RowAttest
Runs an eight-stage isolation test against your staging Supabase and issues a signed attestation.
| Endpoint | https://app.rowattest.com/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.1 |
| Now | 7 tools · grade A (92) · pin ts_470e76f65440337e1254bc5b46fed984 · protocol 2025-06-18 |
| First / last listed | 2026-11-12 02:28 UTC / 2026-11-12 02:28 UTC |
| Grade over time | 2026-11-12: A (92), 7 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: list_projects run_review get_run_status wait_for_run get_findings get_report verify_attestation
list_projects | Lists the Supabase projects connected to this account with id, name, connection state and whether each is ready to run. Call this first to get a project_id. params: none |
run_review | Starts an authorization test run on a connected project and returns the run_id and status. If the project already has a run waiting to start, returns that run instead of starting another. Runs that do not fail count against the monthly allowance. params: project_id*, label, attest |
get_run_status | Returns a run's status (queued, running, complete or failed), its current stage, timestamps and, when a signed report exists, its verify_url. params: run_id* |
wait_for_run | Waits up to timeout_seconds (1 to 60) for a run to finish, then returns the same information as get_run_status. Call it again while the status is still queued or running. params: run_id*, timeout_seconds |
get_findings | Returns the cells that did not pass in a complete run that has a signed report — verdict, surface, operation, boundary, identity, layer outcomes and notes — plus tenancy flags, blocking findings and, when the report includes catalog hygiene checks, the hygiene block (the checks run, each finding's check, severity, object, detail and hint, and any check not run). For a complete run with no signed r params: run_id* |
get_report | Returns the full signed report of a complete run as the exact stored JSON, with its verify_url and report_sha256 (sha256 of the canonical signed bytes, the fingerprint shown on the verify page). Use get_findings for the compact view. params: run_id* |
verify_attestation | Checks a RowAttest attestation published by a site or MCP server. Give it the origin (for example https://example.com); it fetches /.well-known/rowattest.json there, follows the first entry to the signed summary, verifies the signature offline against RowAttest's public key list, and returns whether the proof is valid, when it was issued, its totals, whether findings were present, and whether it i params: origin*, project_ref, fingerprint |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.