RowAttest

com.rowattest/rowattestVersion 1.0.1

Runs an eight-stage isolation test against your staging Supabase and issues a signed attestation.

Status

Responds200 msNov 14, 2026, 14:13 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:13 UTC
Latency: 200 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://app.rowattest.com/mcpResponds200 msNov 14, 2026, 14:13 UTC

No sign-in

Claude Code

claude mcp add --transport http rowattest https://app.rowattest.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: rowattest
Remote MCP server URL: https://app.rowattest.com/mcp

Cursor

{
  "mcpServers": {
    "rowattest": {
      "url": "https://app.rowattest.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"rowattest","type":"http","url":"https://app.rowattest.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

7 tools

Tools of RowAttest
	Description		Read-only	Idempotent	Open world
`get_findings`Returns the cells that did not pass in a complete run that has a signed report — verdict, surface, operation, boundary, identity, layer outcomes and notes — plus tenancy flags, blocking findings and, when the report includes catalog hygiene checks, the hygiene block (the checks run, each finding's check, severity, object, detail and hint, and any check not run). For a complete run with no signed report, while one can still be bought on the run page, it returns the run's unverified result instead: the verdict, surface, operation and principal of each cell that did not pass, the run page's finding lines, the counts, the coverage lines, the access model summary and the same hygiene block. The list of cells is empty when every tested cell passed. Cell results contain no fix suggestions: the engine records only what it observed. Hygiene findings are catalog observations, never verdicts; each carries the engine's one-line hint for the project owner's review.	Returns the cells that did not pass in a complete run that has a signed report — verdict, surface, operation, boundary, identity, layer outcomes and notes — plus tenancy flags, blocking findings and, when the report includes catalog hygiene checks, the hygiene block (the checks run, each finding's check, severity, object, detail and hint, and any check not run). For a complete run with no signed report, while one can still be bought on the run page, it returns the run's unverified result instead: the verdict, surface, operation and principal of each cell that did not pass, the run page's finding lines, the counts, the coverage lines, the access model summary and the same hygiene block. The list of cells is empty when every tested cell passed. Cell results contain no fix suggestions: the engine records only what it observed. Hygiene findings are catalog observations, never verdicts; each carries the engine's one-line hint for the project owner's review.	Not declared	Yes	Not declared	No
`get_report`Returns the full signed report of a complete run as the exact stored JSON, with its verify_url and report_sha256 (sha256 of the canonical signed bytes, the fingerprint shown on the verify page). Use get_findings for the compact view.	Returns the full signed report of a complete run as the exact stored JSON, with its verify_url and report_sha256 (sha256 of the canonical signed bytes, the fingerprint shown on the verify page). Use get_findings for the compact view.	Not declared	Yes	Not declared	No
`get_run_status`Returns a run's status (queued, running, complete or failed), its current stage, timestamps and, when a signed report exists, its verify_url.	Returns a run's status (queued, running, complete or failed), its current stage, timestamps and, when a signed report exists, its verify_url.	Not declared	Yes	Not declared	No
`list_projects`Lists the Supabase projects connected to this account with id, name, connection state and whether each is ready to run. Call this first to get a project_id.	Lists the Supabase projects connected to this account with id, name, connection state and whether each is ready to run. Call this first to get a project_id.	Not declared	Yes	Not declared	No
`run_review`Starts an authorization test run on a connected project and returns the run_id and status. If the project already has a run waiting to start, returns that run instead of starting another. Runs that do not fail count against the monthly allowance.	Starts an authorization test run on a connected project and returns the run_id and status. If the project already has a run waiting to start, returns that run instead of starting another. Runs that do not fail count against the monthly allowance.	No	No	No	No
`verify_attestation`Checks a RowAttest attestation published by a site or MCP server. Give it the origin (for example https://example.com); it fetches /.well-known/rowattest.json there, follows the first entry to the signed summary, verifies the signature offline against RowAttest's public key list, and returns whether the proof is valid, when it was issued, its totals, whether findings were present, and whether it is bound to the project ref you pass. It reads public data only, needs no project of yours, and starts no run. A valid proof means the listed checks ran at that time and were signed by RowAttest; it does not mean the application is secure.	Checks a RowAttest attestation published by a site or MCP server. Give it the origin (for example https://example.com); it fetches /.well-known/rowattest.json there, follows the first entry to the signed summary, verifies the signature offline against RowAttest's public key list, and returns whether the proof is valid, when it was issued, its totals, whether findings were present, and whether it is bound to the project ref you pass. It reads public data only, needs no project of yours, and starts no run. A valid proof means the listed checks ran at that time and were signed by RowAttest; it does not mean the application is secure.	Not declared	Yes	Not declared	Yes
`wait_for_run`Waits up to timeout_seconds (1 to 60) for a run to finish, then returns the same information as get_run_status. Call it again while the status is still queued or running.	Waits up to timeout_seconds (1 to 60) for a run to finish, then returns the same information as get_run_status. Call it again while the status is still queued or running.	Not declared	Yes	Not declared	No

Details

Registry status: Active
Published: Oct 27, 2026
Updated: Oct 27, 2026
Website: https://rowattest.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Project managementSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing