Skip to main content
Glama
Sign In
supabase-security-mcp

supabase-security-mcp

by larik15
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

Related Servers

Alternatives to supabase-security-mcp

No user-submitted related servers found.

    Related Servers

    • se-check

      devhardesian
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI coding agents to audit Supabase or Postgres databases for Row Level Security and multi-tenant isolation holes, reading tables, grants, policies and functions for static findings and optionally probing those policies inside a rolled-back transaction. It reports each hole with an explanation and a fix, so an agent can verify the migrations it just wrote before declaring them done.
      1
      MIT

    • schema-guard-mcp

      yagaMI-Reverse
      A
      license
      A
      quality
      D
      maintenance
      Audits PostgreSQL/Supabase schemas for security issues like missing RLS, permissive policies, and sensitive data exposure during AI conversations.
      3
      MIT

    • sealmyapp

      toby7979
      A
      license
      A
      quality
      C
      maintenance
      Enables AI coding assistants to check whether an API key is safe to expose, audit Supabase Row Level Security, generate owner-based RLS policy templates, and run a builder-specific pre-launch security checklist. Runs locally over stdio with no network calls, telemetry, or file access.
      5
      MIT

    • supabase-security-mcp

      Perufitlife
      A
      license
      A
      quality
      C
      maintenance
      MCP server that lets AI coding agents (Claude Code, Cursor, Cline) audit Supabase projects for security misconfigurations AND apply the fixes — without leaving the agent. Tools: audit_project, list_findings, preview_fix (BEGIN/ROLLBACK safety), apply_fix (with confirmation), apply_all_fixes (transactional bulk). Closes the audit-fix loop entirely in the agent — other Supabase scanners only report.
      5
      4 npm
      1
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 4 tools

    Disambiguation4/5

    The probes are differentiated: `probe_anon` is black-box REST exposure, `audit_policies` inspects database catalogs, `two_account_test` verifies cross-user isolation, and `security_report` orchestrates. There is some conceptual overlap between `probe_anon` and `audit_policies` around anon/RLS exposure, so an agent might briefly hesitate, but no tool duplicates another.

    Naming Consistency3/5

    `probe_anon` and `audit_policies` follow a verb_noun command style, while `two_account_test` and `security_report` are noun-style names. They are all readable snake_case, but the action-first convention is not applied consistently across the set.

    Tool Count5/5

    Four tools is appropriate for a focused Supabase security-audit server: three distinct probes plus one report aggregator. Each tool has a clear job, and none feels redundant or missing.

    Completeness4/5

    The set covers anon REST exposure, RLS policy misconfigurations, SECURITY DEFINER functions, and cross-user table isolation, which are the core Supabase data-security risks. Minor gaps remain, such as no dynamic storage-object cross-account test and no anonymous INSERT probe, but static policy checks partially compensate.

    Maintenance

    ActivityMaintained
    ResponsivenessSyncing

    Resources