# Turn Supabase Security Advisories into Sentry Issues

> Wire up the Supabase and Sentry MCP servers in Claude Code to fetch security advisories and turn them into trackable issues in your normal triage flow.

**URL:** https://sentry.io/cookbook/supabase-advisories-to-sentry-issues/

---

Use the Supabase and Sentry MCP servers in Claude Code to turn security advisories (like missing RLS policies) into trackable Sentry issues, then schedule the check to run daily.

**Time:** 15–20 minutes | **Difficulty:** Intermediate

## What You'll Learn

- Connected the Supabase and Sentry MCP servers in Claude Code

- Fetched security advisories (missing RLS policies, insecure configs) from Supabase

- Created Sentry issues from each advisory for your normal triage flow

- Scheduled a daily automation to repeat this check

**Topics:** Sentry MCP, Issues

## Before you start

**Tools**

- [Claude Code](https://claude.ai/code) installed and running

**Accounts & access**

- [Sentry account](https://sentry.io/signup/) with at least one project

- [Supabase account](https://supabase.com/dashboard) with an active project

**Knowledge**

- Basic familiarity with Claude Code and MCP servers

- Understanding of Supabase Row Level Security (RLS) concepts

## Steps

### 1. Install and authenticate the Sentry MCP server

Run the command below to register the Sentry MCP server with Claude Code. When you launch `claude`, sign in with your Sentry account and grant the requested permissions.

```bash
claude mcp add --transport http sentry https://mcp.sentry.dev/mcp
```

[Sentry MCP server documentation](https://mcp.sentry.dev/)

### 2. Install and authenticate the Supabase MCP server

Same process for Supabase. Claude Code will prompt you to authenticate with your Supabase account in the browser.

```bash
claude mcp add --transport http supabase https://mcp.supabase.com/mcp
```

[Supabase MCP server documentation](https://supabase.com/docs/guides/ai-tools/mcp)

### 3. Fetch security advisories from Supabase

Ask Claude to pull security advisories from your Supabase project. The Supabase MCP's `get_advisors` tool returns issues ranked by severity: disabled Row Level Security (RLS) policies, insecure auth configs, exposed endpoints, and missing indexes.

RLS-disabled warnings are the most common finding, especially when AI agents scaffold your schema and skip security policies during setup.

```text
Check for all the security advisories inside my Supabase project.

List them by severity and explain what each one means
and why it matters.
```

### 4. Create Sentry issues from each advisory

Now ask Claude to create a Sentry issue for each advisory. Each one lands in your [Issues](https://sentry.io/orgredirect/organizations/:orgslug/issues/) feed alongside regular errors, so your team triages security gaps the same way they triage bugs.

```text
For each security advisory you just found, create a Sentry
issue in my [project-slug] project.

Include the severity level, a description of the risk,
and a suggested fix in each issue.
```

### 5. Triage advisories in your Sentry issue feed

Open [Issues](https://sentry.io/orgredirect/organizations/:orgslug/issues/) in Sentry. Assign owners, set priorities, and add advisories to your sprint. Treat high-severity items like disabled RLS policies the same as production bugs.

With [Seer](https://sentry.io/orgredirect/organizations/:orgslug/settings/seer/) enabled, it can automatically analyze new issues and suggest fixes, generating a missing RLS policy and handing it off to a Claude Code or Cursor background agent to open a PR.

[Sentry Issues documentation](https://docs.sentry.io/product/issues/)

### 6. Schedule a daily advisory check

Use Claude Code's `/schedule` command to run this workflow daily. The automation fetches fresh advisories and creates Sentry issues for anything not already tracked.

Paired with Seer autofix, this becomes self-healing: advisories surface, issues get created, and fixes get proposed automatically. You review and merge.

```text
Set up a daily scheduled task that:
1. Fetches all security advisories from my Supabase project
2. Compares them against existing Sentry issues to avoid duplicates
3. Creates new Sentry issues for any advisories not already tracked
4. Summarizes what was found and created
```

## Summary

**Your security gaps have tickets now.**

Supabase advisories become Sentry issues you can assign, prioritize, and fix through your normal workflow.

## Pro Tips

- Also check for performance advisories. The `get_advisors` tool returns both security and performance issues, and a missing index that's fine with 40 rows can become a 10-second query at scale.

- Supabase provides MCP skills for creating efficient RLS policies. Claude can use them to generate correct policies rather than generic templates.

- Include the advisory severity level in the Sentry issue title so your team can sort by urgency at a glance.

- Run this right after scaffolding a project with an AI agent. Agents often skip security setup like RLS during initial scaffolding, and this can catch those gaps before they ship.

## Common Pitfalls

- Complete the OAuth flow for both MCP servers before prompting Claude. Incomplete auth causes silent failures or empty results.

- Don't skip deduplication when scheduling recurring checks. Without it, you'll create duplicate Sentry issues every run.

- The Supabase MCP uses service_role keys that bypass RLS by design. Prefer read-only mode for projects close to production.

- Not every advisory needs an immediate fix. Deprioritize low-severity performance suggestions and focus on critical gaps like missing RLS policies.

## FAQ

**Do I need paid plans for Sentry and Supabase?**

No. Both MCP servers work on free tiers. Seer autofix and extended data retention require paid Sentry plans.

**What types of advisories does Supabase surface?**

Security issues (missing RLS policies, exposed service keys, insecure auth) and performance issues (missing indexes, slow queries). Both can be turned into Sentry issues.

**Can I use this with other AI coding tools?**

Yes. Both the Sentry and Supabase MCPs are widely supported across platforms like Cursor, Codex, and other clients. To see other configuration options, check out the [Sentry MCP server](https://mcp.sentry.dev/).

**Is my Supabase data sent to Anthropic?**

Advisory data (schema metadata and configuration, not application data) becomes part of your Claude conversation context. Review Anthropic's and Supabase's data policies if you have compliance requirements.

**What about duplicate issues on consecutive scheduled runs?**

The Step 6 prompt includes a deduplication check against existing Sentry issues. You can also use Sentry's merge feature to combine duplicates manually.

## Next Steps

- [product/seer](https://sentry.io/product/seer/)

- [product/error-monitoring](https://sentry.io/product/error-monitoring/)

- [Debug faster with Sentry MCP and Claude Code](/cookbook/debug-with-sentry-mcp-claude-code/): Learn how to use the Sentry MCP server to pull issues, read traces, and apply fixes directly in Claude Code.

---

*Source: [sentry.io/cookbook/supabase-advisories-to-sentry-issues/](https://sentry.io/cookbook/supabase-advisories-to-sentry-issues/)*