Finds the places where any user can read or change another user's data in your app.
Maps every data access path, checks who is allowed to call it and whether the row belongs to the caller, with specific checks for Supabase RLS, Next.js middleware, Prisma queries and Express routes.
2 skills · 2 MCP servers · 4 settings
Access Control Auditor answers one question for every piece of data in your app: who can read or change it, and did the code actually check? It maps API routes, server actions, Supabase queries, Prisma calls and Express handlers, then checks three things on each: is the caller authenticated, is the caller allowed to do this action, and does the row they are touching belong to them.
It has dedicated checks for the mistakes that AI-assisted apps make most: Supabase tables with Row Level Security off or with a permissive policy, the service_role client used from a request handler, Next.js middleware that protects pages but not API routes, admin flags read from the request body or a cookie, and IDs taken from the URL and passed straight to the database.
It only reads files. It needs the filesystem and git MCP servers pointed at the app root. Optionally tell it the role names your app uses.