SealMyApp tools

Free, open-source security helpers for vibe-coded apps (Lovable, Bolt, Cursor, Replit, v0, and anything on Supabase or Firebase):

• An MCP server your AI assistant can call to check whether a key is safe to expose, audit Supabase Row Level Security, generate safe RLS policies and run a pre-launch checklist.
• A Cursor rule, an Agent Skill (Claude Code and other skill-aware agents) and an AGENTS.md snippet that stop the AI from leaking secrets or "fixing" empty results with using (true).

Everything here runs locally and makes no network calls.

Made by SealMyApp, a paid service that finds, fixes and monitors security holes in vibe-coded apps. The tools in this repo are free and MIT-licensed, and you don't need a SealMyApp account to use them.

Guides

• Railway breach (21 Oct 2026): how to rotate your secrets, in order

Install the MCP server

Requires Node.js 20+ and git. The first run downloads and builds the package from GitHub, so it takes a little longer.

Claude Code

claude mcp add sealmyapp -- npx -y github:toby7979/sealmyapp-tools

Claude Desktop (claude_desktop_config.json: Settings → Developer → Edit Config)

{
  "mcpServers": {
    "sealmyapp": {
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}

Cursor (.cursor/mcp.json in your project, or ~/.cursor/mcp.json for all projects)

{
  "mcpServers": {
    "sealmyapp": {
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}

VS Code (.vscode/mcp.json; note the top-level key is servers)

{
  "servers": {
    "sealmyapp": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "github:toby7979/sealmyapp-tools"]
    }
  }
}

Then ask your assistant things like "Is a key starting sk_live_ safe in my frontend?", "Give me SQL to audit RLS in my Supabase project" or "Run the pre-launch security checklist for my Lovable app".

Tools

Tool	Input	What it returns
check_key_exposure	key_or_prefix	Whether the key is public by design (Supabase anon/publishable, Stripe pk_, Firebase web key) or secret (sk_live_, service_role, sk-ant-, ...), and what to do next: rotate first if it's secret. Classified offline from the format. Pass only a prefix; the full key is never echoed back.
supabase_rls_audit_sql	none	Read-only SQL that lists tables without RLS, policies whose USING/WITH CHECK is true, views that bypass RLS and public buckets, plus how to read the results.
rls_policy_template	table_kind: profiles | posts | orders | messages | files; optional owner_column	Example owner-based policies (select/insert/update/delete with auth.uid()) and caveats.
vibe_security_checklist	optional builder: lovable | bolt | cursor | replit | v0 | other	A pre-launch checklist covering secrets, Supabase, Firebase, auth and payments, with notes for your builder.
scan_my_app_instructions	url	How to run a free, ownership-verified scan of an app you own at sealmyapp.com, and a link to start it. It does not call any API or start a scan.

Every tool's output ends with a one-line link to SealMyApp's free scan.

Cursor rule

Copy rules/cursor/vibe-security.mdc into your project's .cursor/rules/ folder:

mkdir -p .cursor/rules
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/rules/cursor/vibe-security.mdc -o .cursor/rules/vibe-security.mdc

It's set to alwaysApply: true. Change it to false if you'd rather Cursor pull it in only when the description matches the task.

Agent Skill (Claude Code and other skill-aware agents)

Copy the skills/vibe-security folder into .claude/skills/ in your project (or ~/.claude/skills/ for all projects):

mkdir -p .claude/skills/vibe-security
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/skills/vibe-security/SKILL.md -o .claude/skills/vibe-security/SKILL.md

The agent loads it automatically when you work on keys, env vars, RLS, Firebase rules, auth or payments.

AGENTS.md

For Codex and other agents that read AGENTS.md, paste the section from AGENTS.md into your project's AGENTS.md.

Privacy

• The MCP server runs on your machine over stdio. No tool makes a network call, sends telemetry or reads your files. A test (test/privacy.test.ts) fails the build if network or file-system APIs appear in the source.
• check_key_exposure works from the key's format only and never tests the key against any API. Pass a prefix (for example sk_live_) rather than a whole key: whatever you type goes into your assistant's conversation, which is handled by your AI provider, not by this tool.
• scan_my_app_instructions only builds a link. Nothing is sent to SealMyApp unless you open it and start a scan yourself.

Development

npm install      # also builds via the prepare script
npm test         # builds, then runs unit tests and a stdio test that spawns the server and lists its tools
npm run build
npm run list-tools

The server uses the official MCP TypeScript SDK (@modelcontextprotocol/server, v2) with the stdio transport. It serves both 2025-era clients and the 2026-07-28 protocol.

Contributing

Issues and pull requests are welcome, especially:

• new key formats for check_key_exposure (please link the provider's docs saying whether the key is publishable or secret),
• policy templates for other common table shapes,
• builder-specific checklist notes that you've checked against the builder's current UI.

Please keep the tools offline (no network calls) and add a test for any change. Never paste a real secret into an issue; a prefix is enough. Report security problems in this repo privately to [email protected].

Licence

MIT. Copyright (c) 2026 Richmond Capital Holdings Ltd. See LICENSE.