Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes.
Connect Remote server
claude mcp add --transport http patchlabs https://api.patchlabs.dev/mcp --header "X-API-Key: <X_API_KEY>"
{
"mcpServers": {
"patchlabs": {
"url": "https://api.patchlabs.dev/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}
{
"servers": {
"patchlabs": {
"type": "http",
"url": "https://api.patchlabs.dev/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}
Settings > Connectors > Add custom connector
URL: https://api.patchlabs.dev/mcp
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools 6 found in our last check
rls_checkScan a public repo's supabase/migrations for row-level-security mistakes (static analysis, no sign-up).
headers_checkGrade a public site's HTTPS, TLS certificate, security headers and cookie flags from one load of its home page (no sign-up). Returns findings PL-027..PL-036 with fixes.
start_checkRequest the full lab check. Returns a check id and a link; the repo owner proves ownership with a one-line file.
get_checkStatus, summary, report and fix for a check id.
list_appsApps monitored in the API key's workspace, with their last check. Needs X-API-Key.
run_checkQueue a check for a monitored app now. Needs X-API-Key.
Headers
| Name | Description |
|---|---|
X-API-KeyOptional, secret | Optional PatchLabs API key (pl_live_...) for the app tools. The free rls_check and headers_check tools work without one. |
Details
| Endpoint | https://api.patchlabs.dev/mcp (Streamable HTTP) |
| First published | 11 Nov 2026 |
| Last updated | 11 Nov 2026 |
| Registry name | dev.patchlabs/patchlabs |
More databases servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
