Securealy

Name: Securealy
Author: securealy.com

本地服务

securealy.com安全06 天前更新

代码仓库访问官网

关于 Securealy

从攻击者和客户的视角评估 URL；扫描代码仓库；检查 Supabase、Stripe 和 Vercel。

配置

本地服务的配置在各客户端中通用，复制后粘贴到客户端的 MCP 配置文件即可。

mcp.json · 通用配置

{
  "mcpServers": {
    "com-securealy": {
      "command": "npx",
      "args": [
        "-y",
        "securealy-mcp"
      ],
      "env": {
        "SUPABASE_URL": "<SUPABASE_URL>",
        "SUPABASE_SERVICE_KEY": "<SUPABASE_SERVICE_KEY>",
        "SUPABASE_MGMT_TOKEN": "<SUPABASE_MGMT_TOKEN>",
        "SUPABASE_PROJECT_REF": "<SUPABASE_PROJECT_REF>",
        "STRIPE_SECRET_KEY": "<STRIPE_SECRET_KEY>",
        "VERCEL_TOKEN": "<VERCEL_TOKEN>",
        "VERCEL_PROJECT_ID": "<VERCEL_PROJECT_ID>",
        "SECUREALY_VERCEL_DECRYPT": "<SECUREALY_VERCEL_DECRYPT>",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "<SECUREALY_SUPABASE_HOST_OVERRIDE>",
        "SECUREALY_SCAN_ROOTS": "<SECUREALY_SCAN_ROOTS>",
        "SECUREALY_NO_HISTORY": "<SECUREALY_NO_HISTORY>",
        "SECUREALY_TELEMETRY": "<SECUREALY_TELEMETRY>"
      }
    }
  }
}

启动命令npx -y securealy-mcp

需要配置的环境变量

SUPABASE_URLOptional. Your Supabase project URL, read by check_rls. Sent only to that project.

SUPABASE_SERVICE_KEY密钥Optional. Service role key for check_rls. Sent only to your Supabase project, never printed.

SUPABASE_MGMT_TOKEN密钥Optional. Supabase management token for check_rls and the auth config check. Sent only to the Supabase management API.

SUPABASE_PROJECT_REFOptional. Supabase project ref, used with SUPABASE_MGMT_TOKEN.

STRIPE_SECRET_KEY密钥Optional. Stripe secret key for check_stripe. Sent only to api.stripe.com, never printed.

VERCEL_TOKEN密钥Optional. Project-scoped Vercel token for check_vercel_env. Sent only to api.vercel.com, never printed.

VERCEL_PROJECT_IDOptional. Vercel project id for check_vercel_env.

SECUREALY_VERCEL_DECRYPTOptional. Set to 1 to let check_vercel_env fetch decrypted variable values from api.vercel.com for the trailing-newline and live-key checks. Without it only names and targets are read and those checks are reported as skipped.

SECUREALY_SUPABASE_HOST_OVERRIDEOptional. Set to 1 to let check_rls send the service key to a self-hosted Supabase URL. Without it the key is sent only to an https URL on a Supabase-hosted domain.

SECUREALY_SCAN_ROOTSOptional. Folders, separated by the OS path delimiter, that scan_repo may read in addition to the server's working directory. Anything outside is refused.

SECUREALY_NO_HISTORYOptional. Set to 1 to stop the server appending each run (grade, score, counts, failing check ids; never evidence) to .securealy/history.json in its working directory.

SECUREALY_TELEMETRYOptional, off by default. Set to 1 to send an anonymous aggregate of each run (command, grade, counts, stack kind, failing check ids; no URL, host or evidence) to securealy.com.

本地服务需要在你的电脑上安装运行环境（如 Node.js 18+）。各客户端的配置文件位置不同，请参考客户端文档。

安装包

npmsecurealy-mcp0.1.6stdio

工具

收录的工具列表 · 更新于 2 周前

参数	类型	必填	说明
url	string	是	要评估的 URL，例如 https://my-app.vercel.app。裸主机名会按 https 处理。http://localhost:3000（或 127.0.0.1、[::1]、.localhost、.test）会对本地服务进行上线前评分。
tier	enum	否	passive（默认，适用于任何 URL）或 verified（需要令牌；域名必须已在 securealy.com 验证）。passive \| verified
token	string	否	Securealy 项目令牌（sly_...）。tier 为 verified 时必填。仅通过 Bearer 标头发送到 securealy.com。
bypassToken	string	否	受保护预览环境的 Vercel 保护绕过令牌；仅作为 x-vercel-protection-bypass 发送到受评估的主机。