How do I install Securealy?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

Is Securealy official?

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

How is the trust score calculated?

This listing scores 55 (Fair). The formula is published on the methodology page.

MCPpedia

Securealy MCP Server — Install for Claude, Cursor & VS Code | MCPpedia

Securealy MCP Server

Name: Securealy MCP Server
Author: securealy

Grade a URL as an attacker and a customer would see it; scan a repo; check Supabase, Stripe, Vercel.

Tools Versions Alternatives

Registrysecurealy

55Fair

Install

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "securealy-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "securealy-mcp@0.1.6"
      ],
      "env": {
        "SUPABASE_URL": "",
        "SUPABASE_SERVICE_KEY": "YOUR_SUPABASE_SERVICE_KEY",
        "SUPABASE_MGMT_TOKEN": "YOUR_SUPABASE_MGMT_TOKEN",
        "SUPABASE_PROJECT_REF": "",
        "STRIPE_SECRET_KEY": "YOUR_STRIPE_SECRET_KEY",
        "VERCEL_TOKEN": "YOUR_VERCEL_TOKEN",
        "VERCEL_PROJECT_ID": "",
        "SECUREALY_VERCEL_DECRYPT": "",
        "SECUREALY_SUPABASE_HOST_OVERRIDE": "",
        "SECUREALY_SCAN_ROOTS": "",
        "SECUREALY_NO_HISTORY": "",
        "SECUREALY_TELEMETRY": ""
      }
    }
  }
}

Install guide

Related servers

TerraVision

75Good

Draw cloud architecture diagrams with official AWS, Azure and GCP icons from a prompt or Terraform.

Registrypatrickchugh1.7K stars

openInvest

72Good

Investment runtime for AI agents — LLM investment committee, portfolio ledger, decision accounting

Environment

Name	Required	Notes
SUPABASE_URL	No	Optional. Your Supabase project URL, read by check_rls. Sent only to that project.
SUPABASE_SERVICE_KEY	No	Optional. Service role key for check_rls. Sent only to your Supabase project, never printed. Secret.
SUPABASE_MGMT_TOKEN	No	Optional. Supabase management token for check_rls and the auth config check. Sent only to the Supabase management API. Secret.
SUPABASE_PROJECT_REF	No	Optional. Supabase project ref, used with SUPABASE_MGMT_TOKEN.
STRIPE_SECRET_KEY	No	Optional. Stripe secret key for check_stripe. Sent only to api.stripe.com, never printed. Secret.
VERCEL_TOKEN	No	Optional. Project-scoped Vercel token for check_vercel_env. Sent only to api.vercel.com, never printed. Secret.
VERCEL_PROJECT_ID	No	Optional. Vercel project id for check_vercel_env.
SECUREALY_VERCEL_DECRYPT	No	Optional. Set to 1 to let check_vercel_env fetch decrypted variable values from api.vercel.com for the trailing-newline and live-key checks. Without it only names and targets are read and those checks are reported as skipped.
SECUREALY_SUPABASE_HOST_OVERRIDE	No	Optional. Set to 1 to let check_rls send the service key to a self-hosted Supabase URL. Without it the key is sent only to an https URL on a Supabase-hosted domain.
SECUREALY_SCAN_ROOTS	No	Optional. Folders, separated by the OS path delimiter, that scan_repo may read in addition to the server's working directory. Anything outside is refused.
SECUREALY_NO_HISTORY	No	Optional. Set to 1 to stop the server appending each run (grade, score, counts, failing check ids; never evidence) to .securealy/history.json in its working directory.
SECUREALY_TELEMETRY	No	Optional, off by default. Set to 1 to send an anonymous aggregate of each run (command, grade, counts, stack kind, failing check ids; no URL, host or evidence) to securealy.com.

Securealy MCP Server

Install

Related servers

TerraVision

openInvest

Environment

Tools

About

FAQ

Reviews

Supabase

Azure MCP Server

mcp-ssh-manager

agentpack