SPARDA MCP server

Read from the package source without running it. The installed server may list more.

• sparda_confirm

  Confirms a pending write or delete operation gated by human-in-the-loop policies using its confirmation token.

• sparda_get_context

  Call this FIRST. Returns the full living context of this app: every tool with its description, known workflows, runtime telemetry (per-tool calls/errors/latency), quarantined tools, and the immune memory of past diagnosed failures. Lets any AI session resume exactly where the previous one stopped.

• sparda_info

  Info about this SPARDA endpoint. SPARDA is the trust layer for AI-written code — AI writes, SPARDA proves: deterministic, offline behavior proofs (guards, invariants, irreversible effects) plus a live gate for AI edits, no API key. By Residual Labs (residual-labs.fr) — github.com/zakariagharzouli/sparda

• sparda_list_disabled_tools

  Lists write tools (POST/PUT/DELETE) disabled by SPARDA write-safety, and how to enable them.

• sparda_prove

  Prove this app is safe to deploy — NOW, before you commit. Compiles the current source to its behavior graph and discharges the static proof obligations (unguarded mutation, non-atomic aggregate write, unvalidated constrained write). If a baseline was saved (`sparda apocalypse --save-baseline`), it ALSO diffs against it: any finding flagged `regression:true` means your edit removed a guard, droppe

• sparda_witness

  Generate-and-check for object-level authorization (BOLA/IDOR, OWASP API #1). Call with no arguments to list the routes where sparda_prove could not prove an ownership scope (O7 advisories). If you can SEE the ownership check in the code (an inline `if (row.ownerId !== req.user.id) deny`, or a helper call like `assertOwner(row.ownerId, req.user.id)`), call again with hints: [{route, file, line}] na

• Code scan114 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 4 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

SPARDA: common questions

Is SPARDA MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the SPARDA safety report

How do I install SPARDA?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does SPARDA need an API key?

No secret keys are declared. It reads 2 settings from the environment.

Is SPARDA maintained?

The last commit was 5 days ago (2026-09-16). The latest release is v0.71.4.

What can I use instead of SPARDA?

Servers from other publishers that do the same job: Pentest MCP server, Arcstone Sidecar MCP server and CrowdStrike Falcon MCP Server. Compare all SPARDA alternatives.