Supabase RLS Security Audit MCP Server

What It Does

The Supabase RLS Security Audit MCP Server is a zero-dependency Model Context Protocol server that scans GitHub repositories for Supabase/Postgres Row-Level Security (RLS) vulnerabilities.

Point any MCP-compatible client (Claude, Alexa+, etc.) at this server and ask it to audit a GitHub repo. The server scans the repo's public migrations and env files for:

• CRITICAL: Committed service_role JWTs and sb_secret_ keys (full RLS bypass)
• HIGH: RLS policies open to anon/public with USING(true)
• MEDIUM: Write-all policies for authenticated users (USING(true) WITH CHECK(true))

Every finding includes the exact file, a 30-second verify query, and the recommended fix SQL.

How It Works

1. Fetches the repo's file tree via the GitHub API
2. Identifies .env* files and .sql migration files
3. For env files: checks for committed service_role JWTs and sb_secret_ keys
4. For SQL files: parses CREATE POLICY statements, checks for permissive patterns
5. Returns severity-ranked findings as a markdown report

MCP Tools

Technical Details

• MCP spec: 2025-11-25 (Streamable HTTP transport)
• Zero dependencies: pure Node.js, no SDK, no framework
• Port: 3001 (configurable via MCP_PORT env var)
• Endpoints: POST /mcp (MCP), GET /health (health check)

Testing

Parity-tested against a Python implementation on 3 production repos:

• Azizbek18/YotoqxonaTizimi: 3 findings (2 HIGH, 1 MEDIUM) — confirmed
• antifailure/antifailure: 0 findings (clean) — confirmed
  
• pixelsock/mtxProductConfig: 2 findings (2 CRITICAL) — confirmed

Links

• GitHub: https://github.com/cekuu35/alexa-mcp-server
• Demo video: https://vimeo.com/1234345356

Track

Alexa+ (MCP Server, spec 2025-11-25, Streamable HTTP)

Mini Challenges

• Open Source: github.com/cekuu35/alexa-mcp-server (MIT License)
• AWS Builder: Planned integration with Amazon Bedrock for LLM-powered analysis of findings

Built With

• amazon-alexa+
• mcp
• mcp-server
• node.js
• postgresql
• security
• supabase
• typescript
• zero-dependency