auditai-mcp

auditai-mcp

MCP server for Claude Code and Cursor from Audit AI. It scans a Next.js + Supabase app for the authorization holes AI-built apps tend to ship with (one user reading another tenant's rows, tables without RLS, service-role queries with no check on the caller, mass assignment) and lets your own coding agent confirm and fix what it finds.

No API key, no account, no Docker. The scan is deterministic and runs on your machine; the reasoning is done by the model you already use in Claude Code or Cursor.

Install

Claude Code, from your project directory:

claude mcp add auditai -- npx -y auditai-mcp

Cursor: Settings → MCP → Add server, command npx, args ["-y", "auditai-mcp"].

Needs Node.js 22 or newer. Then ask your agent: "Scan this project with Audit AI and check what it finds."

Check your live database

Ask your agent: "Check what my Supabase database lets a stranger do, with Audit AI." It gets a read-only query from audit_snapshot_query and runs it: through the Supabase MCP server's execute_sql if you have it connected, or by asking you to paste it into the SQL editor. The query reads the Postgres catalog (tables, row level security, policies, grants, functions, triggers, enum values, storage buckets) and whether each table has rows, changes nothing and reads no row of your data. audit_check_snapshot then reports tables anyone can read, write policies open to anyone and SECURITY DEFINER functions the public can call, each with the migration that closes it. Your agent should show you the query before it runs it.

Tools

Tool	What it does
audit_scan	Deterministic scan of routes, server actions, Supabase clients and queries, RLS policies. Saves .audit/scan.json.
audit_get_findings	Findings from the last scan with any recorded verdicts and proposed fixes, as JSON.
audit_get_context	The bounded code slice, policies and instructions for one finding, for your agent to reason about (reason) or fix (fix).
audit_record_verdict	Records your agent's verdict: confirmed at confidence ≥ 0.75, suppressed at ≥ 0.7 "not vulnerable", otherwise unverified.
audit_snapshot_query	The read-only query that exports what your live Supabase database allows.
audit_check_snapshot	Checks what that query returned and prints each hole with its migration and the entry point a stranger would use.
audit_propose_fix	Checks your agent's patch (each search string must occur exactly once, nothing outside the project), saves the diff and a regression test under .audit/fixes/. Writes to the project only with apply: true.

Proof

This package does not run a sandbox. To prove a hole and check the fix, push the repository to GitHub, scan it at auditai.sh and press Prove it on the finding.

Safety

• No shell tool. Every repository tool takes a project path and, where relevant, a finding id like AUDIT-001.
• Paths must be inside the directory the server was started in, symlinks included. Set AUDITAI_MCP_ALLOW_ANY_PATH=1 to allow other directories.
• Code from the scanned repository reaches your agent marked as untrusted data, and secret files (.env, keys, credentials) are never put into the context.
• Nothing is sent over the network. The database check reads only what your agent passes in.
• Findings inferred from application code are marked as leads: about one in four is real on code the rules have never seen. Findings about the database are the ones to act on first.

Scope

Next.js (App Router) + Supabase / PostgreSQL, in JavaScript and TypeScript. How precise the rules are, measured on repositories they had never seen: auditai.sh/stats.

Apache-2.0 · auditai.sh · [e-mail]