Securealy

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/securealy-com-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

8 read · 1 write · 0 delete

Secrets

4 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Node.js package

Tools (9)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_rlsCheck Supabase RLS and auth configread-only

  Run rls-policies and supabase-auth-config against the user's own Supabase project using credentials already in this server's environment: SUPABASE_URL plus SUPABASE_SERVICE_KEY (or SUPABASE_SERVICE_ROLE_KEY), or SUPABASE_MGMT_TOKEN plus SUPABASE_PROJECT_REF. rls-policies lists tables in the public schema with row level security off or with permissive policies; supabase-auth-config reads the auth settings (open signup, email confirmation, OTP expiry). Each value is trimmed, sent only to that Supabase project, and never appears in the output. The service key is sent only to an https URL on a Sup…

• check_stripeCheck Stripe webhook wiringread-only

  Run stripe-webhook-wiring with STRIPE_SECRET_KEY from this server's environment: confirms a live-mode key is in use, that at least one enabled webhook endpoint points at the production host, and that it subscribes to the checkout and subscription events. The key is trimmed, sent only to api.stripe.com, and never appears in the output. Provide productionHost so the endpoint host can be compared.

• check_vercel_envCheck Vercel environment hygieneread-only

  Run vercel-env-hygiene with VERCEL_TOKEN (a project-scoped token is enough) and VERCEL_PROJECT_ID from this server's environment, or the project id passed here. Reports secret-looking variables exposed to the browser through a NEXT_PUBLIC_ or VITE_ prefix, test keys in production, and production values missing from preview. The token is trimmed, sent only to api.vercel.com, and never appears in the output. Variable values are fetched only when SECUREALY_VERCEL_DECRYPT=1 is set in the environment; without it the checks that need values (trailing newlines, live keys outside production) are repor…

• fetch_fixFetch the fix for a checkread-only

  Fetch the published fix for a check id from securealy.com (GET /checks/<id>.json): the catalogue entry plus the fix text the caller is entitled to. Sends only the check id. If the fix endpoint is not available yet, returns the catalogue entry and the fix page URL to read instead.

• get_checkLook up a checkread-only

  Return the catalogue entry for a check id (category, title, severity, tier, what passing means, why it matters, whether the fix is published free) plus the public fix page URL. Use it to explain a failing check to the user before fetching the fix. Local, no network.

• grade_urlGrade a URLread-only

  Grade a website the way an attacker and a customer would see it, in under a minute. Passive tier (default) runs locally in this process and only does what a browser does when a visitor opens the site, plus DNS and TLS lookups: at most 25 requests, no probing, no credential use; it works on any public URL, including preview deployments. A URL on localhost, 127.0.0.1, [::1], *.localhost or *.test (plain http is fine) gives a pre-launch grade of the app running on this machine: the result carries preLaunch: true, checks that need a public domain (TLS, HSTS, DNS, email, domain, Stripe live key) ar…

• list_checksList the check catalogueread-only

  List every check Securealy runs, optionally filtered by category or tier, with severity and the one-line meaning of a pass. Local, no network.

• post_resultPost a local result to Securealy

  Store a GradeResult from a local check (scan_repo, check_rls, check_stripe, check_vercel_env) against the user's Securealy project so it shows in their dashboard. Sends the result and the project token (as a Bearer header) to securealy.com and nothing else. Only call this when the user has asked for the result to be posted.

• scan_repoScan a repositoryread-only

  Run the three local repository checks on a source folder: repo-secrets (secret-shaped strings in the working tree and git history), gitignore-env-coverage (every .env variant ignored) and env-example-parity (.env.example lists every variable the code reads, with no real values). Runs entirely on this machine; nothing is sent anywhere. Findings show a six-character prefix of any secret, never the value. Folder trust: the first call for a path returns a confirmation request instead of results. Show the user the absolute path and call again with trust: true once they confirm it is their project. …

Signals

Stars

0

Forks

0

Open issues

0

Last commit (this folder)

Oct 14, 2026 (14 days ago)

Last release

Oct 14, 2026 (14 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

com.securealy/mcp

Version

0.1.6

Auth

API key

Packages

npm securealy-mcp

License

Apache-2.0

Repository

github.com/securealy/securealy

Website

securealy.com

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql