ohmypolicy-mcp

Scan your Supabase project's Row Level Security from inside your AI coding assistant.

ohmypolicy-mcp is a Model Context Protocol server that lets Claude Desktop, Cursor, Continue, and other MCP clients invoke OhMyPolicy's scanner with a single prompt. Your AI assistant can audit a Supabase project, classify exposed tables, explain findings in plain English, and generate ready-to-run Fix SQL — all without leaving the chat.

Supabase is the first platform supported. Firebase Security Rules, Clerk permissions, and general PostgreSQL RLS are on the roadmap; the tool surface is designed so future platforms slot in without changing how existing tools are called.

Install

Claude Desktop

Edit your claude_desktop_config.json:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add an entry under mcpServers:

{
  "mcpServers": {
    "ohmypolicy": {
      "command": "npx",
      "args": ["-y", "ohmypolicy-mcp"]
    }
  }
}

Restart Claude Desktop. The five ohmypolicy_* tools appear in the tool picker.

Cursor

Open Cursor settings → MCP → Add new MCP server:

• Name: ohmypolicy
• Type: command
• Command: npx -y ohmypolicy-mcp

Or edit ~/.cursor/mcp.json directly:

{
  "mcpServers": {
    "ohmypolicy": {
      "command": "npx",
      "args": ["-y", "ohmypolicy-mcp"]
    }
  }
}

Continue (VS Code / JetBrains)

Add to your Continue config (~/.continue/config.json):

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": ["-y", "ohmypolicy-mcp"]
        }
      }
    ]
  }
}

Any other MCP client

Run npx -y ohmypolicy-mcp. The server speaks Model Context Protocol over stdio.

Usage

In any MCP-enabled chat:

You: Scan my Supabase project at https://abcd.supabase.co for RLS issues.

AI: I'll need your anon key and service_role key. Both are used in-memory
    only and forwarded to ohmypolicy.com just for the scan.

You: [pastes keys]

AI: [calls ohmypolicy_scan_supabase]
    Scan complete for https://abcd.supabase.co
    Total tables scanned: 12
    Exposed tables: 4
    Exposed tables (sorted by severity):
      - public.messages   [public-read-write]
      - public.posts      [public-read]
      - public.users      [public-read]
      - public.orders     [public-write]
    Full report (72h): https://ohmypolicy.com/report/xyz...

You: Generate the fix for the messages table.

AI: [calls ohmypolicy_generate_fix]
    BEGIN;
    ALTER TABLE public.messages ENABLE ROW LEVEL SECURITY;
    ...

Available tools

| Tool | What it does | |---|---| | ohmypolicy_list_platforms | List supported platforms (Supabase live; Firebase / Clerk / general Postgres coming). Call first when the user asks "what can you do". | | ohmypolicy_scan_supabase | Run the full Supabase scan. Requires project URL, anon key, service_role key. | | ohmypolicy_get_report | Fetch a tokenized scan report (72-hour retention). | | ohmypolicy_explain_finding | Plain-English explanation of an exposure type (no-rls, public-read, public-write, public-read-write). | | ohmypolicy_generate_fix | Generate Fix SQL (Supabase) or platform-specific fix code (future). |

Security / trust model

• Your Supabase keys are forwarded to https://ohmypolicy.com/api/scan only for the duration of the scan.
• Keys are never written to disk, never logged, and never included in the stored scan report.
• The scan report stored under the returned token contains table names, exposure flags, Fix SQL, and a Mermaid ERD — no credentials.
• For maximum paranoia: rotate the service_role key in your Supabase dashboard after the scan.
• The MCP server is open source. Inspect the code or self-host the wrapper by pointing OHMYPOLICY_BASE_URL at your own deployment.

Configuration

Environment variables read at startup:

• OHMYPOLICY_BASE_URL — override the API endpoint (default: https://ohmypolicy.com). Useful for self-hosting.

Roadmap

The MCP server tracks the OhMyPolicy scanner roadmap. Today only Supabase is "live"; tool stubs and roadmap status for other platforms are returned by ohmypolicy_list_platforms. New scan tools (ohmypolicy_scan_firebase, ohmypolicy_scan_clerk, etc.) will appear as the underlying scanner adds support.

See https://ohmypolicy.com/docs/scanner-roadmap for the full plan.

Local development

git clone https://github.com/SilverNine/ohmypolicy-mcp.git
cd ohmypolicy-mcp
bun install
bun run build
node dist/index.js   # speaks MCP over stdio

Point your MCP client at the absolute path of dist/index.js instead of npx -y ohmypolicy-mcp to test changes locally.

License

MIT