VibeRaven MCP Server

Use this when the user asks what a VibeRaven finding id means, for example rls_disabled or env_var_drift, or pastes a finding from a VibeRaven 1.6.12 report. Returns what the rule detects in repository files, why it matters, how to fix it and what it does not check, quoted from viberaven.dev with a source link for each part. It does not read the user's repository, database or Vercel project. Known ids: rls_disabled, rls_no_policies, rls_policy_allows_all_read, rls_policy_allows_all_write, security_definer_function_executable, pooler_port_mismatch, service_role_key_in_client_code, env_var_drift. An unknown id returns found: false and the list of known ids.

Use this when the user has a launch question about an AI-built app on Vercel + Supabase, such as Supabase RLS, env vars on Vercel, a Stripe webhook after deploy or a client handoff. Searches the launch guides published on viberaven.dev by keyword and returns up to 5 matches, each with its title, URL and the short answer from the page. It only searches those published pages: it does not browse the web or read the user's project. No match returns an empty list.

Use this when the user wants a manual pre-launch checklist for a Lovable + Supabase app or a Next.js + Supabase app on Vercel. Returns the checklist published on viberaven.dev for that stack with its sources, and the one optional local VibeRaven step (`npx -y [email protected] check`), which is advice, not a gate. The items are manual checks the user does in their dashboards and code; this tool does not run any of them.

Use this when the user wants their Supabase migrations checked for RLS gaps before launch, asks whether the Supabase October 30, 2026 Data API grants change will break their tables, or asks whether a security definer function is callable by anon or by signed-in users. Pass the SQL text: sql for one migration, or files with path and content for several, in the repo's file names. It runs the SQL rules of the VibeRaven 1.6.12 CLI and returns each finding with id, severity, file and line in the text passed, a one-line fix and a guide link. Finding ids: rls_disabled (table without RLS), rls_no_policies (RLS on, no policies), rls_policy_allows_all_read and rls_policy_allows_all_write (using (true) or with check (true) for anon, authenticated or public), security_definer_function_executable (EXECUTE not revoked from anon or authenticated), data_api_grant_without_rls (table granted to anon or authenticated with RLS off), data_api_grant_missing (the browser queries a table that has no grant once default grants are off). data_api_grant_missing needs the migration that revokes default privileges or supabase/config.toml, plus the browser files that call supabase.from(...) (a "use client" file, or src files with package.json for a Vite app). It is a static read of the text passed: it does not connect to the database, does not run the SQL and does not see the rest of the repository. Up to 200 KB in 50 files. The text is processed in memory, not stored and not logged.