@viberaven/mcp

A deployed app can still lack Supabase row level security (RLS). This MCP server lets an agent inspect repository evidence, read tasks and recheck after fixes.

Check AI-built Vercel + Supabase apps before launch/handoff, after migration/policy changes, or for production RLS, environment, database connection, service-role or Stripe webhook failures. Findings include permissive policies, browser-exposed service-role keys, environment-template drift and unsigned Stripe handlers.

Connect Your Host

Requires Node.js 20 or newer. Transport is stdio. Adapt this example to your host's configuration format:

{
  "mcpServers": {
    "viberaven": {
      "command": "npx",
      "args": ["-y", "@viberaven/[email protected]"]
    }
  }
}

On Windows, hosts launching executables directly can use:

{
  "mcpServers": {
    "viberaven": {
      "command": "cmd.exe",
      "args": ["/d", "/s", "/c", "npx", "-y", "@viberaven/[email protected]"]
    }
  }
}

Reconnect, confirm tools appear, then pass the app root:

{
  "name": "viberaven_check_readiness",
  "arguments": { "cwd": "/absolute/path/to/your-app" }
}

Use C:/projects/your-app on Windows. Omitted cwd means the server startup directory; npm validation accepts no cwd. This server invokes matching @viberaven/[email protected] through npx. Scans need no VibeRaven login/API key; downloads and npm validation need network.

The 14 Tools

| Tool | CLI operation | | --- | --- | | viberaven_check_readiness | check --json: fresh check, summary and artifact paths | | viberaven_verify | check --json: recheck after a batch of fixes | | viberaven_audit | audit --vercel-supabase; optional json: true | | viberaven_init_rules | init: native instructions; preview with dryRun: true | | viberaven_clean_plan | clean --plan: write a cleanup plan, deletes nothing | | viberaven_strict_gate | --strict --json: fresh scan with full gate JSON | | viberaven_gate_result | --json: fresh scan, not an older result | | viberaven_context_map | --condense: refresh context from the last scan | | viberaven_actions | actions: current actions and follow-ups | | viberaven_verify_action | --verify --action <actionId> | | viberaven_heal_plan | --heal --plan: review a supported fix | | viberaven_heal_prompt | --heal --prompt: guidance for the coding agent | | viberaven_heal_apply | --heal --apply: supported repository recipe | | viberaven_validate_npm_package | validate-npm-package --json: packageName or packageNames; not a package security review |

Responses contain exit N, CLI output and parseable JSON objects as structured content. Blocker exit 1 can be normal tool content.

Work The Result

Readiness refreshes .viberaven/agent-tasklist.md, gate-result.json and context-map.json without patching source. Read tasks/source, review viberaven_heal_plan before apply, and recheck each batch with viberaven_verify. Provider steps require provider evidence.

The rls_disabled migration enables RLS without policies; browser roles lose row access until policies exist. Obtain agreement before apply and yes: true. Apply/test through your database workflow.

Readiness prints a summary. Read gate-result.json or call viberaven_gate_result/viberaven_strict_gate for full gate.status.

Default check allows warnings: 0 without critical blockers, 1 with blockers, 2 on scan error. Strict gate returns 0 for clear/warning, 1 for not_clear, 2 for error, 3 for unknown or unavailable results. For warning failures, run npx -y [email protected] --strict=warning --json from the app root. Unrestricted SELECT can be intentional public content and is a default warning; focused audit returns 1 for any status other than pass.

Studio And Optional Artifact Mode

From the app root: npx -y [email protected] opens Studio; npx -y [email protected] check checks. Chat needs an installed/authenticated coding CLI and Test connection.

Artifact compatibility command:

npx -y viberaven --agent-mode

Scope And Evidence

Checks do not query live policies, prove complete permissions, build or deploy. With RLS off, grants determine actual access. Verify live user access, provider environment, DNS, billing and webhooks separately. A clear result is not a security audit.

The RLS comparison retains maintainer-authored 1.6.3 runs in local databases, not new scans, hosted Supabase verification or independent endorsement. Public repository | Agent reference. License: MIT.