Securealy

com.securealy/mcp · v0.1.6

Grade a URL as an attacker and a customer would see it; scan a repo; check Supabase, Stripe, Vercel.

Website Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add mcp -e SUPABASE_URL=<SUPABASE_URL> -e SUPABASE_SERVICE_KEY=<SUPABASE_SERVICE_KEY> -e SUPABASE_MGMT_TOKEN=<SUPABASE_MGMT_TOKEN> -e SUPABASE_PROJECT_REF=<SUPABASE_PROJECT_REF> -e STRIPE_SECRET_KEY=<STRIPE_SECRET_KEY> -e VERCEL_TOKEN=<VERCEL_TOKEN> -e VERCEL_PROJECT_ID=<VERCEL_PROJECT_ID> -e SECUREALY_VERCEL_DECRYPT=<SECUREALY_VERCEL_DECRYPT> -e SECUREALY_SUPABASE_HOST_OVERRIDE=<SECUREALY_SUPABASE_HOST_OVERRIDE> -e SECUREALY_SCAN_ROOTS=<SECUREALY_SCAN_ROOTS> -e SECUREALY_NO_HISTORY=<SECUREALY_NO_HISTORY> -e SECUREALY_TELEMETRY=<SECUREALY_TELEMETRY> -- npx -y [email protected]

claude_desktop_config.json

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SUPABASE_URL": "<SUPABASE_URL>",
        "SUPABASE_SERVICE_KEY": "<SUPABASE_SERVICE_KEY>",
        "SUPABASE_MGMT_TOKEN": "<SUPABASE_MGMT_TOKEN>",
        "SUPABASE_PROJECT_REF": "<SUPABASE_PROJECT_REF>",
        "STRIPE_SECRET_KEY": "<STRIPE_SECRET_KEY>",
        "VERCEL_TOKEN": "<VERCEL_TOKEN>",
        "VERCEL_PROJECT_ID": "<VERCEL_PROJECT_ID>",
        "SECUREALY_VERCEL_DECRYPT": "<SECUREALY_VERCEL_DECRYPT>",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "<SECUREALY_SUPABASE_HOST_OVERRIDE>",
        "SECUREALY_SCAN_ROOTS": "<SECUREALY_SCAN_ROOTS>",
        "SECUREALY_NO_HISTORY": "<SECUREALY_NO_HISTORY>",
        "SECUREALY_TELEMETRY": "<SECUREALY_TELEMETRY>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SUPABASE_URL": "<SUPABASE_URL>",
        "SUPABASE_SERVICE_KEY": "<SUPABASE_SERVICE_KEY>",
        "SUPABASE_MGMT_TOKEN": "<SUPABASE_MGMT_TOKEN>",
        "SUPABASE_PROJECT_REF": "<SUPABASE_PROJECT_REF>",
        "STRIPE_SECRET_KEY": "<STRIPE_SECRET_KEY>",
        "VERCEL_TOKEN": "<VERCEL_TOKEN>",
        "VERCEL_PROJECT_ID": "<VERCEL_PROJECT_ID>",
        "SECUREALY_VERCEL_DECRYPT": "<SECUREALY_VERCEL_DECRYPT>",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "<SECUREALY_SUPABASE_HOST_OVERRIDE>",
        "SECUREALY_SCAN_ROOTS": "<SECUREALY_SCAN_ROOTS>",
        "SECUREALY_NO_HISTORY": "<SECUREALY_NO_HISTORY>",
        "SECUREALY_TELEMETRY": "<SECUREALY_TELEMETRY>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SUPABASE_URL": "<SUPABASE_URL>",
        "SUPABASE_SERVICE_KEY": "<SUPABASE_SERVICE_KEY>",
        "SUPABASE_MGMT_TOKEN": "<SUPABASE_MGMT_TOKEN>",
        "SUPABASE_PROJECT_REF": "<SUPABASE_PROJECT_REF>",
        "STRIPE_SECRET_KEY": "<STRIPE_SECRET_KEY>",
        "VERCEL_TOKEN": "<VERCEL_TOKEN>",
        "VERCEL_PROJECT_ID": "<VERCEL_PROJECT_ID>",
        "SECUREALY_VERCEL_DECRYPT": "<SECUREALY_VERCEL_DECRYPT>",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "<SECUREALY_SUPABASE_HOST_OVERRIDE>",
        "SECUREALY_SCAN_ROOTS": "<SECUREALY_SCAN_ROOTS>",
        "SECUREALY_NO_HISTORY": "<SECUREALY_NO_HISTORY>",
        "SECUREALY_TELEMETRY": "<SECUREALY_TELEMETRY>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`SUPABASE_URL` Optional	Optional. Your Supabase project URL, read by check_rls. Sent only to that project.
`SUPABASE_SERVICE_KEY` Optional, secret	Optional. Service role key for check_rls. Sent only to your Supabase project, never printed.
`SUPABASE_MGMT_TOKEN` Optional, secret	Optional. Supabase management token for check_rls and the auth config check. Sent only to the Supabase management API.
`SUPABASE_PROJECT_REF` Optional	Optional. Supabase project ref, used with SUPABASE_MGMT_TOKEN.
`STRIPE_SECRET_KEY` Optional, secret	Optional. Stripe secret key for check_stripe. Sent only to api.stripe.com, never printed.
`VERCEL_TOKEN` Optional, secret	Optional. Project-scoped Vercel token for check_vercel_env. Sent only to api.vercel.com, never printed.
`VERCEL_PROJECT_ID` Optional	Optional. Vercel project id for check_vercel_env.
`SECUREALY_VERCEL_DECRYPT` Optional	Optional. Set to 1 to let check_vercel_env fetch decrypted variable values from api.vercel.com for the trailing-newline and live-key checks. Without it only names and targets are read and those checks are reported as skipped.
`SECUREALY_SUPABASE_HOST_OVERRIDE` Optional	Optional. Set to 1 to let check_rls send the service key to a self-hosted Supabase URL. Without it the key is sent only to an https URL on a Supabase-hosted domain.
`SECUREALY_SCAN_ROOTS` Optional	Optional. Folders, separated by the OS path delimiter, that scan_repo may read in addition to the server's working directory. Anything outside is refused.
`SECUREALY_NO_HISTORY` Optional	Optional. Set to 1 to stop the server appending each run (grade, score, counts, failing check ids; never evidence) to .securealy/history.json in its working directory.
`SECUREALY_TELEMETRY` Optional	Optional, off by default. Set to 1 to send an anonymous aggregate of each run (command, grade, counts, stack kind, failing check ids; no URL, host or evidence) to securealy.com.

Details

Package	`[email protected]` (NPM, stdio)
First published	14 Oct 2026
Last updated	14 Oct 2026
Registry name	`com.securealy/mcp`

More databases servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Securealy often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/com-securealy-mcp/badge.svg)](https://nestdaddy.com/mcp/servers/com-securealy-mcp)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.