sealmyapp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_key_exposureA | Classify an API key as public-by-design (e.g. Supabase anon/publishable, Stripe pk_) or secret (e.g. sk_live_, service_role, sk-ant-), offline from its format, and say what to do next (rotate first if secret). Pass ONLY the prefix (first 8-15 characters), never the whole key. No network calls; the full key is never echoed back. |
| supabase_rls_audit_sqlA | Return read-only SQL to paste into the Supabase SQL editor that lists tables without Row Level Security, policies whose USING/WITH CHECK is |
| rls_policy_templateA | Return example Supabase RLS policies (select/insert/update/delete using auth.uid()) for a common table shape, with caveats. Never uses |
| vibe_security_checklistA | Return a pre-launch security checklist for an AI-built app (secrets, Supabase RLS, Firebase rules, auth, payments), with notes for the builder used. |
| scan_my_app_instructionsA | Explain how to run a free, ownership-verified, read-only security scan of an app you own at sealmyapp.com, and return a link to start it. Does NOT call any API or start a scan. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Most tools target clearly distinct outputs: key classification (check_key_exposure), RLS audit SQL, RLS policy templates, a general checklist, and scan instructions. The two RLS tools (supabase_rls_audit_sql vs rls_policy_template) share a domain and could be momentarily confused, but one audits existing tables while the other provides example policies, so the boundary is workable.
All names use snake_case, which is consistent, but the structural convention is mixed: some are verb-led actions (check_key_exposure, scan_my_app_instructions) while others are noun phrases (supabase_rls_audit_sql, rls_policy_template, vibe_security_checklist). Readable but not a single predictable pattern.
Five tools is well-scoped for a lightweight pre-launch security assistant. Each tool covers a distinct advisory function and none feels redundant or padded.
The surface covers key exposure, Supabase RLS auditing, RLS templates, and a generic pre-launch checklist, but it lacks an actual scan execution (scan_my_app_instructions only explains how), no dedicated Firebase rules tool despite the checklist mentioning it, and no secret-rotation guidance beyond advisory text. Usable but with notable gaps for the stated 'secure your AI-built app' purpose.