Supabase row level security
Paste your migrations, or a read-only snapshot of your live database. Deadbolt shows what signed-out and signed-in users can do to every table, flags the leaks, and writes the fix SQL.
Older projects grant every new public table to anon and authenticated automatically. Newer ones grant nothing unless your SQL does. Only used for pasted SQL.
Check the live database insteadCopy this read-only query, run it in Supabase › SQL Editor, and paste the single JSON result above. It reads table settings, grants and policies, never your rows.
Tables with RLS off, policies that were written but never enabled, using (true) writes, personal columns readable by anyone, views that skip RLS, security definer functions anyone can call, user_metadata in policies, public bucket listing, and grants missing after the Oct 30 change.
It replays your SQL in order (create, alter, drop, grant, revoke, default privileges) and applies Postgres policy semantics: permissive policies OR together, restrictive ones AND, WITH CHECK for new rows. The engine is tested against a real Postgres.
Deadbolt reads only what you paste. It does not connect to Supabase, needs no keys, and the page uploads nothing. The catalog query is read-only and returns no row data.
Add Deadbolt to ChatGPT, Claude, Cursor or any assistant that supports MCP, then ask it to check Supabase migrations or a live project for RLS gaps, open policies, leaky views and missing grants, and get the fix SQL. No key, no login.
https://deadbolt.clawhard.com/mcpclaude mcp add --transport http clawhard-deadbolt https://deadbolt.clawhard.com/mcp
Press Add to Claude, or open Customize → Connectors → Add custom connector, paste the URL and leave sign-in empty.
Open Plugins → + → Add custom MCP server, paste the URL, choose No authentication, accept the warning, then Create as a plugin. Start a chat and type @ to use it.
codex mcp add clawhard-deadbolt --url https://deadbolt.clawhard.com/mcp
gemini mcp add --transport http clawhard-deadbolt https://deadbolt.clawhard.com/mcp
{
"mcpServers": {
"clawhard-deadbolt": { "url": "https://deadbolt.clawhard.com/mcp" }
}
}{
"servers": {
"clawhard-deadbolt": { "type": "http", "url": "https://deadbolt.clawhard.com/mcp" }
}
}No desktop app? Add to VS Code in the browser · VS Code Insiders · Add to Cursor in the browser
Other apps: Goose · LM Studio. Any MCP client works with the URL (Streamable HTTP, no headers).
OpenAPI (custom GPT Actions, scripts) · llms.txt · MCP server card · Agent card · All Clawhard tools in one connector
Deadbolt checks Supabase access control. Paste migration SQL or a read-only catalog snapshot and get a per-table matrix of what signed-out and signed-in users can read and write, the leaks ranked by severity, and the fix SQL. Runs in your browser, no account.
Paste your migration SQL into Deadbolt. It shows, for every table, what signed-out and signed-in users can select, insert, update and delete, and lists anything exposed with the SQL to fix it. For a live project, run the read-only catalog query it gives you and paste the JSON.
Since Oct 30, 2026, new Supabase projects no longer grant new tables in the public schema to anon and authenticated. RLS policies only filter rows; the role also needs a GRANT. Deadbolt flags tables with policies but no grant and writes the GRANT statements.
Yes, it is locked: the API returns no rows and rejects writes for anon and signed-in users. Deadbolt marks it as locked so you can tell intended lockdowns from mistakes.
Yes. Postgres views run as their owner by default, so a view over an RLS-protected table shows every row to anyone allowed to select from the view. Deadbolt flags these and suggests security_invoker = true.
No. It only reads what you paste. The catalog query runs in your own SQL Editor and returns settings and policies, never row data.
Yes. Add the MCP server https://deadbolt.clawhard.com/mcp (tools deadbolt_check_supabase_access and deadbolt_catalog_query) or call the JSON API described at /openapi.json. Agents can check migrations before applying them.
For AI assistants and developers: llms.txt · API (OpenAPI) · MCP server · sitemap