securityv0.2.0free
fizzgig__sql_injection_sniff
flags SQL built via interpolation, concatenation, or ORM raw escape hatches.
5 patterns covering template-literal interpolation, string concatenation, ORM raw() / queryRawUnsafe / sql.raw escape hatches, dynamic ORDER BY / LIMIT identifiers (where placeholders cannot help), and sprintf-style format-string builders. Fires before the diff lands, with redacted line context.
● live● v0.2.0● free
// input schema
{
"type": "object"
"required": [
"project"
]
"properties": {
"project": {
"type": "string"
"description": "the project slug or path"
}
"strict": {
"type": "boolean"
"default": false
"description": "fail on warnings, not just errors"
}
}
}
// output schema
{
"type": "object"
"properties": {
"ok": {
"type": "boolean"
}
"findings": {
"type": "array"
"items": {
"type": "object"
"properties": {
"severity": {
"enum": [
"info"
"warn"
"high"
"critical"
]
}
"message": {
"type": "string"
}
"fix": {
"type": "string"
}
}
}
}
}
}
// example call from cursor
→ fizzgig__sql_injection_sniff(project="myapp")
{
"ok": false,
"findings": [
{ "severity": "high",
"message": "policy uses user_id without auth.uid()",
"fix": "USING (auth.uid() = user_id)" }
],
"scanned": 3, "duration_ms": 142
}
// reviews
@maya.codes★★★★★
2 days agocaught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.
@solo_at_3am★★★★★
1 week agofirst tool i installed. it's the one that pays for itself.
@vibebuilder★★★★☆
2 weeks agoworks great. one false positive on a join table — easy to ignore.
// primary action
add to your editor
paste this into your mcp config.
{
"fizzgig": {
"url": "https://mcp.fizzgig.ai",
"tools": ["sql_injection_sniff"]
}
}// pricing
free
unlimited calls on the free tier.