mcpField
A
Airlock RLS

Airlock RLS

Local
shipsealed.comSecurity0Updated 2w ago
RepositoryVisit website

About Airlock RLS

Airlock RLS is an MCP server for developers building Supabase apps, checking deployed sites for exposed keys and databases for RLS issues. It scans public page assets and audits database catalog metadata without reading row data.

Key features

  1. 01Scan pages and JS bundles for service_role keys
  2. 02Audit disabled or overly permissive RLS policies
  3. 03Check anon/authenticated tenant data leaks
  4. 04Read catalog metadata only during audits
  5. 05Avoid printing full keys when detected

Use cases

  1. 01Check deployed front ends for leaked Supabase keys
  2. 02Verify that database tables have RLS enabled
  3. 03Investigate cross-tenant access policy issues

MCP support

The MCP server exposes tools for site key scans and Supabase RLS audits to MCP clients.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "mateuszingano-airlock-rls": {
      "command": "npx",
      "args": [
        "-y",
        "airlock-rls-mcp"
      ]
    }
  }
}
Run commandnpx -y airlock-rls-mcp

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmairlock-rls-mcp0.1.1

Tools

2

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
site_urlstringYesPublic https URL of the deployed site to scan (e.g. https://myapp.com). Only public http(s) hosts are allowed.
max_scriptsintegerNoHow many JS bundles to read (default 50). If the site has more, the result says how many went unscanned instead of implying it looked at all.

Details

From the project README

Airlock RLS MCP — Supabase leak checks inside your AI coding agent

Let Cursor, Claude Code, or any MCP client check a Supabase app for leaks while it builds it. It catches the most common vibe-coding footgun: a service_role key shipped to the browser, and Row Level Security that's off or wide open.

The engine is Airlock RLS (npm i airlock-rls), the CI gate for Supabase RLS. This package is a thin MCP wrapper around it.

Two tools

scan_site_for_exposed_key — give it a deployed URL. It reads the page and its JS bundles for an exposed Supabase service_role key (a service_role JWT or an sb_secret_... key). No database, no credentials, just the public URL. A hit means anyone who reads it bypasses every RLS policy. It never prints the full key.

audit_supabase_rls — give it a Postgres connection string. It fails on RLS-off tables, permissive (always-true) policies, and anon/authenticated tenant leaks. It reads only catalog metadata (pg_tables, pg_policies, grants), never your row data, so a read-only role is enough.

Add it to your MCP client

{
  "mcpServers": {
    "airlock": {
      "command": "npx",
      "args": ["-y", "airlock-rls-mcp"]
    }
  }
}

That's the same block for Cursor (~/.cursor/mcp.json), Claude Desktop (claude_desktop_config.json) and other MCP clients. With Claude Code:

claude mcp add airlock -- npx -y airlock-rls-mcp

Then ask the agent things like "scan https://myapp.com for an exposed Supabase key" or "audit the RLS on this database" and it calls the tools.

Requirements

Node.js 18 or newer.

Develop

npm install
npm run smoke   # starts the server and checks both tools are advertised

More

Guides on Supabase RLS, a live cross-tenant demo, and the hosted Airlock Monitor (continuous checks of your live database): shipsealed.com

License

MIT © Mateus Zingano

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.