🛡️ Database Sentinel

Security audits for your database backend. Ask "audit my database" and get a scored report with exact fix code.

Works as a Claude Skill (Supabase, MongoDB), a read-only MCP server for any AI client, or a CLI agent that uses your own model (both Supabase).

→ MCP server setup and usage guide

→ Don't want to run it yourself? Locksoup is the hosted version: a Supabase security audit with scheduled re-checks and alerts.

---

Changelog

2026-10-01 (v1.0.1)

• Fixed: an UPDATE policy without WITH CHECK is no longer reported as letting users reassign row ownership (Postgres reuses USING as the check). Q8's label and the agent prompt said otherwise, which produced false mass-assignment findings on real projects.
• Benchmark: new dev case 027 from that project. Test F1 unchanged (0.836 vs 0.838, same day). Runs.

2026-09-30 (docs)

• MCP flow benchmarked: a model driving the real server over stdio scored test F1 0.865, precision 0.905, critical recall 1.0 (results). Harness: evals/mcp_client.py, eval system m.

v1.0.0 (2026-09-30): MCP server release

• MCP server v1.0: four read-only Supabase tools, an audit prompt and the catalog resources. Benchmarked end to end: a model driving the server over stdio scored test F1 0.865, with critical recall 1.0.
• Verified on hosted Supabase: session pooler, read-only role with BYPASSRLS, all 20 queries.
• Fewer false alarms:
  • Q1 now checks API grants: RLS off with anon/authenticated revoked isn't reported as exposed.
  • The audit prompt knows SECURITY INVOKER functions only have the caller's rights.
  • Found on a real project; new dev case 026.
• Pin a version: git+https://github.com/Farenhytee/database-sentinel@v1.0.0 in any uvx/pipx command. The Claude Code plugin is pinned automatically.
• Standard audit is now the CLI default: one prompt plus anon-probe verification, ~$0.0007 and ~15s per audit. --deep runs the tool-using agent, which scored the same on our bench at ~5× the cost.

v0.2.1 (2026-09-30)

• Test F1: agent 0.782 → 0.831, single-prompt 0.766 → 0.849. No crashes or timeouts (results).
• Fixed:
  • A bad tool argument no longer ends the audit; the error goes back to the model.
  • OpenRouter calls route to the fastest provider (slow ones caused timeouts).
  • The agent's final findings step no longer lists candidates it had dismissed.

v0.2.0 (2026-09-29)

• Published test results: agent F1 0.782, single-prompt 0.766, rules 0.559 on a blind, locked 10-case test split, 3 runs each (results).
• Bench: 25 labeled cases (15 dev, 10 blind test).
• Agent:
  • Verify step: probes as anon to confirm exploitable findings.
  • --fix: prints fix SQL for findings you pick. It's never executed.
  • Cost reporting: tokens, $ and tool calls for each audit.
• CI: free rules-only regression gate.