Rls Check

io.github.Muhandis-onlinePublished by GitHub account Muhandis-onlinev0.1.2Updated Oct 30, 2026

Read-only Supabase RLS check: explains in Arabic which tables anyone can read or change. No keys.

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedSTDIODesktop onlyDatabasesSecurity & Monitoring

Overview

AI-generated overview

Read-only Supabase RLS auditor: hands the assistant a SQL query to run, then explains the result table by table in Arabic, without keys or a database…

What you can do
  • Get a read-only SQL query listing every table and view in a Supabase project's public schema with RLS state, anon/authenticated grants, column names and policies.
  • Explain a pasted query result table by table, worst first: exposed, check it, locked or safe.
  • Flag tables anyone with the public anon key can read or change, and tables where any signed-in user can read other users' rows.
  • Attach English labels and links to Arabic fix lessons for non-technical founders.
When to use it
Useful when reviewing a Supabase project's row-level security and you want a plain-language, Arabic explanation of which tables leak customer data. Suits founders or small teams who can run a query in the SQL Editor or through a Supabase MCP tool but do not want to read policies themselves.
Requirements
Runs locally via npx (Node.js) over stdio; no API keys, passwords or environment variables. You must run the returned query yourself in the Supabase SQL Editor or through a Supabase MCP execute_sql tool and pass the result back. Desktop MCP client only.
Before you install
The query output includes schema details such as table names, column names, grants and policy definitions; pasting it into the assistant sends that metadata to the model. The server itself opens no database connection and reads no rows. Findings are advisory and do not replace testing with two accounts.

Installation

In SourceWeft

  1. Open Rls Check in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

RLS check for Supabase: who can read your customers' data?

A read-only query you run in your own Supabase SQL Editor, and an analyser that explains the result table by table:

  • which tables anyone with the public (anon) key can read or change;
  • which tables let any signed-in user read other users' rows;
  • which tables are locked, and which are safe.

The findings are written in Arabic for non-technical founders, with English labels (exposed, check it, locked, safe), and each one links to an Arabic lesson on the fix.

  • It reads no data. The query reads table descriptions only: RLS state, policies, grants and column names. Never a row.
  • It needs no key or password and opens no connection to your database. You run the query yourself, or an agent runs it through the official Supabase MCP.
  • It is the same check as the browser tool at muhandis.online/tools/rls-check: lib/rls-check.js is the site's analyser, copied byte for byte.

Usage

1. In the browser (easiest)

Open the check page, copy the query, run it in Supabase and paste the result. Everything happens in your browser; nothing is sent anywhere.

2. From the command line

bash
npx muhandis-rls-check query > query.sql     # the query: run it in your SQL Editornpx muhandis-rls-check result.json           # paste the result cell into a file; this explains itnpx muhandis-rls-check result.json --json    # the same explanation as JSON

It exits with 1 when a table is exposed, so it can be a CI step.

3. For an AI assistant (MCP)

Add it to Claude, Cursor or any MCP client. The assistant runs the query (through the official Supabase MCP, for example) and this server explains the result. The server itself holds no connection details.

json
{  "mcpServers": {    "muhandis-rls-check": { "command": "npx", "args": ["-y", "muhandis-rls-check", "mcp"] }  }}

Tools: rls_check_query returns the query, rls_check_explain explains a result.

4. As a Claude skill

The same check as a Claude skill: Claude gives you the query, then runs the pasted result through skills/rls-check/scripts/rls_check.py, a Python copy of the analyser that the tests hold to the same output as lib/rls-check.js. It needs no key and makes no network call.

  • Claude app: download rls-check.zip from the latest release, then Customize > Skills, upload it and turn it on. Code execution must be enabled.
  • Claude Code:
/plugin marketplace add Muhandis-online/rls-check/plugin install rls-check@muhandis

What it checks

LabelArabicMeaning
exposedمكشوفRLS is off and the visitor role has a grant; or a policy whose condition is true on a table with personal columns; or a view without security_invoker that visitors can read; or an update or delete policy open to everyone
check itتأكد منهData everyone can read that has no personal columns, such as a product list; or inserts without sign-in, such as a contact form
lockedمقفولRLS on with no policies, or no grants: the app cannot reach it
safeسليمPolicies tied to the row's owner through auth.uid()

Personal columns are recognised by name (email, phone, user_id, iban, national, iqama and similar).

Limits

This checks the rules you can see; it does not replace a test. After it, sign in with two accounts and confirm each one sees only its own rows. Supabase's own Security Advisor flags related issues (RLS disabled, security-definer views, permissive policies); this tool adds an explanation in Arabic for the product's owner, and a link to how to fix each finding.

Found an exposed table and want an engineer to fix it with you? muhandis.online/services/fix

Made by Muhandis, a software company for businesses in Saudi Arabia and the GCC. MIT licence.

Source: README.md at commit 676f5a9

Tools

2

rls_check_query

RLS check: the read-only query

Returns a read-only SQL query that lists every table and view in the public schema of a Supabase (Postgres) project with its RLS state, grants to anon/authenticated, column names and policies. It reads no row of data. Run it in the project (SQL Editor, or a Supabase MCP execute_sql tool), then pass the single JSON result cell to rls_check_explain.

Takes no parameters.

rls_check_explain

RLS check: explain the result

Explains the output of rls_check_query table by table, worst first: which tables anyone with the public (anon) key can read or change, which any signed-in user can read across users, which are locked, which are safe. Findings are in Arabic for founders (labels also given in English) and link to Arabic lessons on muhandis.online. Works offline on the pasted result.

Parametersresultrequired

Version history

2
  1. v0.1.2LatestOct 30, 2026
  2. v0.1.1Oct 29, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Business & Commerce4 toolsOct 30, 2026

HTTP Header Policy Check — HSTS, CSP & Frame Declarations

Published by GitHub account kriton-dev

Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.

Streamable HTTPWeb executableAuth
Security & MonitoringCredential requiredNov 7, 2026

VOOPA Render Check

Published by GitHub account Voopa-Corp

Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.

Streamable HTTPWeb executable
AI & ML2 toolsNov 7, 2026

United Kingdom Company Check

Published by GitHub account JusticeUA

Remote MCP server that lets an assistant run UK company checks — status, insolvency, LEI and sanctions data from official registers.

Streamable HTTPWeb executableAuth
Business & CommerceCredential requiredNov 7, 2026