# SealMyApp tools

Free, open-source security helpers for vibe-coded apps (Lovable, Bolt, Cursor, Replit, v0, and anything on Supabase or Firebase):

- **An MCP server** your AI assistant can call to check whether a key is safe to expose, audit Supabase Row Level Security, generate safe RLS policies and run a pre-launch checklist.
- **A Cursor rule**, **an Agent Skill** (Claude Code and other skill-aware agents) and **an `AGENTS.md` snippet** that stop the AI from leaking secrets or "fixing" empty results with `using (true)`.

Everything here runs locally and makes no network calls.

> Made by [SealMyApp](https://sealmyapp.com), a paid service that finds, fixes and monitors security holes in vibe-coded apps. The tools in this repo are free and MIT-licensed, and you don't need a SealMyApp account to use them.

## Install the MCP server

Requires Node.js 20+ and git. The first run downloads and builds the package from GitHub, so it takes a little longer.

**Claude Code**

```bash
claude mcp add sealmyapp -- npx -y github:toby7979/sealmyapp-tools
```

**Claude Desktop** (`claude_desktop_config.json`: Settings → Developer → Edit Config)

```json
{
  "mcpServers": {
    "sealmyapp": {
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}
```

**Cursor** (`.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` for all projects)

```json
{
  "mcpServers": {
    "sealmyapp": {
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}
```

**VS Code** (`.vscode/mcp.json`; note the top-level key is `servers`)

```json
{
  "servers": {
    "sealmyapp": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}
```

Then ask your assistant things like *"Is a key starting sk_live_ safe in my frontend?"*, *"Give me SQL to audit RLS in my Supabase project"* or *"Run the pre-launch security checklist for my Lovable app"*.

## Tools

| Tool | Input | What it returns |
|---|---|---|
| `check_key_exposure` | `key_or_prefix` | Whether the key is public by design (Supabase anon/publishable, Stripe `pk_`, Firebase web key) or secret (`sk_live_`, `service_role`, `sk-ant-`, ...), and what to do next: rotate first if it's secret. Classified offline from the format. Pass only a prefix; the full key is never echoed back. |
| `supabase_rls_audit_sql` | none | Read-only SQL that lists tables without RLS, policies whose USING/WITH CHECK is `true`, views that bypass RLS and public buckets, plus how to read the results. |
| `rls_policy_template` | `table_kind`: `profiles` \| `posts` \| `orders` \| `messages` \| `files`; optional `owner_column` | Example owner-based policies (select/insert/update/delete with `auth.uid()`) and caveats. |
| `vibe_security_checklist` | optional `builder`: `lovable` \| `bolt` \| `cursor` \| `replit` \| `v0` \| `other` | A pre-launch checklist covering secrets, Supabase, Firebase, auth and payments, with notes for your builder. |
| `scan_my_app_instructions` | `url` | How to run a free, ownership-verified scan of an app you own at sealmyapp.com, and a link to start it. It does not call any API or start a scan. |

Every tool's output ends with a one-line link to SealMyApp's free scan.

## Cursor rule

Copy [`rules/cursor/vibe-security.mdc`](rules/cursor/vibe-security.mdc) into your project's `.cursor/rules/` folder:

```bash
mkdir -p .cursor/rules
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/rules/cursor/vibe-security.mdc -o .cursor/rules/vibe-security.mdc
```

It's set to `alwaysApply: true`. Change it to `false` if you'd rather Cursor pull it in only when the description matches the task.

## Agent Skill (Claude Code and other skill-aware agents)

Copy the [`skills/vibe-security`](skills/vibe-security) folder into `.claude/skills/` in your project (or `~/.claude/skills/` for all projects):

```bash
mkdir -p .claude/skills/vibe-security
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/skills/vibe-security/SKILL.md -o .claude/skills/vibe-security/SKILL.md
```

The agent loads it automatically when you work on keys, env vars, RLS, Firebase rules, auth or payments.

## AGENTS.md

For Codex and other agents that read `AGENTS.md`, paste the section from [`AGENTS.md`](AGENTS.md) into your project's `AGENTS.md`.

## Privacy

- The MCP server runs on your machine over stdio. No tool makes a network call, sends telemetry or reads your files. A test (`test/privacy.test.ts`) fails the build if network or file-system APIs appear in the source.
- `check_key_exposure` works from the key's format only and never tests the key against any API. Pass a prefix (for example `sk_live_`) rather than a whole key: whatever you type goes into your assistant's conversation, which is handled by your AI provider, not by this tool.
- `scan_my_app_instructions` only builds a link. Nothing is sent to SealMyApp unless you open it and start a scan yourself.

## Development

```bash
npm install      # also builds via the prepare script
npm test         # builds, then runs unit tests and a stdio test that spawns the server and lists its tools
npm run build
npm run list-tools
```

The server uses the official MCP TypeScript SDK (`@modelcontextprotocol/server`, v2) with the stdio transport. It serves both 2025-era clients and the 2026-07-28 protocol.

## Contributing

Issues and pull requests are welcome, especially:

- new key formats for `check_key_exposure` (please link the provider's docs saying whether the key is publishable or secret),
- policy templates for other common table shapes,
- builder-specific checklist notes that you've checked against the builder's current UI.

Please keep the tools offline (no network calls) and add a test for any change. Never paste a real secret into an issue; a prefix is enough. Report security problems in this repo privately to hello@sealmyapp.com.

## Licence

MIT. Copyright (c) 2026 Richmond Capital Holdings Ltd. See [LICENSE](LICENSE).