Sparda

The trust layer for AI-written backends.SPARDA compiles your backend — routes, database queries, state mutations, guards, side-effects — into one deterministic behavior graph, thenstatically proves what can and can't break before you ship: no unguarded mutation, no broken invariant, no non-atomic aggregate write.

100% local · deterministic · zero API key · no cloud account. It fails loudly on a real risk, and when it can only see part of your app it saysPROVEN (PARTIAL)— never a false green. And when it can prove it was not even looking at your whole app, it saysPREMISE NOT VERIFIEDand claims nothing at all.

From your Express, FastAPI, Flask, Next.js, NestJS or Medusa app — nothing to configure:

npx sparda-mcp apocalypse # prove the tree is safe to deploy — exit 1 on any real risk, or on an unverified premise npx sparda-mcp prove # the whole verdict: proof + coverage + shareable seal npx sparda-mcp badge # a README badge: proven · coverage% · routes

The wedge — catch an AI edit that removes a guard, in the loop

The one thing a text-diff review and a pattern scanner structurally can't do: prove thatthis specific editdropped a protection the previous version had.sparda gatediffs the behavior graph before/after an edit and blocks a regression — deterministic, offline, sub-second, exit 2 (the Claude CodePostToolUsecontract that stops the agent's edit loop). See it end-to-end in one command, zero setup:

npm run wedge # (from a clone) — or drive it on your own app with sparda gate --arm then sparda gate --hook`

Every route becomes a tool that runs against your live process — real auth, real data, warm connections. One call tosparda_get_contexthands the AI the whole living picture: enabled tools, suggested workflows, runtime telemetry, quarantine state, and immune memory — so every session resumes where the last one stopped.

The AI just edited a route. Did it quietly drop a guard? It callssparda_proveand finds outnow, not in a CI run later. The tool recompiles the app to its behavior graph, discharges the same static obligations assparda apocalypse, and returns a deterministic verdict — the exact word the CLI and badge emit, so it can never over-claim (a low-coverage clean app readsSURFACE, never a barePROVEN). Save a baseline once (sparda apocalypse --save-baseline) and every latersparda_proveflags any finding withregression: true— the guard your edit removed, the route it dropped, the blast radius it grew. That's"AI writes. SPARDA proves."inside the edit loop. Clients that list MCP prompts also get theprove-my-editworkflow.

- Writes (POST/PUT/DELETE) shipdisabled. Enable them per tool insparda.json; your choice survives every re-init.
- An enabled write isnever executed on the first call. SPARDA returns anawaiting_confirmationenvelope — a single-use token plus a preview of the action — and commits only after an explicit confirm step.
- When your client supports MCP elicitation, that confirmation prompt appearsin the AI's own UI.
- Proof-after-write: every successful write is followed by a read-back of the same resource, so the AI — and you — see the real effect, not a hopeful guess.

- Quarantine.A tool that returns 3 consecutive 5xx is quarantined: further calls get a503with a reason and a retry delay instead of hammering your broken route. After a cooldown it half-opens for a single probe.
- Latency & anomaly flags.The router learns each route's baseline and flags deviations locally, in a few lines of math.
- Adaptive diagnosis, only on surprise.A genuinely new failure wakes your AI client's own model to diagnose it once; the diagnosis is cached as an "antibody" insparda.json, so the same failure later costs zero tokens. Cloning your code doesn't clone its immune memory.

On first connection your AI client's own model (via MCP sampling) rewrites raw routes into business-language tool descriptions and proposes multi-step workflows — cached insparda.jsonand exposed as MCP prompts. Nothing to configure, nothing to pay.

- Response recycling.When a read keeps returning the same answer, SPARDA serves the next identical call straight from memory — without touching your host app. Reads only; writes always hit the host.
- A recycling gauge.GET /mcp/statscounts how many calls were answered from SPARDA's own knowledge vs. how many paid the host route. It reads 0% on day one and fills with usage — a measure, never a promise.

Turn it on with"labs": { "recordSequences": true }insparda.json. SPARDA then notices when one tool's output feeds the next tool's input and records thecircuit— structure only (tool names, argument names, counts), never your data. A read-only circuit seen enough timescrystallizes into a composite tool, announced mid-session: one call runs the whole chain, auto-feeding each step from the previous step's real response. Write routes are never absorbed — their per-call confirmation always stands.

GET /mcp/stats(per-tool calls/errors, tool "purity", quarantine state) andGET /mcp/events(errors, latency anomalies, cached diagnoses) expose exactly what your app is doing — surfaced to the AI as live notifications.

- Next.js App Router (13/14/15)— file-based injection. SPARDA creates a catch-all route handler. It natively resolves wrapped handlers (export const POST = withAuth(h)) and deep effect chains.
- NestJS— AST-based router injection. Deeply resolves Multi-hop Dependency Injection (Controller → Service → Repository), inherited DI, andbaseUrl/pathsimports. Fully supports composite decorators (applyDecorators). Resolves ORM writes: Prisma, Kysely, and TypeORM injected repositories (@InjectRepository(Entity)→this.repo.save()).
- Strapi— Native AST ingestion of Strapi content-types, core controllers, and custom routes.
- Express 4/5(JS/TS, ESM/CJS) — AST-based router injection. Deeply resolves external controllers, Mongoose schemas, barrel re-exports, and inline handlers. Uses dynamic tree-scanning to find non-standard entry points (bootstrap.ts, etc).
- MedusaJS— Native AST ingestion of complex e-commerce routing.
- Any Backend On Earth (Go, Java, Rails, Laravel)— Compiles flawlessly from OpenAPI 3.x specs.
- FastAPI(Python >= 3.9) — AST-based router injection.

- Databases— Prisma (incl. named/multiline relations and interactive$transaction(tx ⇒ …)), TypeORM, Kysely, Drizzle, Knex, Sequelize, Mongoose, and raw SQL. Foreign keys become aggregate/consistency domains, so a multi-table write outside a transaction is caught.
- External side-effects— recognized by call shape and by import origin, so an irreversible outbound effect next to a DB write is proven compensable-or-not:fetch/axios/got, Stripe, Twilio, SendGrid/Resend/nodemailer, AWS SDK v3 (send(new PutObjectCommand())), and other payment/mail/cloud/queue clients. A read on such a client stays a non-observable GET — no false alarms.