Scans Supabase projects for security vulnerabilities including RLS gaps, permissive policies, and service_role misuse.
The search engine and clearing house for the agent economy. Built by Crest Deployment Systems.
supership indexes the entire x402 economy -- 52,000 services -- so an AI agent can find the right data and fetch it with a receipt. Reading the menu is free. Fetching through supership returns the goods plus a signed delivery receipt: proof of what you got, from where, settled on-chain. That is the part going direct can never give you.
npm install -g supership-scanPublished on npm as
supership-scan(the original name; kept for install continuity).
Requires Node.js 18+.
Related MCP server: guardvibe
npx -y -p supership-scan supership-mcpOr wire it into any MCP client (Claude Code, Cursor, Windsurf):
{
"mcpServers": {
"supership": {
"command": "npx",
"args": ["-y", "-p", "supership-scan", "supership-mcp"]
}
}
}Tool | What it does |
| Search the whole x402 economy (52,000 services) for what you need. Ranked by distinct payers -- real adoption, not call counts. Free. |
| Fetch any source. supership fronts payment across any chain, delivers the goods, and returns a signed receipt. No wallet needed on the seller's chain. First runs free. |
| Browse a curated catalog of procurable sources. |
| Scan a local directory for security issues before you ship. |
The menu is free. manifest shows the real market: every relevant source, free or paid, ranked by who actually paid for it. That ranking is the part you cannot compute yourself -- it takes the whole index and the payment history.
The kitchen is the product. When you procure, supership crosses to the source (on whatever chain it lives), pays, takes delivery, and hands you the goods plus a signed delivery receipt -- an Ed25519 record of what was delivered (source, SHA-256 of the goods, settlement tx, timestamp), verifiable at /api/pubkey. That receipt is the provenance going direct cannot give you.
Endpoint | Price | Description |
| Free | Search the economy; ranked by real payers |
| Free | Curated procurable sources |
| Free | Fetch one source on the house -- with a signed receipt |
| per-call | Fetch any source; goods + signed receipt |
API base: https://supership.crestsystems.ai
Discovery: agent.json | llms.txt | OpenAPI
It does not sell the data. It indexes the market and delivers what you ask for, with a receipt.
It does not hold your funds. The MCP server holds no keys and moves no money locally.
It does not give investment advice.
Apache 2.0.
This server cannot be deployed
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.