fizzgig__rls_checker
checks supabase row-level-security policies for the 8 canonical leak shapes.
scans SQL migrations for 8 RLS misconfiguration patterns: tables with RLS not enabled at all, RLS explicitly disabled (with system-table downgrade for spatial_ref_sys etc), USING (true) policies, USING with no auth scoping, INSERT/UPDATE missing WITH CHECK (the row-reassignment bug), policies attached to the public role, auth.role() vs auth.uid() confusion, and SECURITY DEFINER functions that bypass RLS. Returns ranked findings with copy-paste fix SQL + pattern_summaries grouping (one ai_context per pattern, not per finding) — sticky tool, run before every migration.
caught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.
first tool i installed. it's the one that pays for itself.
works great. one false positive on a join table — easy to ignore.
{
"fizzgig": {
"url": "https://mcp.fizzgig.ai",
"tools": ["rls_checker"]
}
}