Give your AI agent the power to secure what it built.
A lightweight MCP server that lets Claude Code, Cursor, Windsurf, Cline, and GitHub Copilot scan for exposed secrets, broken Supabase RLS, and missing auth — directly from your editor, before you ever commit.
Included with Starter and Pro — no separate purchase.
Connect to:
Claude Code
Cursor
Windsurf
Cline
GitHub CopilotTell your agent when to scan. It remembers.
Not a git hook — a standing instruction your agent reads every session, the same way it reads any other project rule. Say it once, and every future session in that repo just does it.
“Scan for vulnerabilities before every commit.”
Runs scan_secrets on every file you stage — the flagship, lowest-cost tool, built for this exact habit.
“Scan before every PR.”
Checks the full branch diff, plus scan_lockfile and scan_dockerfile if those files changed.
“Scan after every deploy.”
Runs scan_url against your live site the moment a deploy finishes.
“Scan whenever I touch auth code.”
Runs check_functions, scan_jwt, and scan_oauth_config against anything matching your auth paths.
Add the Ubserve MCP server to Claude Code in one step.
Generate a key from your dashboard, drop it into your agent's MCP config, and start scanning. No account creation inside your editor, no separate CLI to install.
{
"mcpServers": {
"ubserve": {
"url": "https://mcp.ubserve.com/mcp",
"headers": { "x-api-key": "<your key from /dashboard/mcp>" }
}
}
}Everything your agent can call.
| Tool | What it does |
|---|---|
whoami | Your connected account identity and API key scopes. |
get_credit_status | Remaining credits, recent usage, and plan status. |
get_security_memory | Your scan history and vulnerability timeline. |
save_supabase_connection | Register a Supabase project once so check_rls/check_storage/check_auth_config can reference it by id instead of a raw key every call. |
get_last_scan_report | Pull findings from your most recent dashboard scan so an agent can act on them directly. |
scan_package | Check one npm or PyPI package for known CVEs via OSV.dev. |
scan_jwt | Decode a JWT and flag weak algorithms, missing expiry, insecure claims. |
scan_cors | Check a URL for wildcard or overly permissive CORS. |
scan_headers | Audit CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. |
scan_ssl | Check a domain's SSL certificate for expiry and weak TLS versions. |
scan_env | Scan file contents for exposed secrets and verify .gitignore coverage. |
check_auth_config | Audit Supabase auth settings — email confirmation, password strength, OTP expiry. |
check_storage | List Supabase storage buckets and flag any that are public. |
scan_secrets | Deep scan file contents for hardcoded API keys, tokens, and credentials — the "before every commit" tool. |
check_rls | Read real RLS policies and flag any not scoped to auth.uid() or missing entirely. |
scan_api_route | Check one API endpoint for missing auth, rate limiting, and error leakage. |
scan_dockerfile | Flag running as root, exposed sensitive ports, outdated base images, hardcoded secrets. |
scan_webhook | Check if a webhook endpoint validates signatures (Stripe, GitHub, etc). |
scan_lockfile | Scan package.json / package-lock.json / requirements.txt against OSV.dev in bulk. |
check_functions | Read Supabase Edge Function source and flag missing auth checks, exposed keys, unsafe patterns. |
scan_oauth_config | Flag misconfigured redirect URIs, missing PKCE, unsafe token storage. |
scan_upload_endpoint | Test a file upload route for missing type validation, size limits, path traversal. |
scan_github_repo | Scan a GitHub repo for secrets in commits, branch protection, repo visibility. |
scan_url | Full frontend scan — JS bundles, headers, SSL, API path probing. |
full_audit | 8-phase composite audit: discovery, API probing, headers, SSL, CORS, secrets, GitHub. |
Frequently asked questions
What is the Ubserve MCP server?+
An MCP (Model Context Protocol) server that gives your AI coding agent direct, callable security tools — the same detection Ubserve runs on the dashboard, but reachable from inside your editor. Your agent calls it like any other tool, not through a chat window.
Which coding agents does it work with?+
Any MCP-capable agent can call the tools directly — that's the protocol, not an Ubserve limitation. Claude Code, Cursor, Windsurf, Cline, and GitHub Copilot additionally have a ready-made rules file so you can say "scan before every commit" once and have it remembered as a standing instruction.
Does this replace the dashboard scanner?+
No — it's the same detection engine, available from a different surface. The MCP server adds tools the dashboard structurally can't offer, like scanning local files (.env, Dockerfiles) before you ever commit them.
How much does it cost?+
Included with Starter and Pro plans — see the pricing page for details.
Is my Supabase service role key safe?+
It's encrypted at rest and only ever transmitted once, when you register a connection — after that, tools reference it by an opaque id, not the raw key.