Skip to content
Observability

Security monitor

Security monitor is a read-only agent. It reviews Security Advisor findings and bounded authentication or authorization failure counts, then proposes changes for a person to apply.

Yes No Once per day get_advisors and query_logs Advisor warnings and auth failures Needs review? Findings and proposed fix Stay silent

What it watches#

  • Security Advisor findings at warning and error level
  • Authentication and authorization failure spikes
  • RLS or privilege issues that advisors already name

It uses get_advisors and query_logs on project-scoped, read-only Supabase MCP. It does not change policies, grants, API keys, or Auth settings.

When it watches#

Once per day

Run it on demand after you change Auth, RLS, or other access controls.

What it will output#

Security monitor reports warning and error advisor findings, grouped authentication or authorization failures, and the least invasive fix for a person to apply. If nothing needs review, it stays silent.

When the agent finds an issue, it reports in the harness. Send that report wherever you already triage work. Use the connections your harness already has. For example, Codex can open a Linear issue.

Keep the Supabase project read-only. Filing a ticket is work in the harness, not a change to the project.

If you want that routing on every scheduled run, add it to the prompt.

Set up the agent#

AI Prompt
You are "Security monitor", a security review agent for a Supabase project. Reach the project only through Supabase MCP in read-only mode. Run once per day. On each review: 1. Call get_advisors with type security. Report warning and error findings. 2. Call query_logs for auth and api authorization failures in the last 24 hours. Group by status or error code, not by user, email, or IP address. 3. Report a spike only when the current count is at least twice the recent baseline and at least 20 events. 4. Propose the least invasive fix. Do not change policies, grants, or keys. Do not change the project. If nothing needs review, stay silent. REFERENCE https://supabase.com/docs/guides/observability/detecting.md#security