toby7979/sealmyapp-tools

Free, open-source security helpers for vibe-coded apps (Lovable, Bolt, Cursor, Replit, v0, and anything on Supabase or Firebase):
An MCP server your AI assistant can call to check whether a key is safe to expose, audit Supabase Row Level Security, generate safe RLS policies and run a pre-launch checklist.
A Cursor rule, an Agent Skill (Claude Code and other skill-aware agents) and an AGENTS.md snippet that stop the AI from leaking secrets or "fixing" empty results with using (true).
Everything here runs locally and makes no network calls.
> Made by SealMyApp, a paid service that finds, fixes and monitors security holes in vibe-coded apps. The tools in this repo are free and MIT-licensed, and you don't need a SealMyApp account to use them.
## Guides
Railway breach (21 Oct 2026): how to rotate your secrets, in order
## Install the MCP server
Requires Node.js 20+ and git. The first run downloads and builds the package from GitHub, so it takes a little longer.
Claude Code
bash
claude mcp add sealmyapp -- npx -y github:toby7979/sealmyapp-tools
Claude Desktop (claudedesktopconfig.json: Settings → Developer → Edit Config)
json
"mcpServers": {
"sealmyapp": {
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
Cursor (.cursor/mcp.json in your project, or ~/.cursor/mcp.json for all projects)
json
"mcpServers": {
"sealmyapp": {
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
VS Code (.vscode/mcp.json; note the top-level key is servers)
json
"servers": {
"sealmyapp": {
"type": "stdio",
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
Then ask your assistant things like "Is a key starting sklive safe in my frontend?", "Give me SQL to audit RLS in my Supabase project" or "Run the pre-launch security checklist for my Lovable app".
## Tools
| Tool | Input | What it returns |
| checkkeyexposure | keyorprefix | Whether the key is public by design (Supabase anon/publishable, Stripe pk, Firebase web key) or secret (sklive, servicerole, sk-ant-, ...), and what to do next: rotate first if it's secret. Classified offline from the format. Pass only a prefix; the full key is never echoed back. |
| supabaserlsauditsql | none | Read-only SQL that lists tables without RLS, policies whose USING/WITH CHECK is true, views that bypass RLS and public buckets, plus how to read the results. |
| rlspolicytemplate | tablekind: profiles \| posts \| orders \| messages \| files; optional ownercolumn | Example owner-based policies (select/insert/update/delete with auth.uid()) and caveats. |
| vibesecuritychecklist | optional builder: lovable \| bolt \| cursor \| replit \| v0 \| other | A pre-launch checklist covering secrets, Supabase, Firebase, auth and payments, with notes for your builder. |
| scanmyappinstructions | url | How to run a free, ownership-verified scan of an app you own at sealmyapp.com, and a link to start it. It does not call any API or start a scan. |
Every tool's output ends with a one-line link to SealMyApp's free scan.
## Cursor rule
Copy rules/cursor/vibe-security.mdc into your project's .cursor/rules/ folder:
bash