RowAttest

com.rowattestPublished by rowattest.comOfficial publisherv1.0.1Updated Oct 29, 2026

Runs an eight-stage isolation test against your staging Supabase and issues a signed attestation.

VerifiedStreamable HTTPWeb executableDatabasesSecurity & Monitoring

Overview

AI-generated overview

RowAttest runs eight-stage authorization isolation tests against a connected staging Supabase project and returns signed attestation reports.

What you can do
  • List connected Supabase projects with connection state and readiness
  • Start an authorization test run on a project and get its run_id and status
  • Poll or wait for a run's status, stage and timestamps, and get its verify link
  • Read the cells that did not pass, with verdicts, tenancy flags and blocking findings
  • Fetch the full signed report JSON with its verify link and report fingerprint
When to use it
Useful when you are hardening Supabase row-level security or access policies on a staging or test project and want an assistant to run isolation tests, read the failing cells, adjust policies and re-run until the results are clean.
Requirements
A remote endpoint at app.rowattest.com; no local package. A RowAttest account with at least one connected Supabase project, and an API key sent in the Authorization header, created on the API keys page in the RowAttest app.
Before you install
The account owner agrees to connect staging or test projects only, not production databases with real customer data. Runs that do not fail count against the monthly allowance, so repeated runs consume quota. Results from runs without a signed report are unverified and should be described as such. The API key is a credential sent in the Authorization header.

Installation

In SourceWeft

  1. Open RowAttest in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.rowattest%2Frowattest/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "rowattest": {
      "type": "http",
      "url": "https://app.rowattest.com/mcp"
    }
  }
}

Tools

6

list_projects

Lists the Supabase projects connected to this account with id, name, connection state and whether each is ready to run. Call this first to get a project_id.

Takes no parameters.

run_review

Starts an authorization test run on a connected project and returns the run_id and status. If the project already has a run waiting to start, returns that run instead of starting another. Runs that do not fail count against the monthly allowance.

Parametersproject_idrequired

get_run_status

Returns a run's status (queued, running, complete or failed), its current stage, timestamps and, when a signed report exists, its verify_url.

Parametersrun_idrequired

wait_for_run

Waits up to timeout_seconds (1 to 60) for a run to finish, then returns the same information as get_run_status. Call it again while the status is still queued or running.

Parametersrun_idrequiredtimeout_seconds

get_findings

Returns the cells that did not pass in a complete run that has a signed report — verdict, surface, operation, boundary, identity, layer outcomes and notes — plus tenancy flags, blocking findings and, when the report includes catalog hygiene checks, the hygiene block (the checks run, each finding's check, severity, object, detail and hint, and any check not run). For a complete run with no signed report, while one can still be bought on the run page, it returns the run's unverified result instead: the verdict, surface, operation and principal of each cell that did not pass, the run page's finding lines, the counts, the coverage lines, the access model summary and the same hygiene block. The list of cells is empty when every tested cell passed. Cell results contain no fix suggestions: the engine records only what it observed. Hygiene findings are catalog observations, never verdicts; each carries the engine's one-line hint for the project owner's review.

Parametersrun_idrequired

get_report

Returns the full signed report of a complete run as the exact stored JSON, with its verify_url and report_sha256 (sha256 of the canonical signed bytes, the fingerprint shown on the verify page). Use get_findings for the compact view.

Parametersrun_idrequired

Version history

2
  1. v1.0.1LatestOct 29, 2026
  2. v1.0.0Oct 10, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.