Content
# supabase-security-mcp
> The only Supabase security tool that **closes the loop in your AI agent**.
> Audit, preview the fix, and apply it — without leaving Claude / Cursor / Cline.
```
You: audit my supabase project rkmrsefraqssuyuniyco
Claude: Found 17 critical leaks. Want me to apply all SQL fixes?
Run preview_fix on each first?
You: preview them all, then apply if safe.
Claude: [previews each]
All 17 fixes preview cleanly. Applying...
Done. Re-audited: 0 critical findings remaining.
```
Other Supabase scanners (SupaExplorer, AuditYourApp, Vibe App Scanner) **report**. None of them remediate. This one does.
## Tools
| Tool | What it does |
|---|---|
| `audit_project` | Scan a project. Returns JSON findings. Caches for follow-up tools. |
| `list_findings` | List cached findings, optionally filter by severity. |
| `preview_fix` | Wrap the fix SQL in `BEGIN; ... ROLLBACK;` and verify it would run. Safe. |
| `apply_fix` | Actually apply one finding's fix. Requires `confirm: true`. Re-audits to verify. |
| `apply_all_fixes` | Bulk-apply at or above a severity. Single transaction — all or nothing. |
## Install
### Claude Desktop / Claude Code
Add to your MCP config (`~/.claude.json` or `claude_desktop_config.json`):
```json
{
"mcpServers": {
"supabase-security": {
"command": "npx",
"args": ["-y", "@perufitlife/supabase-security-mcp@latest"],
"env": {
"SUPABASE_ACCESS_TOKEN": "sbp_your_personal_access_token"
}
}
}
}
```
Get a token at https://supabase.com/dashboard/account/tokens (read+write to your projects).
### Cursor
`Settings → MCP → Add new MCP server` → paste the same JSON object as above.
### Cline / Continue / etc.
Anything that supports MCP stdio servers will work — point it at `npx -y @perufitlife/supabase-security-mcp@latest` with the env var set.
## Safety model
- **Never auto-applies.** Every `apply_fix` and `apply_all_fixes` call requires `confirm: true`.
- **Preview before apply.** `preview_fix` runs the SQL inside `BEGIN; ... ROLLBACK;` so you see if it would error before touching state.
- **All-or-nothing bulk apply.** `apply_all_fixes` runs everything in a single transaction. If any statement fails, the entire change rolls back.
- **Re-audit after apply.** Every `apply_fix` re-runs the audit and reports whether the finding is actually gone — protects against fix-that-doesn't-fix.
- **Read-only by default for `audit_project`.** Token can be a read-only PAT if you only want to scan, never remediate. (For `apply_fix`, you need write access.)
## What it scans
Inherits all checks from [supabase-security-skill](https://github.com/Perufitlife/supabase-security-skill):
- Tables with RLS disabled and direct anon grants
- `SECURITY DEFINER` functions executable by anon
- Public storage buckets
- Default privileges still granting CRUD to anon
- Auth signups with autoconfirm enabled
- Defense-in-depth: RLS-locked tables with stale anon grants
## Why MCP and not just a CLI
CLIs are great. They're not in your AI agent's context. When you're vibing with Claude in your IDE, asking "is my supabase tight?" should get an actual scan, not a "you should run this command on your laptop."
The flow this enables:
1. *"Add a `subscriptions` table to my schema."* → agent does it
2. *"Now scan for security issues."* → agent calls `audit_project`
3. *Agent notices the new table has no RLS.*
4. *"Want to fix?"* → `preview_fix`, then `apply_fix` after you say yes.
That round-trip is the actual product. The audit is just step 2.
## Roadmap
- [ ] Cron job audit (`pg_cron`)
- [ ] Edge function secrets scan
- [ ] Storage object-level RLS scan
- [ ] HTML report generation as a tool (returns base64 + filename)
- [ ] CORS configuration check
## License
MIT.
