Turn Supabase security advisories into Sentry issues
Use the Supabase and Sentry MCP servers together in Claude Code to turn security advisories into trackable Sentry issues, then schedule it to run daily.
Before you start
Tools
- Claude Code installed and running
Accounts & access
- Sentry account with at least one project
- Supabase account with an active project
Knowledge
- Basic familiarity with Claude Code and MCP servers
- Understanding of Supabase Row Level Security (RLS) concepts
1 Install and authenticate the Sentry MCP server
Run the command below to register the Sentry MCP server with Claude Code. When you launch claude, sign in with your Sentry account and grant the requested permissions.
claude mcp add --transport http sentry https://mcp.sentry.dev/mcp 2 Install and authenticate the Supabase MCP server
Same process for Supabase. Claude Code will prompt you to authenticate with your Supabase account in the browser.
Supabase MCP server documentationclaude mcp add --transport http supabase https://mcp.supabase.com/mcp 3 Fetch security advisories from Supabase
Ask Claude to pull security advisories from your Supabase project. The Supabase MCP's get_advisors tool returns issues ranked by severity: disabled Row Level Security (RLS) policies, insecure auth configs, exposed endpoints, and missing indexes.
RLS-disabled warnings are the most common finding, especially when AI agents scaffold your schema and skip security policies during setup.
Check for all the security advisories inside my Supabase project.
List them by severity and explain what each one means
and why it matters. 4 Create Sentry issues from each advisory
Now ask Claude to create a Sentry issue for each advisory. Each one lands in your Issues feed alongside regular errors, so your team triages security gaps the same way they triage bugs.
For each security advisory you just found, create a Sentry
issue in my [project-slug] project.
Include the severity level, a description of the risk,
and a suggested fix in each issue. 5 Triage advisories in your Sentry issue feed
Open Issues in Sentry. Assign owners, set priorities, and add advisories to your sprint. Treat high-severity items like disabled RLS policies the same as production bugs. With Seer enabled, it can automatically analyze new issues and suggest fixes, generating a missing RLS policy and handing it off to a Claude Code or Cursor background agent to open a PR.
Sentry Issues documentation
6 Schedule a daily advisory check
Use Claude Code's /schedule command to run this workflow daily. The automation fetches fresh advisories and creates Sentry issues for anything not already tracked.
Paired with Seer autofix, this becomes self-healing: advisories surface, issues get created, and fixes get proposed automatically. You review and merge.
Set up a daily scheduled task that:
1. Fetches all security advisories from my Supabase project
2. Compares them against existing Sentry issues to avoid duplicates
3. Creates new Sentry issues for any advisories not already tracked
4. Summarizes what was found and createdThat's it.
Your security gaps have tickets now.
Supabase advisories become Sentry issues you can assign, prioritize, and fix through your normal workflow.
- Connected the Supabase and Sentry MCP servers in Claude Code
- Fetched security advisories (missing RLS policies, insecure configs) from Supabase
- Created Sentry issues from each advisory for your normal triage flow
- Scheduled a daily automation to repeat this check
Pro tips
- 💡 Also check for performance advisories. The
get_advisorstool returns both security and performance issues, and a missing index that's fine with 40 rows can become a 10-second query at scale. - 💡 Supabase provides MCP skills for creating efficient RLS policies. Claude can use them to generate correct policies rather than generic templates.
- 💡 Include the advisory severity level in the Sentry issue title so your team can sort by urgency at a glance.
- 💡 Run this right after scaffolding a project with an AI agent. Agents often skip security setup like RLS during initial scaffolding, and this can catch those gaps before they ship.
Common pitfalls
- ⚠️ Complete the OAuth flow for both MCP servers before prompting Claude. Incomplete auth causes silent failures or empty results.
- ⚠️ Don't skip deduplication when scheduling recurring checks. Without it, you'll create duplicate Sentry issues every run.
- ⚠️ The Supabase MCP uses service_role keys that bypass RLS by design. Prefer read-only mode for projects close to production.
- ⚠️ Not every advisory needs an immediate fix. Deprioritize low-severity performance suggestions and focus on critical gaps like missing RLS policies.
Frequently asked questions
What's next?
Fix it, don't observe it.
Get started with the only application monitoring platform that empowers developers to fix application problems without compromising on velocity.