mcpField
S
Securealy

Securealy

Local
securealy.comSecurity0Updated 6d ago
RepositoryVisit website

About Securealy

Grade a URL as an attacker and a customer would see it; scan a repo; check Supabase, Stripe, Vercel.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "com-securealy": {
      "command": "npx",
      "args": [
        "-y",
        "securealy-mcp"
      ],
      "env": {
        "SUPABASE_URL": "<SUPABASE_URL>",
        "SUPABASE_SERVICE_KEY": "<SUPABASE_SERVICE_KEY>",
        "SUPABASE_MGMT_TOKEN": "<SUPABASE_MGMT_TOKEN>",
        "SUPABASE_PROJECT_REF": "<SUPABASE_PROJECT_REF>",
        "STRIPE_SECRET_KEY": "<STRIPE_SECRET_KEY>",
        "VERCEL_TOKEN": "<VERCEL_TOKEN>",
        "VERCEL_PROJECT_ID": "<VERCEL_PROJECT_ID>",
        "SECUREALY_VERCEL_DECRYPT": "<SECUREALY_VERCEL_DECRYPT>",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "<SECUREALY_SUPABASE_HOST_OVERRIDE>",
        "SECUREALY_SCAN_ROOTS": "<SECUREALY_SCAN_ROOTS>",
        "SECUREALY_NO_HISTORY": "<SECUREALY_NO_HISTORY>",
        "SECUREALY_TELEMETRY": "<SECUREALY_TELEMETRY>"
      }
    }
  }
}
Run commandnpx -y securealy-mcp
Environment variables to set
SUPABASE_URLOptional. Your Supabase project URL, read by check_rls. Sent only to that project.
SUPABASE_SERVICE_KEYSecretOptional. Service role key for check_rls. Sent only to your Supabase project, never printed.
SUPABASE_MGMT_TOKENSecretOptional. Supabase management token for check_rls and the auth config check. Sent only to the Supabase management API.
SUPABASE_PROJECT_REFOptional. Supabase project ref, used with SUPABASE_MGMT_TOKEN.
STRIPE_SECRET_KEYSecretOptional. Stripe secret key for check_stripe. Sent only to api.stripe.com, never printed.
VERCEL_TOKENSecretOptional. Project-scoped Vercel token for check_vercel_env. Sent only to api.vercel.com, never printed.
VERCEL_PROJECT_IDOptional. Vercel project id for check_vercel_env.
SECUREALY_VERCEL_DECRYPTOptional. Set to 1 to let check_vercel_env fetch decrypted variable values from api.vercel.com for the trailing-newline and live-key checks. Without it only names and targets are read and those checks are reported as skipped.
SECUREALY_SUPABASE_HOST_OVERRIDEOptional. Set to 1 to let check_rls send the service key to a self-hosted Supabase URL. Without it the key is sent only to an https URL on a Supabase-hosted domain.
SECUREALY_SCAN_ROOTSOptional. Folders, separated by the OS path delimiter, that scan_repo may read in addition to the server's working directory. Anything outside is refused.
SECUREALY_NO_HISTORYOptional. Set to 1 to stop the server appending each run (grade, score, counts, failing check ids; never evidence) to .securealy/history.json in its working directory.
SECUREALY_TELEMETRYOptional, off by default. Set to 1 to send an anonymous aggregate of each run (command, grade, counts, stack kind, failing check ids; no URL, host or evidence) to securealy.com.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmsecurealy-mcp0.1.6

Tools

9

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
urlstringYesThe URL to grade, for example https://my-app.vercel.app. A bare hostname is treated as https. http://localhost:3000 (or 127.0.0.1, [::1], *.localhost, *.test) gives a pre-launch grade of a local server.
tierenumNopassive (default, works on any URL) or verified (needs token; domain must be verified at securealy.com).passive | verified
tokenstringNoSecurealy project token (sly_...). Required for tier verified. Sent only to securealy.com as a Bearer header.
bypassTokenstringNoVercel protection bypass token for a protected preview; sent only to the graded host as x-vercel-protection-bypass.

Details

The maintainer has not added details yet. Check the README in the repository.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.