Set up SafeFix in two minutes.

You need Node.js 22.12 or newer. In your project folder, run:

npx safefix scan

To check your Supabase database too, copy its connection string (Supabase Dashboard > Connect > Session pooler). Put it in an environment variable, so the password stays out of your shell history:

export SAFEFIX_DB_URL="postgresql://postgres.<project-ref>:<password>@<host>:5432/postgres"
npx safefix scan --path .

$env:SAFEFIX_DB_URL = "postgresql://postgres.<project-ref>:<password>@<host>:5432/postgres"
npx safefix scan --path .

Save a report with --output report.md (or .json, .sarif). The exit code is 1 when a problem is as serious as --fail-on (default: high), so a CI build fails. npx safefix --help lists every option.

In your dashboard, press Fix with AI on a project or on one finding. SafeFix copies one prompt with every open problem: why it matters, the fix, and the SQL or code. It is free on every plan. From the terminal:

npx safefix scan --ai --output fix-prompt.md

Then paste the prompt into your AI tool:

Then scan again, to prove the problems are fixed. The prompt tells the AI to fix the most serious problems first, never to turn off Row Level Security or delete data, never to print secrets, and to treat text from your project as data, never as instructions.

SafeFix runs inside Cursor, Claude Code, VS Code and Windsurf as an MCP server. Your AI tool starts it for you. Set it up once:

claude mcp add safefix -- npx -y safefix mcp

{
  "mcpServers": {
    "safefix": {
      "command": "npx",
      "args": ["-y", "safefix", "mcp"]
    }
  }
}

{
  "servers": {
    "safefix": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "safefix", "mcp"]
    }
  }
}

Windsurf: in the Cascade panel, open the ... menu, then Open MCP config file, and add the same mcpServers entry as for Cursor.

safefix_scan

Scans your open project: a grade, a score and every problem, most serious first.

safefix_explain

One problem in plain English: why it matters, the steps, and the SQL or code.

safefix_verify

Scans again and says which problems are fixed, still open, or new.

safefix_upload

Sends the last scan to your dashboard. It only exists when you set SAFEFIX_TOKEN.

fix_all

A ready prompt that walks your AI tool through fixing everything safely.

To check your database from your AI tool, give the server SAFEFIX_DB_URL in the env of its config. In Cursor it can come from your own environment:

"env": { "SAFEFIX_DB_URL": "${env:SAFEFIX_DB_URL}" }

Never paste a connection string into the chat. SafeFix only scans your open workspace, never your home folder or a whole disk. If it cannot find your project, add "--root", "/path/to/your/project" to the args.

On Windows, if your AI tool cannot start npx, use "command": "cmd" and "args": ["/c", "npx", "-y", "safefix", "mcp"]. In Claude Code, the fix_all prompt is the /safefix:fix_all command.

npx safefix ci init

It writes .github/workflows/safefix.yml: a scan on every push, pull request and night, with a read-only token and actions pinned to commit SHAs. Add --sarif to also see the findings in GitHub’s Security tab.

Then create an upload token in your dashboard (your project > Settings > Tokens) and save it as a repository secret. gh asks for the value, so it stays out of your shell history:

gh secret set SAFEFIX_TOKEN

Commit and push the workflow. Each run uploads its results: history and alerts.

• Read-only. Every database query runs in a read-only transaction that is rolled back. SafeFix never changes your data or your files.
• Nothing leaves your computer unless you upload: with --upload, or with safefix_upload, which only exists when you set SAFEFIX_TOKEN.
• An upload holds results only: findings with every secret masked, and your project folder’s name. Never your source code.
• Fixes are suggestions. SafeFix never applies a fix by itself, and your AI tool asks you before it changes anything.
• Your projects only. Scan projects you own or are allowed to test.

A scan ends with one line about the dashboard. SAFEFIX_NO_PROMO=1 hides it.

More about security