supports commands such as prove, apocalypse, gate, heal, dossier, badge, timeless, and mirror. These commands inspect or execute the compiled representation rather than relying only on text diffs. For example, gate compares behavior graphs before and after an edit and can return exit code 2 when a previously protected route loses its guard.

Compilation is native for Express, FastAPI, Flask, Next.js, NestJS, and Medusa, with OpenAPI available for other stacks. The project describes compilation and safety proof as separate results: a route can compile successfully while the application remains unproven because coverage or premises are incomplete.

Setup and configuration

Install or run the package through npx. From the target application, use:

Terminal
npx sparda-mcp init
npx sparda-mcp dev

init prints a client configuration block containing the application name, an absolute working directory, and the sparda-mcp dev command. Claude Desktop can use that block, and Claude Code connects to the same bridge. No API key, cloud account, or separate hosted service is required.

Tools and capabilities

The zyx77550/sparda MCP server exposes the running application's graph as MCP tools. The available operations depend on what the scanner finds in that application. The broader command set can:

  • Prove behavior and coverage, with JSON or Markdown output.
  • Check deploy safety and produce SARIF suitable for CI.
  • Detect guard removal and other behavior regressions after edits.
  • Generate a self-contained HTML dossier or SVG README badge.
  • Record and replay production requests, then export a replay as a test.
  • Serve the compiled graph over HTTP through mirror.
  • Attempt fixes only when replay, verification, and safety checks continue to pass through heal.

Limitations and notes

The MCP runtime is optional; the prover and graph compiler are the core functions. A successful compilation does not establish that the complete application is safe. When analysis covers only part of an application, SPARDA reports partial proof, and when the analysis premise is not verified it does not claim a passing result.

The material documents Claude Desktop and Claude Code connection instructions. Other MCP clients may require their own configuration format. Runtime writes are not described as unrestricted: human confirmation is part of the write-safety model.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Sparda

zyx77550/sparda is an MCP server that connects to running Express, FastAPI, or Next.js applications through an injected router and graph bridge. Its main tools expose application behavior for agent use, while keeping reads open by default and requiring human confirmation for writes. It also supports local proof and regression checks.

Run `npx sparda-mcp init` from the application directory, then start the application and run `npx sparda-mcp dev`. The initialization command scans routes, injects the marked MCP router with a backup, writes `sparda.json`, and prints a client configuration block.

Use `sparda gate` to compare the behavior graph before and after an edit. It can identify a removed guard, such as a protected route becoming reachable without its guard, and `--hook` returns exit code 2 for the documented Claude Code PostToolUse workflow.

No. The documented compiler, prover, and MCP runtime run locally and do not require an API key or cloud account. The project describes its analysis as deterministic and offline, with incomplete coverage reported instead of being treated as a verified pass.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSparda AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/zyx77550-sparda?style=directory)](https://allmcps.com/mcp/zyx77550-sparda)
HTML Embed
<a href="https://allmcps.com/mcp/zyx77550-sparda"><img src="https://allmcps.com/api/badge/zyx77550-sparda?style=directory" alt="Sparda on AllMCPs" /></a>