MCP Observatory
44s ago Tracked 40,724 Last 44s ago 24h 2,033
github JavaScript analyzed · update queued cd266c3 (3 behind)

zyx77550/sparda

github

AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.

maintainer
zyx77550
license
NOASSERTION
first seen
2026-07-25
last seen
2026-07-30
releases · 30d
6
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit cd266c3 · analyzer v30 · 5d ago

skills & prompt files 4

danger signals1

code evidence vv0.68.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 540

filesystem 114

  • fs zyx77550-sparda-cd266c3/.github/sparda-pr-comment.mjs :14 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/check-readme.mjs :6 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/cve-replay.mjs :17 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/flywheel-bench.mjs :19 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/guard-removal-replay.mjs :14 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/repro.mjs :14 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/scale-gen.mjs :5 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/bench/wedge.mjs :14 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/docs/csop-handoff/adapter/sparda-to-csop.mjs :3 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/extensions/vscode/src/extension.cjs :17 const fs = require('node:fs');
  • fs (weak) zyx77550-sparda-cd266c3/integrations/claude-code/demo.mjs :15 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/integrations/claude-code/sparda-prove.mjs :14 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/scripts/corpus-oracle.mjs :37 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/scripts/release-gate.mjs :31 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/apocalypse.js :9 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/badge.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/claude-hook.js :11 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/src/commands/demo.js :8 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/doctor.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/dossier.js :8 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/enforce.js :28 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/evolve.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/gate.js :29 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/genome.js :10 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/grammar.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/heal.js :9 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/hook.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/immunize.js :8 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/init.js :3 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/mirror.js :8 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/negentropy.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/openapi.js :10 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/remove.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/report.js :6 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/review.js :15 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/seed.js :13 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/speculate.js :9 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/sync.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/timeless.js :9 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/commands/twin.js :12 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/detect.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/flight/format.js :8 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/generator/express.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/generator/fastapi.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/generator/manifest.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/generator/nextjs.js :6 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/index.js :3 import { readFileSync } from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/parser/express.js :2 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/parser/nextjs.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/server/condenser.js :6 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/server/persistence.js :21 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/server/stdio.js :3 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/express.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/extract.js :9 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/medusa.js :18 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/nestjs.js :14 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/nextjs.js :6 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/openapi.js :12 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/oracle-static.js :30 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/prisma.js :10 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/serialize.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/sql.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/strapi.js :27 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/verify.js :7 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/src/ubg/witness.js :23 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/badge.test.js :6 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/command-smoke.test.js :8 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/corpus-snapshot.test.js :8 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/cross-framework-verbs.test.js :14 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/demo.test.js :2 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/dossier.test.js :7 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/e2e/harness.mjs :9 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/e2e/phase1.mjs :2 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/enforce.test.js :13 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/flight.test.js :7 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/gossip.test.js :11 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/heal.test.js :6 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/helpers/copy-fixture.js :22 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/mutation/run.mjs :11 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/negentropy.test.js :5 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/nest-custom-resolver.test.js :21 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/nextjs.test.js :7 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/no-mutant-left-behind.test.js :36 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/no-silent-loss-fleet.test.js :23 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/no-silent-loss.test.js :18 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/packaging.test.js :10 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/param-auth-decorator.test.js :13 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/persistence.test.js :7 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/pr-comment-e2e.test.js :9 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/premise-convention.test.js :19 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/premise-wired-everywhere.test.js :22 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/probe.test.js :23 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/release-gate.test.js :17 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/release-sync.test.js :10 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/report.test.js :5 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/review.test.js :5 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/round3.test.js :6 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/router-selftest.cjs :3 const fs = require('fs');
  • fs (weak) zyx77550-sparda-cd266c3/tests/sdk-effect.test.js :8 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/seed.test.js :6 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/sparda-prove-mcp.test.js :7 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/sparda.test.js :2 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/typeorm.test.js :9 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/ubg.test.js :4 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/unmeasured-is-not-a-pass.test.js :47 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/vscode-extension.test.js :15 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/witness.test.js :10 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tests/zero-day-effects.test.js :13 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tools/corpus/run.mjs :12 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/tools/fuzzer/cleanup.mjs :1 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/tools/fuzzer/ollama-fuzzer.mjs :1 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/tools/publish/execute-sync.mjs :1 import fs from 'node:fs';
  • fs (weak) zyx77550-sparda-cd266c3/tools/publish/publish-gate.test.js :12 import fs from 'node:fs';
  • fs zyx77550-sparda-cd266c3/tools/publish/publish-public.mjs :16 import fs from 'node:fs';

shell / exec 39

  • shell zyx77550-sparda-cd266c3/bench/cve-replay.mjs :20 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/bench/flywheel-bench.mjs :23 import { spawn } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/bench/guard-removal-replay.mjs :17 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/bench/repro.mjs :17 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/bench/wedge.mjs :18 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/extensions/vscode/src/extension.cjs :16 const cp = require('node:child_process');
  • shell (weak) zyx77550-sparda-cd266c3/integrations/claude-code/demo.mjs :14 import { execFileSync, spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/integrations/claude-code/sparda-prove.mjs :13 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/scripts/corpus-oracle.mjs :39 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/scripts/release-gate.mjs :33 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/commands/heal.js :11 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/commands/review.js :18 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/commands/twin.js :89 if (new RegExp(`^${pattern}$`).test(pathname)) return { name, tool: t };
  • shell zyx77550-sparda-cd266c3/src/detect.js :4 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/flight/heal.js :139 if (new RegExp(`^${escaped}/?$`).test(url)) return n;
  • shell zyx77550-sparda-cd266c3/src/generator/fastapi.js :5 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/parser/fastapi.js :2 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/probe/express-shim.cjs :20 * SPARDA_IPC_PORT for spawn() callers.
  • shell zyx77550-sparda-cd266c3/src/probe/probe.js :14 import { fork, spawn } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/server/confirmation.js :15 // node:child_process only. value-free: the dialog shows method+path+token-prefix, never an
  • shell zyx77550-sparda-cd266c3/src/ubg/fastapi.js :7 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/src/ubg/mirror.js :253 return new RegExp(`^${escaped}/?$`);
  • shell (weak) zyx77550-sparda-cd266c3/tests/command-smoke.test.js :298 import { spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/e2e/harness.mjs :8 import { spawn } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/genome.test.js :42 expect(a.id).toMatch(new RegExp(`^${ANTIBODY_VERSION}_[0-9a-f]{32}$`));
  • shell (weak) zyx77550-sparda-cd266c3/tests/gossip.test.js :16 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/mutation/run.mjs :13 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/pr-comment-e2e.test.js :12 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/premise-convention.test.js :21 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/registration-invariant-fleet.test.js :26 import { spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/review.test.js :8 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/sparda.test.js :5 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/ubg.test.js :7 import { spawnSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tests/wedge.test.js :9 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tools/corpus/run.mjs :14 import { spawnSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/tools/fuzzer/ollama-fuzzer.mjs :4 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/tools/publish/execute-sync.mjs :4 import { execFileSync } from 'node:child_process';
  • shell (weak) zyx77550-sparda-cd266c3/tools/publish/publish-gate.test.js :15 import { execFileSync } from 'node:child_process';
  • shell zyx77550-sparda-cd266c3/tools/publish/publish-public.mjs :19 import { execFileSync } from 'node:child_process';

network 32

  • net zyx77550-sparda-cd266c3/.github/sparda-pr-comment.mjs :35 const res = await fetch(`${cfg.apiUrl}${url}`, {
  • net zyx77550-sparda-cd266c3/bench/flywheel-bench.mjs :22 import net from 'node:net';
  • net (weak) zyx77550-sparda-cd266c3/scripts/release-gate.mjs :109 const res = await fetch(registryUrlFor(pkg.name, version), { method: 'HEAD' });
  • net zyx77550-sparda-cd266c3/src/commands/doctor.js :62 const r = await fetch(`http://127.0.0.1:${m.port}/mcp/tools`, {
  • net zyx77550-sparda-cd266c3/src/commands/evolve.js :39 const res = await fetch(`http://127.0.0.1:${port}/mcp/invoke`, {
  • net zyx77550-sparda-cd266c3/src/commands/report.js :348 live = await fetch(`http://127.0.0.1:${manifest.port}/mcp/stats`, {
  • net zyx77550-sparda-cd266c3/src/commands/timeless.js :11 import http from 'node:http';
  • net zyx77550-sparda-cd266c3/src/commands/twin.js :14 import http from 'node:http';
  • net zyx77550-sparda-cd266c3/src/flight/box.js :32 // Node 18: fetch (undici) and crypto.randomUUID call Date.now()/Math.random()
  • net zyx77550-sparda-cd266c3/src/flight/replayer.js :9 import http from 'node:http';
  • net zyx77550-sparda-cd266c3/src/probe/express-shim.cjs :34 const net = require('net');
  • net zyx77550-sparda-cd266c3/src/server/stdio.js :140 await fetch(`${base}/mcp/tools`, { headers: hostHeaders(key, ctx) })
  • net zyx77550-sparda-cd266c3/src/ubg/extract.js :2653 // fetch(url, { method: 'POST' }) — literal method option or nothing (SBIR §2.4)
  • net zyx77550-sparda-cd266c3/src/ubg/mirror.js :20 import http from 'node:http';
  • net (weak) zyx77550-sparda-cd266c3/tests/badge.test.js :49 // zero-infra ethos: no external RESOURCE fetch (the xmlns namespace URI is not a fetch —
  • net (weak) zyx77550-sparda-cd266c3/tests/e2e/harness.mjs :66 const r = await fetch(`http://127.0.0.1:${this.port}/health`, { signal: AbortSignal.timeout(800) });
  • net (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-blindspots/src/index.js :3 import axios from 'axios';
  • net (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-express/src/app.js :45 await fetch('https://hooks.example.com/user-created', { method: 'POST' });
  • net (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-immune-observable/src/app.js :7 import axios from 'axios';
  • net (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-irreversible-fanout/src/messaging.controller.ts :29 await fetch('https://example.test/a');
  • net (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-semantics/src/app.js :47 await fetch('https://api.stripe.example/charge', { method: 'POST' });
  • net (weak) zyx77550-sparda-cd266c3/tests/flight.test.js :10 import http from 'node:http';
  • net (weak) zyx77550-sparda-cd266c3/tests/gossip.test.js :13 import net from 'node:net';
  • net (weak) zyx77550-sparda-cd266c3/tests/heal.test.js :16 import http from 'node:http';
  • net (weak) zyx77550-sparda-cd266c3/tests/immune-observable.test.js :2 // to hard-flag EVERY observable external call on a mutating route — including a generic fetch (a
  • net (weak) zyx77550-sparda-cd266c3/tests/mirror-stateful.test.js :29 const res = await fetch(base + p, { method });
  • net (weak) zyx77550-sparda-cd266c3/tests/mutation/run.mjs :246 desc: 'apocalypse: hard-flag every observable incl. a generic fetch (autoimmunity → the O4 wolf-cry returns, ADR-072)',
  • net (weak) zyx77550-sparda-cd266c3/tests/pr-comment-e2e.test.js :8 import http from 'node:http';
  • net (weak) zyx77550-sparda-cd266c3/tests/round3.test.js :94 const users = await fetch(`${base}/api/users`).then((r) => r.json());
  • net (weak) zyx77550-sparda-cd266c3/tests/router-selftest.cjs :83 const r = await fetch(`${B}/invoke`, {
  • net (weak) zyx77550-sparda-cd266c3/tests/sparda.test.js :6 import http from 'node:http';
  • net zyx77550-sparda-cd266c3/tools/fuzzer/ollama-fuzzer.mjs :46 const res = await fetch(OLLAMA_URL, {

secrets 6

  • secrets zyx77550-sparda-cd266c3/.github/sparda-pr-comment.mjs :94 token: process.env.GITHUB_TOKEN,
  • secrets zyx77550-sparda-cd266c3/src/generator/manifest.js :7 if (process.env.SPARDA_LOCAL_KEY) {
  • secrets (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-sdk-provenance/src/app.js :11 const stripe = Stripe(process.env.KEY); // factory idiom → labeled by provenance
  • secrets (weak) zyx77550-sparda-cd266c3/tests/nextjs.test.js :176 process.env.SPARDA_LOCAL_KEY = manifest.localKey;
  • secrets (weak) zyx77550-sparda-cd266c3/tests/router-selftest.cjs :10 process.env.SPARDA_LOCAL_KEY = 'testkey';
  • secrets (weak) zyx77550-sparda-cd266c3/tests/sparda.test.js :1065 process.env.SPARDA_LOCAL_KEY = key;

database 20

  • db zyx77550-sparda-cd266c3/bench/scale-gen.mjs :57 `const { PrismaClient } = require('@prisma/client');`,
  • db zyx77550-sparda-cd266c3/src/ubg/extract.js :579 // CommonJS destructured require — `const { PrismaClient } = require('@prisma/client')`.
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-app-alias/src/app.js :6 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-app-alias/src/sub.js :2 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-computed-write/src/app.js :5 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-credential-gate/src/app.js :2 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-dynamic-effects/src/app.js :4 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-guard-dominance/lib/prisma.js :1 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-invisible-verbs/src/app.js :7 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-next-matcher/lib/prisma.js :1 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-object-scope/src/app.js :7 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-ownership-assert/src/app.js :2 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-pathed-handler/src/admin.js :2 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-pathed-handler/src/app.js :5 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-prisma-folder/src/index.js :4 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-router-use-order/src/admin.js :6 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-scoped-middleware/src/app.js :6 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-server-actions/lib/prisma.js :1 import { PrismaClient } from '@prisma/client';
  • db (weak) zyx77550-sparda-cd266c3/tests/fixtures/ubg-taint-write/src/app.js :4 const { PrismaClient } = require('@prisma/client');
  • db (weak) zyx77550-sparda-cd266c3/tests/zero-day-effects.test.js :111 const { PrismaClient } = require('@prisma/client');

install hooks 1

  • prepublishOnly zyx77550-sparda-cd266c3/package.json :20 node scripts/release-gate.mjs

declared dependencies 12

  • @modelcontextprotocol/sdk@1.29.0
  • @babel/parser@8.0.4
  • @babel/traverse@8.0.4
  • @clack/prompts@1.7.0
  • @eslint/js@^10.0.1
  • @vitest/coverage-v8@^4.1.10
  • eslint@^10.7.0
  • eslint-config-prettier@^10.1.8
  • express@^5.2.1
  • globals@^17.7.0
  • prettier@^3.8.4
  • vitest@^4.1.10

obfuscation 2

  • dynamic require()/import() zyx77550-sparda-cd266c3/docs/csop-handoff/adapter/sparda-to-csop.mjs :6 const { compileUBG } = await import(pathToFileURL(S + '/src/ubg/compile.js').href);
  • dynamic require()/import() zyx77550-sparda-cd266c3/src/commands/heal.js :194 const mod = await import(`${entry}?sparda-heal=${Date.now()}`);

perm:untrusted 2

  • untrusted (weak) zyx77550-sparda-cd266c3/tests/gossip.test.js :185 fetch(`${base}/stats`, { headers: { 'x-sparda-key': key } }).then((r) => r.json());
  • untrusted (weak) zyx77550-sparda-cd266c3/tests/round3.test.js :94 const users = await fetch(`${base}/api/users`).then((r) => r.json());