v0.2.0 — +5 audit checks

Synced 5 new checks from supabase-security-skill v0.2.0:

• realtime_publication_no_rls (CRITICAL)
• anonymous_signins_enabled (HIGH)
• weak_password_policy (MEDIUM)
• no_captcha_on_auth (MEDIUM)
• function_no_search_path (MEDIUM)

Tools unchanged. apply_fix and apply_all_fixes work transparently for new findings.

v0.1.0 — First MCP server that closes the loop

Audit + preview + apply Supabase security fixes from inside Claude/Cursor/Cline.

5 tools: audit_project, list_findings, preview_fix, apply_fix, apply_all_fixes.

Safety: all apply tools require confirm=true; preview_fix uses BEGIN+ROLLBACK; apply_all_fixes wraps everything in a single transaction.

Differentiator vs every other Supabase scanner: this one remediates. SupaExplorer, AuditYourApp, Vibe App Scanner all just report. This applies the fix and re-audits to verify.

Install in any MCP client:

{
  "mcpServers": {
    "supabase-security": {
      "command": "npx",
      "args": ["-y", "@perufitlife/supabase-security-mcp@latest"],
      "env": { "SUPABASE_ACCESS_TOKEN": "sbp_xxx" }
    }
  }
}