Atlas / MCP servers / vgiri2015 / Ai-Spark

Ai-SparkBLOCK

mcp/vgiri2015/ai-spark
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
2 2r · 0w · 0d
Transport
—
License
—
Stars
29
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

This project implements a Model Context Protocol (MCP) server and client for optimizing Apache Spark code. The system provides intelligent code optimization suggestions and performance analysis through a client-server architecture.

How It Works

Code Optimization Workflow

graph TB
subgraph Input
A[Input PySpark Code] --> |spark_code_input.py| B[run_client.py]
end

subgraph MCP Client
B --> |Async HTTP| C[SparkMCPClient]
C --> |Protocol Handler| D[Tools Interface]
end

subgraph MCP Server
E[run_server.py] --> F[SparkMCPServer]
F --> |Tool Registry| G[optimize_spark_code]
F --> |Tool Registry| H[analyze_performance]
F --> |Protocol Handler| I[Claude AI Integration]
end

subgraph Resources
I --> |Code Analysis| J[Claude AI Model]
J --> |Optimization| K[Optimized Code Generation]
K --> |Validation| L[PySpark Runtime]
end

subgraph Output
M[optimized_spark_code.py]
N[performance_analysis.md]
end

D --> |MCP Request| F
G --> |Generate| M
H --> |Generate| N

classDef client fill:#e1f5fe,stroke:#01579b
classDef server fill:#f3e5f5,stroke:#4a148c
classDef resource fill:#e8f5e9,stroke:#1b5e20
classDef output fill:#fff3e0,stroke:#e65100

class A,B,C,D client
class E,F,G,H,I server
class J,K,L resource
class M,N,O output

Component Details

  1. Input Layer
  2. spark_code_input.py: Source PySpark code for optimization
  3. run_client.py: Client startup and configuration
  1. MCP Client Layer
  2. Tools Interface: Protocol-compliant tool invocation
  1. MCP Server Layer
  2. run_server.py: Server initialization
  3. Tool Registry: Optimization and analysis tools
  4. Protocol Handler: MCP request/response management
  1. Resource Layer
  2. Claude AI: Code analysis and optimization
  3. PySpark Runtime: Code e
Read from source at commit 53089993c5e4OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add spark-mcp-server --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} -- uvx spark-mcp-server
claude-desktop
{
  "mcpServers": {
    "spark-mcp-server": {
      "command": "uvx",
      "args": [
        "spark-mcp-server"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}"
      }
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
analyze_performancereadAnalyze performance of Spark code execution
optimize_spark_codereadOptimize Spark code using Claude AI
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
none-observed
Shell
declared (3 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (4)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
v0-legacy/run_optimized.py:26
exec(open(code_path).read())
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
v1/run_optimized.py:28
exec(code_file.read())
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
v1/requirements.txt
mcp, pyspark, anthropic, pydantic
Why it matters. 4 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha 53089993c5e4full audit observations/trust-audit/mcp-server/vgiri2015__ai-spark.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0853089993c5e4BLOCKD69first audit
06

Questions

What tools does Ai-Spark expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Ai-Spark safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Ai-Spark need?

It reads ANTHROPIC_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (53089993c5e4), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement