supabase-security-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SUPABASE_ACCESS_TOKEN | Yes | Your Supabase personal access token (sbp_...). Get one at https://supabase.com/dashboard/account/tokens |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| audit_projectA | Scan a Supabase project for security issues: RLS gaps, exposed SECURITY DEFINER functions, public buckets, default-privilege leaks, and unsafe auth config. Returns findings JSON. Caches result for use by apply_fix tools. |
| list_findingsA | List findings from the last audit of a project, optionally filtered by severity. Use after audit_project to inspect specific issues. |
| preview_fixA | Preview what a fix would change WITHOUT applying it. Wraps the fix SQL in BEGIN; ... ROLLBACK; and returns what would have happened. Safe to call for any finding. |
| apply_fixA | ACTUALLY APPLY a fix SQL to the project. Requires confirm=true. Always run preview_fix first. Re-runs audit afterward to verify the finding is gone. |
| apply_all_fixesA | Bulk-apply all SQL fixes from last audit, optionally filtered by severity. Wraps everything in a single transaction — if any statement fails, everything rolls back. Always preview the count and list before confirming. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clear, distinct purpose: auditing, listing findings, previewing fixes, applying a single fix, and bulk-applying fixes. There is no overlap or ambiguity.
All tool names follow a consistent verb_noun pattern (e.g., audit_project, list_findings, preview_fix, apply_fix, apply_all_fixes), making the API predictable and easy to navigate.
With 5 tools, the server is well-scoped for its purpose of security auditing and fix application. Each tool is necessary, and the count is neither too few nor excessive.
The tool set covers the full workflow: audit, inspect findings, preview fixes, apply individual fixes, and bulk apply. There are no obvious missing operations for this domain.