Database Sentinel

by Farenhytee

Read-only security audit for Supabase. Four tools surface RLS gaps, permissive policies, exposed functions and grants; an audit prompt returns scored findings with fix SQL.

Security
51stars
No ratings
UpdatedOct 21, 2026

InstallRepository Website

Install Database Sentinel

Pick your client, then add it in one click or paste the config.

STDIOPython

~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "farenhytee-database-sentinel": {
      "command": "uvx",
      "args": [
        "--from",
        "git+…",
        "sentinel-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx --from git+… sentinel-mcp

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 15d ago.

Overview

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

10/10 checks healthy over the last 19d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · sentinel-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars51Stargazers on the source repository.

Last commit1mo agoMost recent push to the default branch.

Install checkInconclusiveDidn't respond in our test window — often a slow first install.

From the project README

🛡️ Database Sentinel

Security audits for your database backend. Ask "audit my database" and get a scored report with exact fix code.

Works as a Claude Skill (Supabase, MongoDB), a read-only MCP server for any AI client, or a CLI agent that uses your own model (both Supabase).

→ MCP server setup and usage guide

→ Don't want to run it yourself? Locksoup is the hosted version: a Supabase security audit with scheduled re-checks and alerts.

Changelog

2026-10-01 (v1.0.1)

Fixed: an UPDATE policy without WITH CHECK is no longer reported as letting users reassign row ownership (Postgres reuses USING as the check). Q8's label and the agent prompt said otherwise, which produced false mass-assignment findings on real projects.
Benchmark: new dev case 027 from that project. Test F1 unchanged (0.836 vs 0.838, same day). Runs.

2026-09-30 (docs)

MCP flow benchmarked: a model driving the real server over stdio scored test F1 0.865, precision 0.905, critical recall 1.0 (results). Harness: evals/mcp_client.py, eval system m.

v1.0.0 (2026-09-30): MCP server release

MCP server v1.0: four read-only Supabase tools, an audit prompt and the catalog resources. Benchmarked end to end: a model driving the server over stdio scored test F1 0.865, with critical recall 1.0.
Verified on hosted Supabase: session pooler, read-only role with BYPASSRLS, all 20 queries.
Fewer false alarms:
- Q1 now checks API grants: RLS off with anon/authenticated revoked isn't reported as exposed.
- The audit prompt knows SECURITY INVOKER functions only have the caller's rights.
- Found on a real project; new dev case 026.
Pin a version: git+https://github.com/Farenhytee/database-sentinel@v1.0.0 in any uvx/pipx command. The Claude Code plugin is pinned automatically.
Standard audit is now the CLI default: one prompt plus anon-probe verification, ~$0.0007 and ~15s per audit. --deep runs the tool-using agent, which scored the same on our bench at ~5× the cost.

v0.2.1 (2026-09-30)

Test F1: agent 0.782 → 0.831, single-prompt 0.766 → 0.849. No crashes or timeouts (results).
Fixed:
- A bad tool argument no longer ends the audit; the error goes back to the model.
- OpenRouter calls route to the fastest provider (slow ones caused timeouts).
- The agent's final findings step no longer lists candidates it had dismissed.

v0.2.0 (2026-09-29)

Published test results: agent F1 0.782, single-prompt 0.766, rules 0.559 on a blind, locked 10-case test split, 3 runs each (results).
Bench: 25 labeled cases (15 dev, 10 blind test).
Agent:
- Verify step: probes as anon to confirm exploitable findings.
- --fix: prints fix SQL for findings you pick. It's never executed.
- Cost reporting: tokens, $ and tool calls for each audit.
CI: free rules-only regression gate.

2026-09-29

One-command install: Claude Code plugin (skill + MCP server, prompts for your connection string) and an Add to Cursor button.
Install from GitHub: one command for the MCP server (uvx --from git+… sentinel-mcp) and the agent (pipx install "database-sentinel[agent] @ git+…").
sentinel-mcp --role-sql prints the read-only role setup SQL.
Clearer errors: the MCP client now sees why a call failed, and the CLI prints a single-line error.

2026-09-28

New: MCP server for Supabase. Four read-only tools, an audit prompt and the pattern catalog as resources. Your own LLM does the analysis, so it's free.
New: lite agent (sentinel-audit). A LangGraph pipeline that works with any OpenAI-compatible model: OpenRouter, OpenAI, or local Ollama.
New: benchmark + evals. 10 labeled Supabase cases, with precision/recall/F1 compared across a rules baseline, a single-prompt baseline and the agent.
Fixed: six Supabase audit queries. Q8 (UPDATE without WITH CHECK) never matched anything, Q16 and Q19 missed rows for least-privilege roles, and Q6, Q13 and Q14 had wrong conditions.

Quick start

Claude Code installs the audit skill and the MCP server in one go (needs uv):

Terminal

claude plugin marketplace add Farenhytee/database-sentinel
claude plugin install database-sentinel@database-sentinel

Supabase users: create the read-only login (step 1), then run /plugin configure database-sentinel@database-sentinel in Claude Code. Then ask: Audit my database.

Cursor

Other MCP clients, and full setup: MCP guide

More ways to install

Skill only (Claude Code picks it up automatically):

bash

git clone https://github.com/Farenhytee/database-sentinel.git ~/.claude/skills/database-sentinel

CLI agent (Supabase, bring your own model):

server.ts

pipx install "database-sentinel[agent] @ git+https://github.com/Farenhytee/database-sentinel"
export SENTINEL_BASE_URL=http://localhost:11434/v1 SENTINEL_MODEL=<model>   # Ollama, or any OpenAI-compatible API + SENTINEL_API_KEY
sentinel-audit --dsn "postgresql://sentinel_auditor:<password>@<host>:5432/postgres" \
  --rest-url https://<ref>.supabase.co --anon-key <anon key> --repo ./my-app

The default audit is one prompt plus anon-probe verification. --deep runs a tool-using agent instead: same accuracy on our bench, ~5× the cost. --fix prints fix SQL for the findings you pick; it's never executed.

What it catches

Backend	Patterns	Examples
Supabase	27 (catalog)	RLS disabled, service-role key in frontend, `USING (true)`, views bypassing RLS, exposed `SECURITY DEFINER` functions, `user_metadata` in policies, mass assignment, public buckets
MongoDB	20 (catalog)	MongoBleed (CVE-2025-14847), auth disabled, `0.0.0.0/0` Atlas allowlist, server-side JS, privileged app user

Full tables are in Appendix A.

Safety

Read-only by default. Only system catalogs are read. The MCP server and agent can't write, drop or delete anything.
Your rows are never read. The audit role has no access to table data. Repo scans report file and line, never secret values.
Write and network probes are opt-in (Skill only). Details are in Appendix D.

Status

Backend	Skill	MCP server / agent
Supabase	✅	✅
MongoDB	✅	planned
Firebase, Postgres, MySQL, cross-backend	planned	planned

License

MIT. Exception: database_sentinel/agent/, database_sentinel/mcp_server/ and database_sentinel/kb/ are AGPL-3.0 (see the LICENSE in each).

Appendix

A. Pattern highlights

Supabase

Severity	Pattern	What
🔴 CRITICAL	`RLS_DISABLED`	Tables without Row-Level Security are fully exposed
🔴 CRITICAL	`SERVICE_ROLE_EXPOSED`	service_role key in frontend code bypasses all security
🔴 CRITICAL	`POLICIES_BUT_NO_RLS`	Policies written but RLS never enabled
🟠 HIGH	`USING_TRUE`	`USING (true)` on writes or private data
🟠 HIGH	`VIEW_NO_SECURITY_INVOKER`	Views bypass RLS and run as their owner
🟠 HIGH	`SECURITY_DEFINER_EXPOSED`	RLS-bypassing functions callable via the API
🟠 HIGH	`USER_METADATA_IN_POLICY`	Policies trust user-editable metadata
🟠 HIGH	`MASS_ASSIGNMENT`	Users can update privilege/billing columns on their own rows
🟠 HIGH	`GHOST_AUTH`	Unconfirmed sign-ups get authenticated sessions
🟠 HIGH	`JWT_SECRET_EXPOSED`	Leaked signing secret lets attackers forge any token
🟡 MEDIUM	+ 17 more	anti-patterns.md

MongoDB

Severity	Pattern	What
🔴 CRITICAL	`MG-SH-001` MongoBleed (CVE-2025-14847, CISA KEV)	Pre-auth heap memory disclosure; ~87K instances exposed at disclosure
🔴 CRITICAL	`MG-SH-002` Auth disabled	No authentication (Meow ransomware surface)
🔴 CRITICAL	`MG-SH-003` Internet-bound mongod	`--bind_ip_all` + reachable 27017
🔴 CRITICAL	`MG-AT-001` Atlas allowlist `0.0.0.0/0`	Cluster reachable from anywhere
🟠 HIGH	`MG-SH-005` Server-side JS enabled	`$where` / `$function` / `mapReduce` reachable
🟠 HIGH	`MG-SH-007` Privileged app user	App connects as `root` / `dbAdminAnyDatabase`
🟠 HIGH	`MG-AT-002` Atlas Function pass-through	NoSQL injection over HTTPS
🟡 MEDIUM	+ 13 more	anti-patterns.md

The MongoBleed probe (mongobleed-probe.md) is a single-packet, read-only detector. It was verified against mongo:7.0.20 (vulnerable) and 7.0.28 (patched), and runs only after two opt-in confirmations.

B. How the Skill audits

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Database Sentinel

Farenhytee/database-sentinel is an MCP server that provides read-only security audits for Supabase databases. Its four tools surface RLS gaps, permissive policies, exposed functions, and grants. An audit prompt returns scored findings with exact SQL fixes, while leaving changes to the developer; it does not execute fixes.

It checks for row-level security gaps, overly permissive policies, exposed database functions, and grants. The audit flow combines these checks into scored findings and can include exact SQL for remediation.

Yes, the MCP server is read-only. It inspects Supabase security configuration and returns findings and fix SQL, but the generated fixes are not executed.

Yes, its audit prompt returns a scored security report. The MCP server supplies the database information through four read-only tools, while the connected AI client analyzes the results and presents findings with fix SQL.

Related MCP servers

All in Security All alternatives

Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Database Sentinel AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/farenhytee-database-sentinel?style=directory)](https://allmcps.com/mcp/farenhytee-database-sentinel)

HTML Embed

<a href="https://allmcps.com/mcp/farenhytee-database-sentinel"><img src="https://allmcps.com/api/badge/farenhytee-database-sentinel?style=directory" alt="Database Sentinel on AllMCPs" /></a>

At a glance

Category: Security
Transport: STDIO
Runtime: Python
Last updated: Oct 21, 2026

GitHub stars51

Last commit1mo ago

51Quality signal: Good · 51/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools22/30

Adoption & activity6/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

Own this project?

This listing is pre-filled from public sources. Claim it via your GitHub README, a site badge, or DNS TXT to edit it and earn the Verified badge.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically.

Claim this listing