GuardLayer MCP Server

by solvionholdings Your server? Claim it

answering

GuardLayer is answering right now. Last checked 8 min ago. It exposes 3 tools. Last commit 10 Nov 2026.

Security checks for Next.js + Supabase apps: code scan, read-only live DB check, fix confirmation.

Uptime history 8 hours of history

8 hours agonow

100.0%

Uptime 24h

29 of 29 checks

Tools

read from the server

507 ms

Response time

average over 24h

Stars

last commit 10 Nov 2026

Nothing serious here today

Today is the operative word: we check GuardLayer every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 8 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add guardlayer --transport http https://www.guardlayer.io/api/mcp

Settings → Connectors → Add custom connector, then paste this address

https://www.guardlayer.io/api/mcp

~/.codex/config.toml

[mcp_servers.guardlayer]
url = "https://www.guardlayer.io/api/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "guardlayer": {
      "url": "https://www.guardlayer.io/api/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "guardlayer": {
      "type": "http",
      "url": "https://www.guardlayer.io/api/mcp"
    }
  }
}

Available tools 3

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

supabase

check_supabase_snapshot

Checks the JSON from get_supabase_snapshot_sql: tables anyone can read, RLS off, policies that only check for a signed-in user (public in practice when sign-ups are open), users who can update their own role or plan columns, exposed SECURITY DEFINER functions, public buckets. Pass auth_config (the project's Auth settings) when you can: it decides whether 'any signed-in user' means anyone. Pass previous_issue_keys from an earlier result to see what is closed, still open or new. Returns each issue with its SQL fix and a fix prompt.

get_supabase_snapshot_sql

Returns the read-only SQL for the live Supabase check and how to run it. It reads only catalog metadata (table and column names, RLS flags, policies, grants, triggers, SECURITY DEFINER functions, bucket settings), never table rows, and returns one JSON value.

scan

scan_files

Static security scan of a Next.js + Supabase codebase: secrets in code or public env vars (NEXT_PUBLIC_, VITE_), service role keys in client code, RLS off or open policies in supabase/migrations, unauthenticated API routes, Server Actions and Edge Functions, unsafe redirects and more. Send source files (ts, tsx, js, jsx, sql, .env*, config files) with paths relative to the project root; skip node_modules, build output and lockfiles. Up to 300 files and 4 MB per call; split bigger projects. Files are scanned in memory and discarded.

Endpoints

URL	Transport	State	Latency	Checked
https://www.guardlayer.io/api/mcp	streamable-http	answering	301 ms	8 min ago

Alternatives to GuardLayer

same job, measured the same way

Redproof

by howlinman24

Security checks for apps built with AI tools: scan a GitHub repo and read the fix prompts.

local only

Jikida

by jikida

Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.

85 installs/wk local only

Valca

by pranlabs

Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.

144 installs/wk local only

MCP Codeaudit

by infoinlet-marketplace

Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.

74 installs/wk local only

Rich Text Format MCP

by mrfentmen

Rich Text Format MCP: read, check, lint, scaffold and run code.

local only

Glyph Bitmap Distribution Format MCP

by mrfentmen

Glyph Bitmap Distribution Format MCP: read, check, lint, scaffold and run code.

local only

Spline Font Database MCP

by mrfentmen

Spline Font Database MCP: read, check, lint, scaffold and run code.

local only

Valve Data Format MCP

by mrfentmen

Valve Data Format MCP: read, check, lint, scaffold and run code.

local only

GuardLayer — questions

Answers built from our own checks of this server.

What can GuardLayer do?

It exposes 3 tools, read directly from the server on our last check. Among them: check_supabase_snapshot, get_supabase_snapshot_sql, scan_files. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is GuardLayer working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 29 of 29 checks got a reply (100.0%), average response time 507 ms. The bar chart above shows every period we have measured.

How do I connect GuardLayer?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does GuardLayer need an API key?

No. GuardLayer completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 3 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is GuardLayer?

It answers our handshake in 507 ms on average, which is faster than 22% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is GuardLayer open source?

The code is open source: it is published under the MIT licence and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at guardlayer.io, which runs on its operator's own terms.