Supabase Security Auditor

Find security risks in your Supabase database before they become production problems.

Supabase Security Auditor is a read-only MCP server that lets your AI assistant inspect important Supabase security settings without modifying your database or reading application row data.

What it checks

RLS Coverage

Detects tables where Row Level Security is disabled while API-facing roles still have privileges.

RLS Policy Quality

Finds dangerously permissive RLS policies affecting anon, authenticated, and PUBLIC access.

Role Grants & Privileges

Detects excessive PostgreSQL privileges, including:

• RLS bypass risks
• dangerous TRUNCATE access
• schema CREATE privileges
• excessive table privileges
• column-level privilege gaps

What you get

Each audit returns:

• A security score from 0–100
• Severity totals
• Critical, High, Medium, and lower-risk issue counts
• The 3 highest-risk findings with clear explanations

This makes it easy to quickly identify where your Supabase security posture needs attention.

Available MCP tools

• health_check — Check server health
• get_server_info — View server capabilities and limitations
• list_supabase_projects — List projects available to your connected Supabase account
• run_audit — Run a read-only security audit on a Supabase project

Designed for safe inspection

The auditor is intentionally read-only.

It does not:

• modify database objects
• execute remediation SQL
• require your database password
• require a Supabase service-role key
• read application row data

You connect your own Supabase access token and remain in control of your credentials.

Good for

• Supabase developers
• AI coding agents
• indie hackers
• SaaS teams
• security reviews before launch
• checking existing Supabase projects for common authorization mistakes

Current V1 scope

The hosted V1 currently focuses on three security areas:

1. RLS coverage
2. RLS policy quality
3. PostgreSQL role grants and privileges

Checks for Auth, Storage, Functions, and other Supabase services are planned for future versions.