PostureBase

Inspiration

Supabase makes it extremely fast to build a backend, but security misconfigurations can remain invisible during development. Missing RLS protection, exposed privileged functions, weak Auth settings, public Storage buckets, and leaked keys may not break an application, so developers can ship them without noticing.

I wanted a simple security preflight that developers could run before shipping, without relying on an AI model to guess whether their project is secure.

What it does

PostureBase is a deterministic, local, read-only security scanner for Supabase projects.

It checks database metadata, RLS policies, privileged functions, views, Storage configuration, Auth settings, rate limits, extensions, and local source files. Every finding contains a stable rule ID, severity, evidence, confidence, and remediation guidance.

PostureBase works as both a terminal tool and a local MCP server for Codex, Claude Code, and OpenCode. The coding agent can read and explain the structured findings while every change remains under the developer's control.

PostureBase does not require a hosted backend, does not include credentials in reports, does not use AI to decide what is secure, and never automatically changes the Supabase project.

How I built it

The scanner core was built in Python using direct PostgreSQL metadata queries and the Supabase Management API. The same deterministic scanner powers both the terminal interface and the MCP integration.

A guided setup flow stores credentials in a private, ignored local profile. Client-specific installers configure Codex, Claude Code, and OpenCode to launch PostureBase locally over stdio.

The project includes automated tests and cross-platform GitHub Actions coverage for Windows and Linux.

Challenges I faced

The biggest challenges were keeping credentials out of agent configuration and reports, handling Supabase Session Pooler connections reliably, and safely updating the different configuration formats used by Codex, Claude Code, and OpenCode.

It was also important to ensure that terminal scans and MCP scans always produced the same findings.

Accomplishments

• A working deterministic Supabase security scanner
• Read-only database and Management API inspection
• Local MCP integration with Codex, Claude Code, and OpenCode
• Guided credential setup without exposing secrets to agents
• Human-readable and structured JSON reports
• 18 automated tests across Windows and Linux
• A verified public v0.1.0 release

What I learned

I learned how MCP servers communicate with coding agents through local stdio and how to design security tooling where deterministic analysis is separated from AI-assisted explanation.

What's next

Future versions can expand rule coverage, add more configurable security policies, improve CI reporting, and provide easier package installation while preserving the local, deterministic, and read-only security model.

Built With

• actions
• claude
• code
• codex
• cybersecurity
• github
• mcp
• modelcontextprotocol
• opencode
• postgresql
• python
• supabase
• uv