Airlock RLS

io.github.mateuszinganoPublished by GitHub account mateuszinganov0.1.1Updated Oct 27, 2026

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security.

VerifiedSTDIODesktop onlyDatabasesDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP wrapper that scans a deployed site for an exposed Supabase service_role key and audits Row Level Security on a Supabase database.

What you can do
  • Scan a deployed URL and its JS bundles for an exposed Supabase service_role JWT or sb_secret_ key, without printing the full key
  • Audit a Postgres database's RLS using only catalog metadata: flags RLS-off tables, always-true policies, and anon/authenticated tenant leaks
  • Report findings back to the coding agent so it can fix leaks while building the app
When to use it
Useful when building or reviewing a Supabase-backed app and you want the agent to check a deployed site for a leaked service_role key or verify that Row Level Security is enabled and not wide open.
Requirements
Runs locally over stdio via npx (Node.js 18 or newer). The key scan needs only the public site URL; the RLS audit needs a Postgres connection string, for which a read-only role is said to be enough.
Before you install
The RLS audit requires a Postgres connection string, a credential that grants database access; prefer a read-only role. The scan fetches the target site and its JS bundles over the network. Findings may reveal security weaknesses, and the README points to a separate hosted monitoring product.

Installation

In SourceWeft

  1. Open Airlock RLS in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Airlock RLS MCP — Supabase leak checks inside your AI coding agent

Let Cursor, Claude Code, or any MCP client check a Supabase app for leaks while it builds it. It catches the most common vibe-coding footgun: a service_role key shipped to the browser, and Row Level Security that's off or wide open.

The engine is Airlock RLS (npm i airlock-rls), the CI gate for Supabase RLS. This package is a thin MCP wrapper around it.

Two tools

scan_site_for_exposed_key — give it a deployed URL. It reads the page and its JS bundles for an exposed Supabase service_role key (a service_role JWT or an sb_secret_... key). No database, no credentials, just the public URL. A hit means anyone who reads it bypasses every RLS policy. It never prints the full key.

audit_supabase_rls — give it a Postgres connection string. It fails on RLS-off tables, permissive (always-true) policies, and anon/authenticated tenant leaks. It reads only catalog metadata (pg_tables, pg_policies, grants), never your row data, so a read-only role is enough.

Add it to your MCP client

json
{  "mcpServers": {    "airlock": {      "command": "npx",      "args": ["-y", "airlock-rls-mcp"]    }  }}

That's the same block for Cursor (~/.cursor/mcp.json), Claude Desktop (claude_desktop_config.json) and other MCP clients. With Claude Code:

bash
claude mcp add airlock -- npx -y airlock-rls-mcp

Then ask the agent things like "scan https://myapp.com for an exposed Supabase key" or "audit the RLS on this database" and it calls the tools.

Requirements

Node.js 18 or newer.

Develop

bash
npm installnpm run smoke   # starts the server and checks both tools are advertised

More

Guides on Supabase RLS, a live cross-tenant demo, and the hosted Airlock Monitor (continuous checks of your live database): shipsealed.com

License

MIT © Mateus Zingano

Source: README.md at commit c4fdef2

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestOct 14, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts