Open-source Database Sentinel: a read-only MCP server that audits Supabase security in Claude and Cursor
Farenhytee · reddit · 2026-09-30
A developer open-sourced Database Sentinel as a read-only MCP server (usable in Claude Code, Cursor, Claude Desktop) that audits Supabase projects for common vibe-coding mistakes: RLS disabled, USING (true) policies, publicly callable SECURITY DEFINER functions, and leaked service-role keys.
- 20 fixed audit queries (RLS, policies, grants, definer functions, buckets); schema only, never row data
- Anon-key probe answers "can a stranger read this table?" with status code and row count only
- Repo scan flags leaked service-role keys and JWT secrets by file and line
- Connects as a read-only sentinelauditor role with 5s timeout and zero write/drop tools; fixes come back as reviewable SQL
Evaluated on 25 labeled Supabase projects (10 blind-written and hash-locked as a test set), scoring F1 0.85 and catching every critical issue; found real problems on the author's own hosted projects. Install: claude plugin marketplace add Farenhytee/database-sentinel. MCP version is Supabase-only; the original skill still covers MongoDB.
More from coding & agent
- CrawlRaven launches on Product Hunt with new MCP server for Claude and Cursor — ayushtweetshere · 2026-09-30
- "Context + Harness is the new product": one tweet nails the agent stack shift — smtabatabaie · 2026-09-30
- 5 ways to cut LLM costs without changing models: optimize tokens, caching and calls — goyalshaliniuk · 2026-09-30
- Open Pstack: Codex as parent, Devin implements, Claude reviews — multi-provider agent orchestration — CombinationOk2374 · 2026-09-30
- VFX creator uses Opus 5.5 to drive Blender, freezing dancers into statues — anselm · 2026-09-30
- Cisco's 2026 campus hiring adds AI-agent project round with prompt documentation — cneuralnetwork · 2026-09-30