Securealy

Securealy is a local MCP server that grades a URL from attacker and customer perspectives and checks a repo, Supabase, Stripe and Vercel configurations.

What you can do

Grade a URL as an attacker and as a customer would see it, producing a grade, score and failing check ids for a run. Scan a repository, reading the working directory plus any extra folders listed in SECUREALY_SCAN_ROOTS. Check Supabase row-level security and auth configuration using a management token, project ref, URL and service key. Check Stripe configuration with a secret key. Check Vercel environment variables, optionally fetching decrypted values. Optionally append a run summary to a local history file and send anonymous aggregate telemetry.

When to use it

Useful when you want an assistant to audit a deployed site or repository for security and configuration problems, or to verify Supabase, Stripe and Vercel settings before or after a release.

Requirements

Runs locally over stdio via npx from the npm package securealy-mcp, so Node.js is needed. Optional credentials: STRIPE_SECRET_KEY, SUPABASE_MGMT_TOKEN, SUPABASE_SERVICE_KEY, VERCEL_TOKEN, plus SUPABASE_PROJECT_REF, SUPABASE_URL and VERCEL_PROJECT_ID. Network access to the relevant provider APIs is required for those checks.