Rls Doctor

Read-only Postgres/Supabase RLS audit with a rolled-back probe that proves who can read which rows.

Connector by subhajitlucky · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/subhajitlucky-rls-doctor

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Read-only Postgres/Supabase RLS audit with a rolled-back probe that proves who can read which rows.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 3 read · 0 write · 0 delete · 3 not yet classified
Secrets: None asked for
Install scripts: Not scanned yet
Runs as: Node.js package

Tools by what they do 6

Read from the source code; the running server may list different tools.

Read 3 · Look things up without changing anything.

check_rls
describe_capabilities
explain_table

Not yet classified 3 · We could not tell from the name and description.

probe_access
propose_repair
prove_isolation

Tools (6)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

check_rls
Audit Postgres or Supabase Row Level Security posture from catalog metadata. Reports disabled RLS, unconditional policies, missing WITH CHECK, reachable TRUNCATE, disabled FORCE RLS, and broad default privileges. Read-only: it never mutates the target database.
describe_capabilities
Describe this MCP server: available tools, which run offline versus against a live database, read-only guarantees, coverage limitations, and when user approval is required. Call this once before running other tools.
explain_table
Explain the Row Level Security posture of one table: whether RLS and FORCE RLS are on, which policies apply, what grants application roles hold, and which risks apply. Read-only.
probe_access
Impersonate application roles in a rolled-back, read-only transaction and report which rows they can actually read. Proves cross-tenant exposure that catalog review alone cannot show. Never commits. Ask the user before running this against a live database.
propose_repair
Generate a canonical repair for an RLS-disabled table and verify it statically before returning it: the patch is only included when every target witness flips to proved and no new medium+ finding appears. Read-only: never writes files and never applies anything; the CLI `fix` command adds live shadow verification.
prove_isolation
Prove row-isolation claims offline from SQL schema or migration files, with no database connection: for each table, command, and role it returns proved (with the ownership column), witness (with the reason), or undecided (outside the sound decidable fragment). Read-only and offline.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit: Oct 11, 2026 (17 days ago)
Last release: Oct 11, 2026 (17 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.subhajitlucky/rls-doctor
Version: 0.5.8
Auth: No auth
Packages: npm rls-doctor
License: MIT
Repository: github.com/subhajitlucky/rls-doctor
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql