Free, open-source security helpers for vibe-coded apps (Lovable, Bolt, Cursor, Replit, v0, and anything on Supabase or Firebase):
- An MCP server your AI assistant can call to check whether a key is safe to expose, audit Supabase Row Level Security, generate safe RLS policies and run a pre-launch checklist.
- A Cursor rule, an Agent Skill (Claude Code and other skill-aware agents) and an
AGENTS.mdsnippet that stop the AI from leaking secrets or "fixing" empty results withusing (true).
Everything here runs locally and makes no network calls.
Made by SealMyApp, a paid service that finds, fixes and monitors security holes in vibe-coded apps. The tools in this repo are free and MIT-licensed, and you don't need a SealMyApp account to use them.
Guides
Install the MCP server
Requires Node.js 20+ and git. The first run downloads and builds the package from GitHub, so it takes a little longer.
Claude Code
claude mcp add sealmyapp -- npx -y github:toby7979/sealmyapp-tools
Claude Desktop (claude_desktop_config.json: Settings → Developer → Edit Config)
{
"mcpServers": {
"sealmyapp": {
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
}
}
}
Cursor (.cursor/mcp.json in your project, or ~/.cursor/mcp.json for all projects)
{
"mcpServers": {
"sealmyapp": {
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
}
}
}
VS Code (.vscode/mcp.json; note the top-level key is servers)
{
"servers": {
"sealmyapp": {
"type": "stdio",
"command": "npx",
"args": ["-y", "github:toby7979/sealmyapp-tools"]
}
}
}
Then ask your assistant things like "Is a key starting sk_live_ safe in my frontend?", "Give me SQL to audit RLS in my Supabase project" or "Run the pre-launch security checklist for my Lovable app".
Tools
| Tool | Input | What it returns |
|---|---|---|
check_key_exposure |
key_or_prefix |
Whether the key is public by design (Supabase anon/publishable, Stripe pk_, Firebase web key) or secret (sk_live_, service_role, sk-ant-, ...), and what to do next: rotate first if it's secret. Classified offline from the format. Pass only a prefix; the full key is never echoed back. |
supabase_rls_audit_sql |
none | Read-only SQL that lists tables without RLS, policies whose USING/WITH CHECK is true, views that bypass RLS and public buckets, plus how to read the results. |
rls_policy_template |
table_kind: profiles | posts | orders | messages | files; optional owner_column |
Example owner-based policies (select/insert/update/delete with auth.uid()) and caveats. |
vibe_security_checklist |
optional builder: lovable | bolt | cursor | replit | v0 | other |
A pre-launch checklist covering secrets, Supabase, Firebase, auth and payments, with notes for your builder. |
scan_my_app_instructions |
url |
How to run a free, ownership-verified scan of an app you own at sealmyapp.com, and a link to start it. It does not call any API or start a scan. |
Every tool's output ends with a one-line link to SealMyApp's free scan.
Cursor rule
Copy rules/cursor/vibe-security.mdc into your project's .cursor/rules/ folder:
mkdir -p .cursor/rules
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/rules/cursor/vibe-security.mdc -o .cursor/rules/vibe-security.mdc
It's set to alwaysApply: true. Change it to false if you'd rather Cursor pull it in only when the description matches the task.
Agent Skill (Claude Code and other skill-aware agents)
Copy the skills/vibe-security folder into .claude/skills/ in your project (or ~/.claude/skills/ for all projects):
mkdir -p .claude/skills/vibe-security
curl -fsSL https://raw.githubusercontent.com/toby7979/sealmyapp-tools/main/skills/vibe-security/SKILL.md -o .claude/skills/vibe-security/SKILL.md
The agent loads it automatically when you work on keys, env vars, RLS, Firebase rules, auth or payments.
AGENTS.md
For Codex and other agents that read AGENTS.md, paste the section from AGENTS.md into your project's AGENTS.md.
Privacy
- The MCP server runs on your machine over stdio. No tool makes a network call, sends telemetry or reads your files. A test (
test/privacy.test.ts) fails the build if network or file-system APIs appear in the source. check_key_exposureworks from the key's format only and never tests the key against any API. Pass a prefix (for examplesk_live_) rather than a whole key: whatever you type goes into your assistant's conversation, which is handled by your AI provider, not by this tool.scan_my_app_instructionsonly builds a link. Nothing is sent to SealMyApp unless you open it and start a scan yourself.
Development
npm install # also builds via the prepare script
npm test # builds, then runs unit tests and a stdio test that spawns the server and lists its tools
npm run build
npm run list-tools
The server uses the official MCP TypeScript SDK (@modelcontextprotocol/server, v2) with the stdio transport. It serves both 2025-era clients and the 2026-07-28 protocol.
Contributing
Issues and pull requests are welcome, especially:
- new key formats for
check_key_exposure(please link the provider's docs saying whether the key is publishable or secret), - policy templates for other common table shapes,
- builder-specific checklist notes that you've checked against the builder's current UI.
Please keep the tools offline (no network calls) and add a test for any change. Never paste a real secret into an issue; a prefix is enough. Report security problems in this repo privately to hello@sealmyapp.com.
Licence
MIT. Copyright (c) 2026 Richmond Capital Holdings Ltd. See LICENSE.
