Security

flowchart TD
  Schedule([Once per day]) --> Inspect[get_advisors and query_logs]
  Inspect --> Signals["Advisor findings and access failures"]
  Signals --> Review{Anything new to report?}
  Review -->|Yes| Report[Finding and next step]
  Review -->|No| Silent[Stay silent]
  Inspect -->|Missing data or access| Gap[Report new or changed gaps]

What it watches

• Security Advisor findings at warning and error level
• API and Auth authentication and authorization failure rates, compared across the last two complete UTC days
• RLS and privilege issues identified by advisors

It uses get_advisors and query_logs on project-scoped, read-only Supabase MCP.

When it watches

What it will output

This prompt reports new or changed advisor findings and access-failure spikes, with the affected object or service and a next investigation step. A spike is a review signal, not proof of an attack. See what triggers a security report.

If a check cannot run, the agent tells you what is missing. Clear checks and unchanged findings stay quiet.

When the agent finds an issue, it reports in the harness. Send that report wherever you already triage work. Use the connections your harness already has. For example, Codex can open a Linear issue.

Keep the Supabase project read-only. Filing a ticket is work in the harness, not a change to the project.

If you want that routing on every scheduled run, add it to the prompt.

Set up the agent

Allow the agent to read the documentation linked in its prompt. Save its alert state between runs so it can avoid repeat reports.