sparda-mcp 0.3.0 → 0.5.0

package/README.md

@@ -45,6 +45,12 @@ Your app learns what "self" looks like — and defends itself:
 - **Immune memory.** Diagnoses are cached as antibodies in `sparda.json` (git-versioned): the same failure later is diagnosed instantly, zero tokens. Your app accumulates antibodies as it lives — cloning the code doesn't clone its immune system.
 - **`sparda_get_context`.** One tool call gives the AI the full living context: tools, workflows, runtime telemetry, quarantine state, immune memory. Every AI session resumes where the last one stopped.
 
+## v0.4 — the recycling economy + first Labs organ
+- **Recycling gauge (zero config).** The router counts calls answered from SPARDA's own knowledge vs calls that paid the host route (`GET /mcp/stats → recycle`), and the bridge counts the sampling calls its cached knowledge avoided. Day 1 it reads 0% — the circle fills with usage. A measure, never a promise.
+- **Idle harvester.** All of SPARDA's internal work (analysis, persistence) runs only when the event loop is quiet, one job per tick. Perceived saturation: zero.
+- **Sequence condenser (Labs, opt-in, default OFF).** Set `"labs": { "recordSequences": true }` in `sparda.json` (or `SPARDA_RECORD_SEQUENCES=1` for one session) and SPARDA observes when one tool's output feeds the next tool's input, recording the *circuit* — structure only (tool names, arg names, counts), never your data. Deterministic, zero LLM.
+- **Crystallization: tools nobody wrote.** A read-only circuit observed 3× is born as a *composite tool*, announced mid-session via `tools/list_changed`: one call runs the whole chain, auto-feeding each linked argument from the previous step's real response. Your AI names it (MCP sampling, sanitized) or a deterministic name ships without any LLM. Write routes are never absorbed — their per-call confirmation stands.
+
 Where this is going: [ROADMAP.md](./ROADMAP.md).
 
 ## v0 supports

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Turn any codebase into an MCP server with one command. Express & FastAPI → Claude-ready in 3 minutes.",
   "type": "module",
   "bin": {

package/src/commands/hook.js

@@ -27,3 +27,25 @@ export async function runHook(opts) {
   fs.chmodSync(hookPath, 0o755);
   console.error('[sparda] sentinel installed: routes re-sync after every commit (post-commit hook).');
 }
+
+// Uninstall exactly what runHook installed (hard rule #4 applied to .git/hooks):
+// delete the file if we created it whole, strip our exact block if we appended,
+// line-filter as a last resort if the user edited around it. Returns whether
+// anything was removed so `remove` can report it.
+export function removeHook(cwd) {
+  const hookPath = path.join(cwd, '.git', 'hooks', 'post-commit');
+  let content;
+  try { content = fs.readFileSync(hookPath, 'utf8'); } catch { return false; }
+  if (!content.includes(MARKER)) return false;
+  const block = `${MARKER}\nnpx --no-install sparda-mcp sync --quiet || true\n`;
+  if (content === `#!/bin/sh\n${block}`) {
+    fs.rmSync(hookPath);
+    return true;
+  }
+  let out = content.includes(`\n${block}`) ? content.replace(`\n${block}`, '') : content.replace(block, '');
+  if (out.includes(MARKER)) {
+    out = out.split('\n').filter((l) => l !== MARKER && l !== 'npx --no-install sparda-mcp sync --quiet || true').join('\n');
+  }
+  fs.writeFileSync(hookPath, out);
+  return true;
+}

package/src/commands/init.js

@@ -8,13 +8,14 @@ import { parseFastAPIProject } from '../parser/fastapi.js';
 import { sanitizeDescription } from '../security/sanitize.js';
 import { generateExpress } from '../generator/express.js';
 import { generateFastAPI } from '../generator/fastapi.js';
+import { c, gradient, colorizeJson } from '../ui/style.js';
 
 
 const VERSION = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 
 export async function runInit(opts) {
   const t0 = Date.now();
-  p.intro(`SPARDA v${VERSION}`);
+  p.intro(`${gradient('SPARDA')} ${c.dim(`v${VERSION}`)}`);
 
   const s = p.spinner();
   s.start('Scanning project...');
@@ -25,13 +26,13 @@ export async function runInit(opts) {
     const res = parseExpressProject(opts.cwd, stack.entryFile);
     routes = res.routes;
     skipped = res.skipped;
-    s.stop(`Stack detected: Express (${stack.moduleType.toUpperCase()}) — entry: ${stack.entryFile}, port: ${stack.port}`);
+    s.stop(`Stack detected: ${c.cyan(`Express (${stack.moduleType.toUpperCase()})`)} — entry: ${stack.entryFile}, port: ${stack.port}`);
   } else if (stack.framework === 'fastapi') {
     const res = parseFastAPIProject(opts.cwd, stack.entryFile, stack.pythonCmd);
     routes = res.routes;
     skipped = res.skipped;
     entryAppVars = res.entryAppVars;
-    s.stop(`Stack detected: FastAPI — entry: ${stack.entryFile}, port: ${stack.port}`);
+    s.stop(`Stack detected: ${c.cyan('FastAPI')} — entry: ${stack.entryFile}, port: ${stack.port}`);
   }
 
   if (routes.length === 0) {
@@ -49,9 +50,9 @@ export async function runInit(opts) {
   p.log.info(`${routes.length} routes found — ${high} high confidence, ${routes.length - high} partial`);
 
   const preview = routes.slice(0, 8).map((r) =>
-    `${r.mutating ? '✗' : '✓'} ${r.method.toUpperCase().padEnd(6)} ${r.path}${r.mutating ? '   (disabled: write-safety)' : ''}`
+    `${r.mutating ? c.red('✗') : c.green('✓')} ${r.method.toUpperCase().padEnd(6)} ${r.path}${r.mutating ? c.dim('   (disabled: write-safety)') : ''}`
   ).join('\n');
-  p.note(preview + (routes.length > 8 ? `\n... (+${routes.length - 8} more)` : ''), 'TOOLS TO GENERATE');
+  p.note(preview + (routes.length > 8 ? c.dim(`\n... (+${routes.length - 8} more)`) : ''), 'TOOLS TO GENERATE');
 
   if (flaggedCount) p.log.warn(`${flaggedCount} suspicious docstring(s) purged (prompt-injection defense)`);
   if (skipped.length) p.log.warn(`${skipped.length} route(s) skipped — details in .sparda/scan-report.json`);
@@ -84,15 +85,15 @@ export async function runInit(opts) {
   p.log.success('Wrote sparda.json');
 
   const cfg = JSON.stringify({ [path.basename(opts.cwd)]: { command: 'npx', args: ['sparda-mcp', 'dev'], cwd: opts.cwd } }, null, 2);
-  p.outro(`Done in ${((Date.now() - t0) / 1000).toFixed(1)}s.
+  p.outro(`${c.green(`Done in ${((Date.now() - t0) / 1000).toFixed(1)}s.`)}
 
    Next steps:
-   1. Start your app:        ${stack.framework === 'express' ? 'npm run dev' : 'fastapi dev'}
-   2. Start the MCP bridge:  npx sparda-mcp dev
+   1. Start your app:        ${c.cyan(stack.framework === 'express' ? 'npm run dev' : 'fastapi dev')}
+   2. Start the MCP bridge:  ${c.cyan('npx sparda-mcp dev')}
    3. Add to Claude Desktop config (claude_desktop_config.json):
 
-${cfg.split('\n').map((l) => '   ' + l).join('\n')}
+${colorizeJson(cfg).split('\n').map((l) => '   ' + l).join('\n')}
 
-   Write tools (POST/PUT/DELETE) are disabled by default.
-   Enable them in sparda.json, then re-run \`npx sparda-mcp init --yes\`.`);
+   ${c.dim('Write tools (POST/PUT/DELETE) are disabled by default.')}
+   ${c.dim('Enable them in sparda.json, then re-run')} ${c.cyan('`npx sparda-mcp init --yes`')}${c.dim('.')}`);
 }

package/src/commands/remove.js

@@ -5,6 +5,7 @@ import * as p from '@clack/prompts';
 import { removeInjection as removeExpress } from '../generator/express.js';
 import { removeInjection as removeFastAPI } from '../generator/fastapi.js';
 import { detectStack } from '../detect.js';
+import { removeHook } from './hook.js';
 
 export async function runRemove(opts) {
   const manifestPath = path.join(opts.cwd, 'sparda.json');
@@ -43,6 +44,7 @@ export async function runRemove(opts) {
     if (fs.existsSync(abs)) { fs.rmSync(abs); console.log(`✓ Deleted ${f}`); }
   }
   if (revertGitignore(opts.cwd, manifest.gitignore)) console.log('✓ Reverted .gitignore edit');
+  if (removeHook(opts.cwd)) console.log('✓ Uninstalled post-commit sentinel hook');
   fs.rmSync(manifestPath);
   fs.rmSync(path.join(opts.cwd, '.sparda'), { recursive: true, force: true });
   console.log('✓ Deleted sparda.json and .sparda/');

package/src/generator/express.js

@@ -5,7 +5,7 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { parse } from '@babel/parser';
 import { toolNameFor } from '../parser/express.js';
-import { carryOverManifest } from './manifest.js';
+import { carryOverManifest, defaultSpardingMemory } from './manifest.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const MARK_START = '// >>> sparda-injection (do not edit this block) >>>';
@@ -28,6 +28,28 @@ export function generateExpress({ cwd, entryFile, moduleType, port, routes }) {
   }
   const prev = carryOverManifest(cwd, tools);
 
+  // --- sparding safety memory & fingerprints
+  const sparding = defaultSpardingMemory(prev);
+  const oldFingerprints = sparding.toolFingerprints ?? {};
+  const newFingerprints = {};
+  for (const [name, t] of Object.entries(tools)) {
+    const raw = `${t.method}|${t.path}|${JSON.stringify(t.params)}`;
+    const fp = crypto.createHash('sha256').update(raw).digest('hex').slice(0, 8);
+    newFingerprints[name] = fp;
+    const oldFp = oldFingerprints[name];
+    if (oldFp && oldFp !== fp) {
+      sparding.events.push({
+        ts: new Date().toISOString(),
+        tool: name,
+        decision: 'audit',
+        risk: 'medium',
+        reasons: [`route structure modified (fingerprint changed from ${oldFp} to ${fp})`],
+      });
+      if (sparding.events.length > 100) sparding.events.shift();
+    }
+  }
+  sparding.toolFingerprints = newFingerprints;
+
   // stable across re-runs so a running bridge/host pair never desyncs
   const localKey = prev?.localKey ?? crypto.randomUUID();
   const entryAbs = path.resolve(cwd, entryFile);
@@ -61,6 +83,7 @@ export function generateExpress({ cwd, entryFile, moduleType, port, routes }) {
 
   tpl = tpl
     .replace('__IMPORT_LINE__', importLine)
+    .replace('__SPARDING_POLICIES__', JSON.stringify(sparding.policies ?? {}))
     .replace('__ROUTER_DECL__', isESM
       ? 'export const spardaRouter = express.Router();'
       : 'const spardaRouter = express.Router();\nmodule.exports = { spardaRouter };')
@@ -97,6 +120,8 @@ export function generateExpress({ cwd, entryFile, moduleType, port, routes }) {
     ...(gitignore ? { gitignore } : {}),
     ...(prev?.semantic ? { semantic: prev.semantic } : {}),
     ...(prev?.immune ? { immune: prev.immune } : {}),
+    ...(prev?.labs ? { labs: prev.labs } : {}),
+    sparding,
   };
   atomicWrite(path.join(cwd, 'sparda.json'), JSON.stringify(manifest, null, 2) + '\n');
 

package/src/generator/fastapi.js

@@ -5,7 +5,7 @@ import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { toolNameFor } from '../parser/express.js';
-import { carryOverManifest } from './manifest.js';
+import { carryOverManifest, defaultSpardingMemory } from './manifest.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const MARK_START = '# >>> sparda-injection (do not edit this block) >>>';
@@ -28,6 +28,28 @@ export function generateFastAPI({ cwd, entryFile, port, routes, entryAppVars, py
   }
   const prev = carryOverManifest(cwd, tools);
 
+  // --- sparding safety memory & fingerprints
+  const sparding = defaultSpardingMemory(prev);
+  const oldFingerprints = sparding.toolFingerprints ?? {};
+  const newFingerprints = {};
+  for (const [name, t] of Object.entries(tools)) {
+    const raw = `${t.method}|${t.path}|${JSON.stringify(t.params)}`;
+    const fp = crypto.createHash('sha256').update(raw).digest('hex').slice(0, 8);
+    newFingerprints[name] = fp;
+    const oldFp = oldFingerprints[name];
+    if (oldFp && oldFp !== fp) {
+      sparding.events.push({
+        ts: new Date().toISOString(),
+        tool: name,
+        decision: 'audit',
+        risk: 'medium',
+        reasons: [`route structure modified (fingerprint changed from ${oldFp} to ${fp})`],
+      });
+      if (sparding.events.length > 100) sparding.events.shift();
+    }
+  }
+  sparding.toolFingerprints = newFingerprints;
+
   // stable across re-runs so a running bridge/host pair never desyncs
   const localKey = prev?.localKey ?? crypto.randomUUID();
   const entryAbs = path.resolve(cwd, entryFile);
@@ -41,6 +63,7 @@ export function generateFastAPI({ cwd, entryFile, port, routes, entryAppVars, py
     // double-stringify: a JSON string literal is also a valid Python string literal,
     // and json.loads() in the template turns it into real Python values (E-009)
     .replace('__TOOLS_JSON__', JSON.stringify(JSON.stringify(tools)))
+    .replace('__SPARDING_POLICIES__', JSON.stringify(JSON.stringify(sparding.policies ?? {})))
     .replace('__LOCAL_KEY__', localKey)
     .replace('__PORT__', String(port));
 
@@ -66,6 +89,8 @@ export function generateFastAPI({ cwd, entryFile, port, routes, entryAppVars, py
     ...(gitignore ? { gitignore } : {}),
     ...(prev?.semantic ? { semantic: prev.semantic } : {}),
     ...(prev?.immune ? { immune: prev.immune } : {}),
+    ...(prev?.labs ? { labs: prev.labs } : {}),
+    sparding,
   };
 
   atomicWrite(path.join(cwd, 'sparda.json'), JSON.stringify(manifest, null, 2) + '\n');

package/src/generator/manifest.js

@@ -2,10 +2,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-// Re-running init must not wipe what the user (or the semantic/immune passes)
-// wrote into sparda.json: per-tool `enabled` overrides, the cached `semantic`
-// enrichment and the `immune` memory (antibodies) survive as long as the
-// tool's method+path are unchanged.
+// Re-running init must not wipe what the user (or the semantic/immune/Labs
+// passes) wrote into sparda.json: per-tool `enabled` overrides, the cached
+// `semantic` enrichment, the `immune` memory (antibodies), the `labs`
+// state (opt-in flags + observed circuits), and the `sparding` security
+// memory survive as long as the tool's method+path are unchanged.
 export function carryOverManifest(cwd, tools) {
   let prev = null;
   try {
@@ -21,3 +22,18 @@ export function carryOverManifest(cwd, tools) {
   }
   return prev;
 }
+
+export function defaultSpardingMemory(prev) {
+  return prev?.sparding ?? {
+    version: 1,
+    policies: {
+      reads: 'allow',
+      writes: 'require_human',
+      deletes: 'block',
+      requireProofAfterWrite: true,
+    },
+    events: [],
+    failures: {},
+    toolFingerprints: {},
+  };
+}

package/src/parser/express.js

@@ -110,7 +110,7 @@ export function parseExpressProject(cwd, entryFile) {
         }
 
         const fullPath = joinPath(prefix, pathArg.value);
-        if (fullPath.startsWith('/mcp')) {
+        if (fullPath === '/mcp' || fullPath.startsWith('/mcp/')) {
           skipped.push({ reason: `self-referential path ${fullPath} blocked`, file: rel(absFile), line: p.node.loc?.start.line });
           return;
         }
@@ -129,6 +129,14 @@ export function parseExpressProject(cwd, entryFile) {
 
         const mutating = method !== 'get';
         const params = [...pathParams];
+        // query params: handlers reveal them as req.query.X / destructured req.query —
+        // without this the AI cannot discover ?limit=… filters at all (E2E P2 finding)
+        const taken = new Set(params.map((x) => x.name));
+        for (const q of queryParamsOf(p)) {
+          if (taken.has(q)) continue;
+          taken.add(q);
+          params.push({ name: q, in: 'query', type: 'string', required: false, description: 'query parameter' });
+        }
         let confidence = 'high';
         if (mutating) {
           params.push({ name: 'body', in: 'body', type: 'object', required: false, description: 'JSON body — schema not statically detected' });
@@ -172,6 +180,40 @@ export function parseExpressProject(cwd, entryFile) {
   }
 }
 
+// Query params are invisible in a route's signature; only the handler body
+// reveals them. Covers the two canonical shapes — req.query.x / req.query['x']
+// and `const { x } = req.query` — on inline handlers only (an Identifier
+// handler lives elsewhere; guessing is worse than staying silent). Bounded.
+function queryParamsOf(callPath) {
+  const reqNames = new Set();
+  for (const a of callPath.node.arguments) {
+    if ((a.type === 'ArrowFunctionExpression' || a.type === 'FunctionExpression') && a.params[0]?.type === 'Identifier') {
+      reqNames.add(a.params[0].name);
+    }
+  }
+  const found = [];
+  if (!reqNames.size) return found;
+  const isReqQuery = (n) => n?.type === 'MemberExpression' && !n.computed &&
+    n.object?.type === 'Identifier' && reqNames.has(n.object.name) &&
+    n.property?.type === 'Identifier' && n.property.name === 'query';
+  callPath.traverse({
+    MemberExpression(q) {
+      const n = q.node;
+      if (!isReqQuery(n.object) || found.length >= 15) return;
+      if (!n.computed && n.property.type === 'Identifier') found.push(n.property.name);
+      else if (n.computed && n.property.type === 'StringLiteral') found.push(n.property.value);
+    },
+    VariableDeclarator(q) {
+      if (q.node.id.type !== 'ObjectPattern' || !isReqQuery(q.node.init)) return;
+      for (const prop of q.node.id.properties) {
+        if (found.length >= 15) break;
+        if (prop.type === 'ObjectProperty' && prop.key.type === 'Identifier') found.push(prop.key.name);
+      }
+    },
+  });
+  return [...new Set(found)];
+}
+
 function joinPath(prefix, p) {
   const joined = `${prefix ?? ''}${p === '/' && prefix ? '' : p}`.replace(/\/{2,}/g, '/');
   return joined.startsWith('/') ? joined : `/${joined}`;

package/src/parser/fastapi_extract.py

@@ -27,6 +27,77 @@ class RouteSpecExtractor:
         lines = [line.strip() for line in doc.splitlines()]
         return " ".join([l for l in lines[:3] if l]).strip()
 
+    def _is_depends(self, default_node):
+        """Returns True if the default value is a Depends(...) call."""
+        return (
+            isinstance(default_node, ast.Call) and
+            ((isinstance(default_node.func, ast.Name) and default_node.func.id == 'Depends') or
+             (isinstance(default_node.func, ast.Attribute) and default_node.func.attr == 'Depends'))
+        )
+
+    def _collect_all_imports(self, start_file):
+        to_visit = [start_file]
+        collected = set()
+        visited_imports = set()
+        
+        while to_visit:
+            curr = to_visit.pop(0)
+            if curr in visited_imports:
+                continue
+            visited_imports.add(curr)
+            
+            if not os.path.exists(curr):
+                continue
+            
+            try:
+                with open(curr, 'r', encoding='utf-8') as f:
+                    src = f.read()
+                tree = ast.parse(src, filename=curr)
+            except:
+                continue
+                
+            for node in ast.walk(tree):
+                resolved = None
+                if isinstance(node, ast.ImportFrom):
+                    dots = '.' * node.level if node.level > 0 else ''
+                    module_with_dots = f"{dots}{node.module}" if node.module else dots
+                    
+                    for name_node in node.names:
+                        if node.module:
+                            full_mod = f"{module_with_dots}.{name_node.name}"
+                        else:
+                            full_mod = f"{module_with_dots}{name_node.name}"
+                        resolved = self.resolve_import(curr, full_mod)
+                        if resolved and resolved not in collected:
+                            collected.add(resolved)
+                            to_visit.append(resolved)
+                    
+                    resolved = self.resolve_import(curr, module_with_dots)
+                    if resolved and resolved not in collected:
+                        collected.add(resolved)
+                        to_visit.append(resolved)
+                        
+                elif isinstance(node, ast.Import):
+                    for name_node in node.names:
+                        resolved = self.resolve_import(curr, name_node.name)
+                        if resolved and resolved not in collected:
+                            collected.add(resolved)
+                            to_visit.append(resolved)
+                            
+        return collected
+
+    def preload_models(self):
+        """Pre-scan all reachable files for Pydantic models before route extraction."""
+        for abs_path in self._collect_all_imports(self.entry_file):
+            if abs_path not in self.models:
+                try:
+                    with open(abs_path, 'r', encoding='utf-8') as f:
+                        src = f.read()
+                    tree = ast.parse(src, filename=abs_path)
+                    self.extract_pydantic_models(tree, abs_path)
+                except:
+                    pass
+
     def resolve_import(self, from_file, module_name):
         if not module_name:
             return None
@@ -176,10 +247,22 @@ class RouteSpecExtractor:
         for node in tree.body:
             # from x import y
             if isinstance(node, ast.ImportFrom):
-                resolved = self.resolve_import(abs_file, node.module)
-                if resolved:
-                    for name_node in node.names:
-                        local_name = name_node.asname or name_node.name
+                dots = '.' * node.level if node.level > 0 else ''
+                module_with_dots = f"{dots}{node.module}" if node.module else dots
+                
+                for name_node in node.names:
+                    local_name = name_node.asname or name_node.name
+                    
+                    if node.module:
+                        full_mod = f"{module_with_dots}.{name_node.name}"
+                    else:
+                        full_mod = f"{module_with_dots}{name_node.name}"
+                        
+                    resolved = self.resolve_import(abs_file, full_mod)
+                    if not resolved:
+                        resolved = self.resolve_import(abs_file, module_with_dots)
+                        
+                    if resolved:
                         import_map[local_name] = resolved
 
             # import x
@@ -221,36 +304,46 @@ class RouteSpecExtractor:
             if isinstance(node, ast.Expr) and isinstance(node.value, ast.Call):
                 call = node.value
                 if isinstance(call.func, ast.Attribute) and call.func.attr == 'include_router':
-                    # First arg is the router variable
-                    if len(call.args) >= 1 and isinstance(call.args[0], ast.Name):
-                        router_name = call.args[0].id
-                        mount_prefix = ""
-                        for kw in call.keywords:
-                            if kw.arg == 'prefix':
-                                val = self.get_lit_value(kw.value)
-                                if val is not None:
-                                    mount_prefix = val
-                        
-                        resolved_file = import_map.get(router_name)
-                        # Reconstruct cumulative prefix
-                        # parent prefix + mount prefix
-                        cum_prefix = (prefix + mount_prefix).replace('//', '/')
-                        if resolved_file:
-                            self.mounts.append((cum_prefix, resolved_file, router_name))
-                        else:
-                            # If it's a locally defined router
-                            if router_name in router_vars:
-                                local_r_prefix = router_prefixes.get(router_name, "")
-                                self.mounts.append((cum_prefix + local_r_prefix, abs_file, router_name))
+                    # First arg is the router variable (can be ast.Name or ast.Attribute like users.router)
+                    if len(call.args) >= 1:
+                        arg0 = call.args[0]
+                        router_name = None
+                        is_attribute = False
+                        if isinstance(arg0, ast.Name):
+                            router_name = arg0.id
+                        elif isinstance(arg0, ast.Attribute) and isinstance(arg0.value, ast.Name):
+                            router_name = arg0.value.id
+                            is_attribute = True
+                            
+                        if router_name:
+                            mount_prefix = ""
+                            for kw in call.keywords:
+                                if kw.arg == 'prefix':
+                                    val = self.get_lit_value(kw.value)
+                                    if val is not None:
+                                        mount_prefix = val
+                            
+                            resolved_file = import_map.get(router_name)
+                            # Reconstruct cumulative prefix
+                            # parent prefix + mount prefix
+                            cum_prefix = (prefix + mount_prefix).replace('//', '/')
+                            if resolved_file:
+                                # If it was users.router, we mount the resolved file with the module's router name
+                                self.mounts.append((cum_prefix, resolved_file, router_name))
                             else:
-                                self.skipped.append({
-                                    'reason': f"Router '{router_name}' source file not resolved",
-                                    'file': self.get_rel_path(abs_file),
-                                    'line': node.lineno
-                                })
+                                # If it's a locally defined router
+                                if not is_attribute and router_name in router_vars:
+                                    local_r_prefix = router_prefixes.get(router_name, "")
+                                    self.mounts.append((cum_prefix + local_r_prefix, abs_file, router_name))
+                                else:
+                                    self.skipped.append({
+                                        'reason': f"Router '{router_name}' source file not resolved",
+                                        'file': self.get_rel_path(abs_file),
+                                        'line': node.lineno
+                                    })
 
             # FunctionDef decorated with app/router decorators
-            elif isinstance(node, ast.FunctionDef):
+            elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
                 for dec in node.decorator_list:
                     if isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
                         obj_node = dec.func.value
@@ -283,7 +376,7 @@ class RouteSpecExtractor:
                                         full_path = '/' + full_path
 
                                     # Anti-loop skip
-                                    if full_path.startswith('/mcp'):
+                                    if full_path == '/mcp' or full_path.startswith('/mcp/'):
                                         self.skipped.append({
                                             'reason': f"self-referential path {full_path} blocked",
                                             'file': self.get_rel_path(abs_file),
@@ -327,6 +420,10 @@ class RouteSpecExtractor:
                                             
                                         # Check if it has a default value
                                         has_default = idx >= defaults_start_idx
+                                        if has_default:
+                                            default_val = node.args.defaults[idx - defaults_start_idx]
+                                            if self._is_depends(default_val):
+                                                continue
                                         
                                         # Parse type annotation
                                         arg_type, type_req = self.parse_type_annotation(arg.annotation)
@@ -403,6 +500,9 @@ class RouteSpecExtractor:
             self.entry_app_vars = list(app_vars)
 
     def run(self):
+        # Pre-load Pydantic models from all imported files
+        self.preload_models()
+        
         # 1st pass: parse entry file
         self.parse_file(self.entry_file, '', 0)