Skip to content
Agentmart
Submit a tool

Flare

Scan a running app or repo for leaked secrets, exposed routes and open RLS, and verify live keys

Connector by flarehq.dev · Domain verified by the MCP Registry

IndexedLicense unknownLocal (stdio)
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/flarehq-dev-security

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Scan a running app or repo for leaked secrets, exposed routes and open RLS, and verify live keys

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
4 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
Not scanned yet
Runs as
Node.js package

Tools by what they do 4

Read from the source code; the running server may list different tools.

Read 4 · Look things up without changing anything.

  • flare_authz_test
  • flare_scan_repo
  • flare_scan_url
  • flare_verify_credential

Tools (4)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • flare_authz_testTest for broken object-level authorization (IDOR) across two accountsread-only

    Detects the top OWASP API risk — objects readable by accounts that do not own them (IDOR), and privileged routes reachable by non-privileged accounts. Give it URLs that return one account's objects plus the session headers for TWO different accounts, and it requests each URL as the other account and compares. A finding is reported ONLY when the second account receives the first account's exact data — an API that safely scopes the response to its own caller is correctly reported as safe. Reads only: it sends GET requests and never creates, changes or deletes anything. LOCALHOST ONLY for now (ht…

  • flare_scan_repoScan a local repository for committed secrets and unsafe migrationsread-only

    Runs Flare's deep source scan over a local directory: committed credentials, .env handling, unsafe SQL migrations (disabled RLS, allow-all policies), unprotected route handlers, and dependency issues. Findings include file and line so they can be fixed directly. Reads the filesystem only; nothing is uploaded.

  • flare_scan_urlScan a running app for exposed secrets and misconfigurationsread-only

    Runs Flare's full external security scan against a URL and returns ranked findings with fixes. Works against localhost (e.g. http://localhost:3000), so you can start the dev server and scan it before the code ever ships. Checks: secrets in bundles (each verified live against the issuing provider), secrets leaked through React Server Component props, NEXT_PUBLIC_ misuse, tokens in URLs, Supabase/Firebase table & storage exposure, unauthenticated and shadow API routes, unauthenticated LLM proxies, security headers, exposed .env/.git files, and SPF/DMARC. All checks are read-only.

  • flare_verify_credentialCheck whether a credential is still liveread-only

    Given a credential you have already found, checks whether it still authenticates by making a single read-only identity request to the provider that issued it (OpenAI, Anthropic, Stripe, GitHub, Slack, Google, or a Supabase service_role JWT). Non-billable and non-mutating: no model calls, no writes. Use this to tell a real incident from an already-rotated key before alarming the user. The credential is sent only to its own issuer.

Signals

Last release
Aug 13, 2026 (2 months ago)

Details

Registry name
dev.flarehq/security
Version
0.2.1
Auth
No auth
Packages
npm flarehq-mcp
License
License unknown
Website
flarehq.dev/mcp
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registry
Cite this page

Flare MCP server. Agent Mart. https://agentmart.dev/connectors/flarehq-dev-security (last updated 2026-10-24)