What can your AI agent destroy?

A free, read-only check for Supabase apps. It finds the keys, MCP servers and settings that give an agent too much power.

Run the free check Get it fixed 
$ karchi-guard scan ./my-app

BLAST RADIUS: an AI agent working here has enough access to:
  - read every row in every table          (B1 .env:2)
  - run any SQL, including DROP TABLE      (B2 .mcp.json:7)
  - delete the whole project, and its backups (B2 .mcp.json:7)
  - reach every project in your account    (B2 .mcp.json:7)

8 findings: 2 CRITICAL, 5 HIGH, 1 MEDIUM

[CRITICAL] B3 Supabase MCP server 'supabase' is not read-only
  Fix: add read_only=true to the URL
Shortened from a real run on a test repo with fake keys. Secret values are never printed.

AI tools write the code. Nobody checks what the agent can reach.

Apps built with Lovable, Bolt, Cursor or Claude Code often keep a service key in .env, an MCP server with write access, and no backup outside Supabase. An agent that goes wrong can use all of it.

An agent deleted production in 9 seconds.

In April 2026 a Cursor agent deleted a production data volume and its backups, using a token it found in an unrelated file.

Incident report (OECD)

Deleting a Supabase project deletes its backups.

A token that can delete your project can also take your backups with it. A copy outside Supabase is the only safe copy.

Supabase docs

What the free check looks at

It reads files in your repo, and with --home your agent configs too. No network, no database, no account.

B1 B2Keys an agent can read

  • service_role and sb_secret_ keys in files, .env and your built frontend
  • Keys in VITE_ or NEXT_PUBLIC_ variables, which ship to every visitor
  • Supabase access tokens and database passwords

B3 B4Supabase MCP server

  • Not read-only, so the agent can change data and drop tables
  • Not limited to one project, so it reaches your whole account

B6Claude Code rules

  • Would it stop supabase db reset --linked, supabase projects delete or drop table?
  • Can it read .env without asking?
  • Is it in bypassPermissions mode?

B7Backups

  • Is there a dump job that stores a copy outside Supabase?

Run it in one minute

Python 3.11 or newer. Nothing else to install. It exits with code 1 on any critical finding, so it can fail a CI job.

On your machine

git clone https://github.com/karthikkushi/karchi-guard
cd karchi-guard
PYTHONPATH=src python3 -m karchi_guard scan /path/to/your/app

In GitHub Actions

- uses: actions/checkout@v4
- uses: karthikkushi/karchi-guard@v0

Rather not fix it yourself?

I run three checks on a local copy of your schema, write a plain-English report, and send the fix as a pull request.

  1. You give written permission and share the repo. I never connect to your live database.
  2. I build a local copy from your migrations and run Karchi Guard, the Supabase Security Advisor, and a user A vs user B test with real test accounts. I also read every database function that skips RLS.
  3. You get a report that says what is wrong, why it matters and how bad it is. Table and column names only, never your data. See a sample report.
  4. You get a pull request with the RLS migration and safer agent settings, plus a before and after check. You decide whether to merge.
$49

One Supabase project, up to about 15 tables. Delivered in 48 hours.

  • Report with fix SQL
  • User A vs user B leak test
  • Pull request with the fixes
  • Re-check after the fix
Request a fix

Honest limits

I never

  • Scan or test an app without the owner's written permission
  • Connect to your live database or copy user data
  • Upload your code or keys anywhere. The free check runs on your machine
  • Call an app "100% secure"

The free check does not cover

  • RLS policies. Run supabase db advisors --type security
  • Whether user A can read user B's rows. The $49 fix tests this
  • Keys in old git commits. Run gitleaks
  • Cursor and Windsurf command allowlists

Questions

Do you need my Supabase keys?

No. The free check reads files on your machine. For the $49 fix I only need the repo, or a schema-only dump with no data. Keys that leaked should be rotated by you, in your own dashboard.

Supabase already has a Security Advisor. Why do I need this?

Use the Advisor; the fix includes it. It checks your database rules. It does not check what your AI agent can reach. In our test app it also missed a policy that let any logged-in user read every order. The user A vs user B test caught it.

Is this made by Supabase, Lovable or Anthropic?

No. Karchi Guard is an independent open-source project (MIT license) by Karthik, a developer in India.