A
licenseA
qualityB
maintenanceScan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.
2
46 npm
MIT
GuardLayer
Server Details
Security checks for Next.js + Supabase apps: code scan, read-only live DB check, fix confirmation.
If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
- Status
- Healthy
- Uptime
- 100.0% over the last 24 hours
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
- Repository
- solvionholdings/guardlayer-plugin
- GitHub Stars
- 0
- Server Listing
- GuardLayer
- ChatGPT
- –
- Claude
- –
TDQS
A4.1/5.0
Scored across 3 tools
Disambiguation4/5
The two Supabase tools are tightly coupled but distinct: get_supabase_snapshot_sql produces the SQL, while check_supabase_snapshot analyzes its JSON output. The descriptions make the handoff explicit, and scan_files targets a clearly different surface (source files vs. live database metadata). Slight risk of an agent confusing the two Supabase tools, but the naming and description clarify the order of operations.
Naming Consistency4/5
All three names follow a verb_noun pattern (check_, get_, scan_) in snake_case, which is consistent. The only minor awkwardness is the long compound get_supabase_snapshot_sql, but it is predictable and readable.
Tool Count4/5
Three tools is lean but each serves a distinct step in the audit workflow: fetch SQL, validate the resulting snapshot, and statically scan source files. The set is well-scoped for a focused security-audit server, though it sits at the thin end of the range.
Completeness4/5
The surface covers the core audit lifecycle for Supabase projects and Next.js codebases, including regression tracking via previous_issue_keys and remediation prompts. Minor gaps exist around fetching auth_config automatically and verifying that fixes were applied, but agents can work around these.
Available Tools
3 toolscheck_supabase_snapshotCheck a live Supabase projectARead-onlyInspect
Checks the JSON from get_supabase_snapshot_sql: tables anyone can read, RLS off, policies that only check for a signed-in user (public in practice when sign-ups are open), users who can update their own role or plan columns, exposed SECURITY DEFINER functions, public buckets. Pass auth_config (the project's Auth settings) when you can: it decides whether 'any signed-in user' means anyone. Pass previous_issue_keys from an earlier result to see what is closed, still open or new. Returns each issue with its SQL fix and a fix prompt.
Inputs: snapshot (required), auth_config, previous_issue_keys.
get_supabase_snapshot_sqlGet the read-only Supabase snapshot queryARead-onlyInspect
Returns the read-only SQL for the live Supabase check and how to run it. It reads only catalog metadata (table and column names, RLS flags, policies, grants, triggers, SECURITY DEFINER functions, bucket settings), never table rows, and returns one JSON value.
Inputs: no named parameters.
scan_filesScan code for security issuesARead-onlyInspect
Static security scan of a Next.js + Supabase codebase: secrets in code or public env vars (NEXT_PUBLIC_, VITE_), service role keys in client code, RLS off or open policies in supabase/migrations, unauthenticated API routes, Server Actions and Edge Functions, unsafe redirects and more. Send source files (ts, tsx, js, jsx, sql, .env*, config files) with paths relative to the project root; skip node_modules, build output and lockfiles. Up to 300 files and 4 MB per call; split bigger projects. Files are scanned in memory and discarded.
Inputs: files (required), ignore.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Related MCP Connectors
Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.
Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.
Code security scanner for founders and small teams: leaked secrets, missing RLS, injection, CVEs
Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.
Related MCP Servers
- AlicenseBqualityBmaintenanceRead-only security audit for Supabase. Surfaces RLS gaps, permissive policies, exposed functions and grants, and returns scored findings with fix SQL that is never executed.451MIT
- AlicenseAqualityBmaintenanceStatic security scanner for AI-generated (vibe-coded) Supabase and Next.js apps. Runs as an MCP server so an LLM can scan, explain findings, and produce fixes while it writes code, all locally and offline.545 npmMIT
- AlicenseAqualityDmaintenanceAudits PostgreSQL/Supabase schemas for security issues like missing RLS, permissive policies, and sensitive data exposure during AI conversations.3MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd
Glama MCP Gateway
Add one secure layer between your agents and this server.