VibeRaven: Supabase and Vercel pre-launch check
VibeRaven
A CLI and MCP that find RLS gaps, service_role keys in client code and unsigned Stripe webhooks in an app on Vercel and Supabase
- 64 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The tool reads sources and environment files of the project, and viberaven_heal_apply changes files
- The init command appends rules to AGENTS.md, CLAUDE.md and other agent config files
Install
- Works in
Manual install
npx -y viberaven@1.7.6 checkThe check from the project root. No account is needed and it does not connect to Supabase.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The tool reads sources and environment files of the project, and viberaven_heal_apply changes files
- The init command appends rules to AGENTS.md, CLAUDE.md and other agent config files
This is third-party code. Review the repository files before installing.
What it does
VibeRaven reads the repository on your machine and reports gaps with file and line before launch. It looks at supabase migrations, client and server code, package.json and .env.example. It does not connect to your Supabase project and sends no requests to the app. Rules cover tables without RLS enabled, policies like using (true) that open every row to read or write, a service_role key in files shipped to the browser or in NEXT_PUBLIC_ variables, security definer functions callable by anon, a direct Postgres connection on port 5432 from serverless code instead of the pooler on 6543, and Stripe webhooks without signature checks. It also catches environment variables missing from .env.example, queries without a row limit and absent error monitoring. The command exits with code 1 on a blocking finding, so it works as a CI step. For agents there is an MCP server with viberaven_check_readiness, viberaven_heal_apply, viberaven_verify, viberaven_audit, viberaven_gate_result and viberaven_validate_npm_package, plus six skills and a plugin for Claude Code and Cursor.
Who it is for. People who build AI-made apps on Vercel and Supabase and want to catch security gaps before the first users.
Good fit when
- An AI-built app is heading to launch and you need an RLS policy check
- After a new migration or policy change you want to confirm tables are not open to everyone
- CI needs a step that blocks merged code with a service_role key in the client
- You hand a project to someone and want a report with files and lines
- Before adding an npm dependency the agent checks the package through viberaven_validate_npm_package
Not a fit when
- Your stack is different: the rules are written for Vercel and Supabase
- You need to test a live project: the tool reads code and migrations and does not connect to the database or the app
- You need a full penetration test: this is static repository analysis, not an attack on a running system
Example request
Check this app with viberaven before release, fix one gap at a time and rerun the check after a batch of fixes.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
The rules know only migrations in supabase/migrations and code in the repository, so settings made by hand in the Supabase panel stay invisible. Two Security Advisor lints, security_definer_view and function_search_path_mutable, have no rules yet and are covered only by guides. Node.js 20 or newer is required. The version is pinned in the commands (1.7.6) and must be changed on update. The init command appends bounded rule blocks to AGENTS.md, CLAUDE.md, GEMINI.md, Cursor rules and Copilot instructions, with a preview mode before writing.
How to disable. For MCP run claude mcp remove viberaven. Delete the rule blocks between the VIBERAVEN:START and VIBERAVEN:END markers in AGENTS.md and other files by hand, along with the .viberaven folder.
FAQ
Does VibeRaven connect to my Supabase project?
No. It reads only files on your machine and sends no requests to the database or the app. No account is needed.
What does it check?
Migrations and RLS policies, the service_role key in client code and NEXT_PUBLIC_ variables, security definer functions, the Postgres pooler port, Stripe webhook signatures, the variable list in .env.example, unbounded queries and error monitoring.
How do I add it to CI?
With the check command, which exits with code 1 on a blocker. There is also the GitHub Action ohad6k/viberaven-action@v1, which comments on a pull request and with fail-on-blockers fails the job.
Which skills are included?
Six skills from skills.sh: viberaven, architecture-context, architecture-plan, what-broke, production-context and go-live. The main skill installs with npx -y skills@1.7.0 add ohad6k/VibeRaven --skill viberaven.
What is Studio?
A local page opened by npx -y viberaven@1.7.6 with no command. Your Claude Code, Codex or Gemini CLI agent makes a change in the folder while you see steps, checks, the app and the diff, with undo in one click.
Discussion
No questions or reviews yet.
Related
MCP serversA skill that audits vibe-coded apps: secrets, Supabase RLS, authorization, payments, rate limits, mobile and AI integrations
Skill that scans a project for common vibe-coding holes: keys in code, .env in git, open LLM endpoints and weak auth.
Security checks for apps an agent wrote: rules for AGENTS.md, a live-site scanner and an audit across 17 vulnerability types
A Claude Code plugin that audits Supabase and MongoDB security with a score, ready fixes, a read-only MCP server and a CLI agent.
A security CLI for coding agents: secret scanning, command policies, pre-commit hooks, third-party skill auditing
A local MCP server and CLI find vulnerabilities in AI-generated code and drive a scan, fix and rescan loop, no account needed
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| VibeRaven: Supabase and Vercel pre-launch check (this card) | no | not required | 64 | |
| Supabase MCP Server | yes | OAuth | 3,010 | an MCP for managing a Supabase project, without repository checks |
| Supabase Agent Skills | no | 3,056 | skills for working with Supabase, no vulnerability scanner in them |
README in short
The README lists checks with IDs and related Security Advisor lints, example output, run modes in a terminal, CI and agents, six skills, plugins, MCP and the local Studio. It links to guides on common Supabase mistakes.