AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
This grade was produced by analyzer v30 , 3 version s behind the one running now. Detectors added since have not been applied here, so it is not directly comparable with a server analyzed at the current version. A re-scan is queued.
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 11
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 7m ago · see ecosystem CVEs →
- C · 44 → C · 36
- C · 56 → C · 44
- C · 44 → C · 56
- B · 32 → C · 44
No known CVEs for this server.
- high dangerous code
dynamic exec: eval() · obfuscated payload: dynamic require()/import()
analyzed commit cd266c3 · analyzer v30 · 5d ago
skills & prompt files 4
- agent-rules zyx77550-sparda-cd266c3/CLAUDE.md
- agent-rules zyx77550-sparda-cd266c3/GEMINI.md
- skill zyx77550-sparda-cd266c3/SKILL.md
- skill zyx77550-sparda-cd266c3/tools/publish/public/SKILL.md
danger signals1
- dynamic code execution eval() zyx77550-sparda-cd266c3/tests/cross-framework-verbs.test.js :96
const verbs = eval(m[1]);
[](https://mcpobservatory.com/servers/github:zyx77550/sparda/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of zyx77550.