VibeRaven

check_github_repo({"repo":"owner/name"}) Check the Supabase migrations of a public GitHub repository for missing RLS or policies, policies that let anyone read or write every row, exposed security definer functions and Data API grant gaps. Use it when the user names or links their app repo (Lovable, Bolt, v0 and Cursor apps synced to GitHub) and has no terminal. Reads supabase/migrations/*.sql at one commit with the VibeRaven 1.8.0 SQL rules and returns finding id, severity, file, line, a link to that line, a fix and a guide link. Limits: public repositories only, up to 50 files/200 KB; cannot see the live database or private repos, does not run SQL, and does not store files.

check_supabase_migrations({"sql":"create table public.notes (id bigint);"}) Use when reviewing Supabase migration changes for missing RLS or policies, unrestricted read/write policies, exposed security definer functions and Data API grant gaps. Pass file contents: sql contains one migration's SQL text; files contains path and content for each file. Runs the VibeRaven 1.8.0 SQL rules and returns finding id, severity, file, line, a suggested fix and a guide link. For missing Data API grants, include the migration revoking default privileges or supabase/config.toml, plus browser files using supabase.from(...) (a "use client" file, or src files with package.json for Vite). Limits: supplied text only, up to 200 KB/50 files; cannot access your repository or database, does not execute SQL, and does not store or log file contents.

explain_finding({"gap_id":"rls_disabled"}) Use after a check returns a finding id, such as rls_disabled or env_var_drift, to understand and fix that VibeRaven 1.8.0 finding. Returns detection scope, impact, fix guidance and coverage limits quoted from viberaven.dev with source links. Unknown ids return found: false and known ids. For a raw error without a finding id, use search_guides. Limits: explains published rules only; does not read your repo, database or Vercel project.

launch_checklist({"stack":"nextjs-supabase-vercel"}) Use for a broad pre-launch review of a Lovable + Supabase app or a Next.js + Supabase app on Vercel. For a specific failing request, use search_guides. Returns a published manual checklist with sources and an optional local repo check (`npx -y viberaven@1.8.0 check`). Limits: checklist guidance only; does not run checks or verify dashboards, code or launch readiness.

provider_playbook({"provider":"supabase","topic":"grants"}) Use before implementing a feature that touches a provider, when setup or integration rules are needed. Returns versioned setup guidance, gotchas, dated changes, integration seams, existing repo checks and planned live checks with official sources. Available packs: supabase. Pass topic to return matching items; for a specific error use search_guides, for dated changes use recent_provider_changes. Limits: guidance only; does not connect to providers, read your project, run checks or verify that a feature works.

recent_provider_changes({"provider":"supabase","query":"42501","limit":5}) Use when a provider update may explain changed behavior, or a deployment needs review against dated provider changes. Returns candidate changes, documented errors or symptoms, fixes, date meanings and official supporting sources. Filter by provider or redacted error keywords. For general troubleshooting use search_guides; for setup use provider_playbook. Available providers: anthropic, clerk, lovable, nextjs, openai, railway, stripe, supabase, vercel. Limits: guidance only; does not read your repo, connect to providers, run fixes or verify rollout, deployment or live behavior.

search_guides({"query":"supabase tables missing rls"}) Find troubleshooting steps for exact errors in Supabase RLS, Realtime and auth; Clerk middleware and sessions; Better Auth origins and OAuth callbacks; Vercel environment variables and deployments; Stripe webhooks; or Storybook environment variables and 404s. Search published viberaven.dev guides by keywords or error text; returns up to 5 titles, URLs and short answers. Also covers Lovable + Supabase launch checks and client handoff. No match returns an empty list. Limits: searches the indexed published guides only; does not browse the web or read your project.