## https://sploitus.com/exploit?id=17AC31EF-032E-5AD3-AFAF-B132C14B2B2D
# SPAR backend
Python core: attacker/defender agents, orchestrator, and the detonation boundary.
Built W0-first (the self-play loop must close on one real CVE before anything else).
## Layout
- `spar/targets.py` - authorized-targets guard (LOCKED). Default-deny; refuses live/production
hosts categorically. Exercised by `tests/test_targets.py` (part of the W6 gate).
- `spar/sandbox.py` - the detonation boundary (LOCKED). Every exploit runs inside a Modal
gVisor Sandbox and nowhere else. `detonate_vul4j` is the single entry point; it raises
`ModalAuthError` rather than fabricating a result when Modal is unavailable.
- `spar/w0_bout.py` - W0 orchestration + evidence writer. Runs one real vul4j bout and
evaluates the success-then-fail gate.
## W0 target (locked)
VUL4J-79 / CVE-2018-1002201 - Zip Slip path traversal in `zeroturnaround/zt-zip`.
Chosen as the cheapest reliable build (single JDK 8, Maven, tiny module, ~8s compile per the
vul4j reproduction log) so Modal cost stays minimal. Proof-of-vulnerability tests:
- `org.zeroturnaround.zip.DirectoryTraversalMaliciousTest#testUnwrapDoesntLeaveTarget`
- `org.zeroturnaround.zip.DirectoryTraversalMaliciousTest#testUnpackDoesntLeaveTarget`
The bout, inside one Modal sandbox:
1. Check out the vulnerable revision (PoV baked in by vul4j).
2. Build, run the PoV tests -> they FAIL. The exploit lands: the archive escapes the target
directory. This proves the bug is real.
3. Apply the real human patch (commit `759b72f`).
4. Re-run the identical PoV tests -> they PASS. The exploit no longer lands.
5. Run the repo's full test suite -> green.
Gate passes only if all three hold. Evidence is written to `../evidence/w0_transcript.json`
with the real sandbox id, timings, and per-step log. Nothing executes on the host.
## Run
```bash
python3.12 -m venv ../.venv && . ../.venv/bin/activate
pip install -r requirements.txt
PYTHONPATH=. python -m pytest tests/ -q # offline: 20 tests
PYTHONPATH=. python -m spar.w0_bout # real detonation (needs Modal auth + credit)
```
Modal auth: `modal token new`. If a bout dies with "reaching billing cycle spend limit", the
workspace needs credits or a card (see repo `HUMAN-NEEDED.md`).
## SPAR as an MCP: your coding agent can prove its own fixes before it ships them
SPAR ships a thin MCP server (`spar-mcp`, built on the official Python MCP SDK /
FastMCP) so any MCP client - Cursor, Claude Code, your own agent - can call SPAR's
real capabilities. The hero tool is `spar_prove(repo, patch_diff?)`: it re-runs the
real exploit and tells you whether the attack now FAILS (DEFENDED) or still lands,
with the real Modal sandbox id, exit codes, test counts, and cost. An agent can
prove its own patch holds before opening the PR.
Every tool enforces the same cage: authorized/owned repos only (others are
refused), sandbox-only execution, PoCs sealed until a human merges, human referee
required. Results are real recorded bouts or real sandbox runs, never fabricated.
Run: `spar-mcp` (or `python -m spar.mcp_server`). Config: see `docs/mcp-config.md`.
Tools: `spar_status`, `spar_prove`, `spar_attack`, `spar_ask`, `spar_vault`.