
Supabase Rls Check
Read-only Supabase RLS checks: explain rules, analyze/diff SQL exports, scan public env vars.
- tools
- 2
- transport
- STDIO
- last updated
- Nov 11, 2026
Tools
2 toolsPublic tool metadata for what this MCP can expose to an agent.
analyze_sql_exportAnalyze a SQL export file of Supabase catalog metadata.
Analyze a SQL export file of Supabase catalog metadata.
No parameter schema in public metadata yet.
explain_ruleExplain the rationale, caveats, and remediation example for a rule.
Explain the rationale, caveats, and remediation example for a rule.
No parameter schema in public metadata yet.
Sponsors
Readme
supabase-rls-check
Consent-gated, read-only configuration and anonymous-exposure checks for Supabase projects (PostgreSQL 15+, Python 3.11+). No database password or service_role key required.
Why this exists
Supabase applications intentionally ship a public anon JWT or sb_publishable_ key inside browser JavaScript bundles so client code can talk directly to PostgREST (/rest/v1/) and Storage. Because every visitor can read that key from DevTools, access control depends directly on PostgreSQL Row Level Security (RLS), policy expressions, table/function grants, view options, and Storage bucket visibility—along with never bundling a service_role token in frontend code.
Details
- Repository
- github.com/tthanh2k6/supabase-rls-check
- Category
- Databases
- Package
supabase-rls-check- Transport
- STDIO
- Registry
- MCP registry, active