Buy the AI Agent Launch Pack
Get the downloadable pack immediately, or use the fixed-scope checkout for one MCP report, one Supabase grants/RLS review, or one AI workflow risk review.
Choose checkout path
Fastest: Digital Pack
Use this when you want the downloadable local app, safe-intake builder, launch checklist, buyer templates, MCP/tool-call materials, and fictional sample report.
- Immediate post-payment access.
- No subscription and no account login.
- No secrets or customer records needed.
Optional: 24-hour review
Use this only after one AI workflow, one MCP artifact, or one redacted Supabase RLS policy set is clear enough for a fixed-scope review. Delivery is a concise Markdown report with top risks and fixes.
- One workflow, one redacted MCP artifact, or one redacted Supabase policy set only.
- 24-hour clock starts after payment and safe intake.
- Intake pauses if sensitive data is included.
Buy the digital pack if you want the materials now. Use the service checkout only when the boundary is one specific workflow, one redacted MCP tools/list schema, or one redacted OAuth step-up trace and you can describe it safely without secrets, private screenshots, customer records, or payment details.
MCP compatibility report
Use this fixed-scope service when your immediate problem is MCP tool metadata quality, argument-generation compatibility, or OAuth step-up trace behavior rather than a full app launch.
Good fit
- One redacted MCP
tools/listJSON result. - Schema issues such as empty
inputSchema,invalid_property_schema_shape,property_union_type_compatibility,$defs/$ref, stale fields, or flat-vs-wrapper argument mismatch. - One redacted MCP OAuth trace showing
403 insufficient_scope,WWW-Authenticate, protected-resource metadata, or missing post-403 step-up evidence. - You want a short Markdown report with findings, client-compatibility risks, and concrete regression checks.
Not included
- No source-code audit, penetration test, compliance certification, incident response, or guarantee that a server is safe.
- No private repos, secrets, customer records, cookies, OAuth grants or credential values, card/bank/tax data, or payment details in the intake.
- No execution of your MCP tools.
Supabase grants/RLS report
Use this fixed-scope service when your immediate launch risk is Supabase Data API grants, anonymous sign-in, Row Level Security policy drift, security_invoker view drift, or a redacted policy set that needs a second pass before users touch real data.
Good fit
- One redacted Supabase policy/schema/grant excerpt.
- Data API grants, permission-denied table errors, anonymous sign-in,
is_anonymous,to authenticated, invite/team/workspace membership, ownership, role, or billing-state policy questions. - Supabase MCP project-scoped branching,
create_branch,list_branches, cost-confirmation prerequisites, and migration-staging gate questions. - Public views that may have lost
security_invoker = truethrough dashboard definition copy, SQL editor edits,create or replace view, orsupabase db diffoutput. - Signup trigger failures involving
public.handle_new_user,Database error saving new user, profile inserts, or Security Advisorsearch_pathwarnings. - RPC or
SECURITY DEFINERreview where the expected caller boundary, exposed schema, defaultEXECUTEexposure, explicit grants, or RLS-bypass risk is unclear. - You want a short Markdown report with likely anonymous-user risks and concrete regression checks.
Open the free grants readiness checker first
Build a free grant migration packet
Open the free anonymous RLS matrix
Open the free Supabase MCP branching checker
Open the free signup trigger debugger
Open the free security_invoker view drift checker
Build a redacted RPC exposure packet
Open the free Security Definer RPC audit
What you get back
- One concise Markdown report for one redacted Supabase launch packet.
- Severity and likely failure mode for the most important grant, RLS, view, RPC, function, trigger, or generated-migration issue.
- Concrete no-session, anon, authenticated owner, wrong-owner, wrong-tenant, REST/RPC, or Security Advisor checks to run before launch.
- Delivery target: within 24 hours after safe intake is provided.
Not included
- No private dashboard access, database login, source-code audit, penetration test, compliance certification, incident response, or guarantee that your project is safe.
- No secrets, private connection strings, real user data, private screenshots, card/bank/tax data, payment details, or credential values in the intake.
- No execution against your production Supabase project.
Service Order Summary
Checkout after scope is agreed for the 24-hour human review path.
Included
- One AI feature, workflow, or redacted MCP tools/list schema reviewed from high-level context.
- Standalone local risk-check app, safe intake builder, and fictional sample report for reference.
- One concise Markdown report with top risks, severity, rationale, and three prioritized fixes.
Timing
- 24-hour turnaround starts after payment and safe high-level intake are complete.
- If the intake contains sensitive data, review pauses until it is redacted.
- Scope is limited to one workflow so the fixes stay practical.
Before Paying
1. Confirm scope
One AI feature or workflow, not a full application audit.
2. Keep intake safe
Use the safe intake builder or placeholders and high-level descriptions. Do not send secrets or real customer records.
3. Expect a report
Delivery is a concise Markdown report with severity, rationale, and the top three fixes.
After Payment
1. Payment checked privately
Ky confirms the real payment and actual Stripe fee outside this repo before any revenue is recorded.
2. Safe intake only
You provide a high-level description with placeholders. Sensitive content is rejected before review.
3. Report delivered
The final report stays focused on launch risk, practical fixes, and the one agreed workflow.
Do Not Send
- Secrets, API keys, OAuth tokens, cookies, passwords, or credentials.
- Card numbers, bank details, payout details, tax details, or private processor screenshots.
- Real customer records, private dashboard screenshots, or full transaction IDs.
Not Included
This is not legal advice, compliance certification, penetration testing, incident response, or a guaranteed security approval.
For the delivery workflow, run preflight_stripe_service_sale.py first, then use complete_stripe_service_sale.py only after real payment is confirmed privately and the actual Stripe fee is known.