Explore
Evidence for your next connection.
Independent measurements of remote MCP servers. Every observation has a timestamp.
Read-only probesMCP server · Database
Security checks for Next.js + Supabase apps: code scan, read-only live DB check, fix confirmation.
0 failed · 7 not measured
Median of successful probes over 7 days
Share of countable probes over 30 days, including daily rollups. Auth challenges are excluded.
Tool definitions returned by this server
Independent monitoring
Responded
The server completed its last measured handshake. This is an observation, not a guarantee.
Last checked| Test area | Passed | Failed | Unmeasured |
|---|---|---|---|
ConnectionCan a client connect and discover tools? | 5 | 0 | 0 |
Reliability & speedDoes it respond consistently and quickly? | 1 | 0 | 3 |
Access & authenticationWhat is required to use this server? | 1 | 0 | 2 |
Tool qualityAre the tool definitions usable by an agent? | 4 | 0 | 0 |
Publisher identityCan the publisher be traced to its source? | 4 | 0 | 2 |
Unmeasured means there is not enough evidence to decide. How these checks work
Start using GuardLayer
Choose your client, copy the configuration, then enable the server in your client’s MCP settings.
Run this command in your terminal, then restart Claude Code.
Claude Code
claude mcp add --transport http guardlayer https://www.guardlayer.io/api/mcpCapabilities
Checks the JSON from get_supabase_snapshot_sql: tables anyone can read, RLS off, policies that only check for a signed-in user (public in practice when sign-ups are open), users who can update their own role or plan columns, exposed SECURITY DEFINER functions, public buckets. Pass auth_config (the project's Auth settings) when you can: it decides whether 'any signed-in user' means anyone. Pass previous_issue_keys from an earlier result to see what is closed, still open or new. Returns each issue with its SQL fix and a fix prompt.
DiscoveredReturns the read-only SQL for the live Supabase check and how to run it. It reads only catalog metadata (table and column names, RLS flags, policies, grants, triggers, SECURITY DEFINER functions, bucket settings), never table rows, and returns one JSON value.
DiscoveredStatic security scan of a Next.js + Supabase codebase: secrets in code or public env vars (NEXT_PUBLIC_, VITE_), service role keys in client code, RLS off or open policies in supabase/migrations, unauthenticated API routes, Server Actions and Edge Functions, unsafe redirects and more. Send source files (ts, tsx, js, jsx, sql, .env*, config files) with paths relative to the project root; skip node_modules, build output and lockfiles. Up to 300 files and 4 MB per call; split bigger projects. Files are scanned in memory and discarded.
DiscoveredRecent measurements
| Checked | Result | Response | Tools |
|---|---|---|---|
| Connected | 520 ms | 3 | |
| Connected | 1021 ms | 3 |