Scan in 60 seconds

Grade your own agent setup from A to F with one command. Nothing leaves your machine.

Before you start

Node 22.12 or later, for npx. No account, no key, no server.
A project with agent configs: .mcp.json, .cursor/mcp.json, .vscode/mcp.json, claude_desktop_config.json, package.json or pyproject.toml.

1. Run it

In your project:

$ npx -y deedglass scan --no-write
Blast radius: …
  A means a small blast radius, not a safe agent.
…
Full report with fixes: deedglass.com/pro ($29 once).

The scan reads your files and the MCP configs in your home directory, finds the MCP servers and agent frameworks you use, and works out what they can change. It sends nothing anywhere. Without --no-write it also writes deedglass-scan.md and deedglass-scan.html.

2. Read the score

The first line is the grade, the number of write paths with no check, and the one thing to fix first. The small print under it matters: A means a small blast radius, not a safe agent. The grade measures what your setup could change, not what your agent will do.

Every deduction follows, one per line. The score never appears without them.

The formula, in full (formula v1)

points = 100
       − 35                             if the database role is a superuser or has BYPASSRLS
       − 20 × min(2, high findings)
       −  8 × min(3, medium findings)
       −  4 × min(5, unchecked write paths)
points = max(points, 0)
grade  = A ≥ 90 · B 80–89 · C 65–79 · D 50–64 · F < 50

An unchecked write path is a tool that can write, delete or move money, or a table the role can DELETE or TRUNCATE, that isn’t routed through deedglass mcp wrap with an active policy. Low and info findings never deduct.

3. Rank the tables your agent can change

Point the scan at the database your agent uses, by the name of the variable that holds its URL:

npx -y deedglass scan --postgres-dsn-env DATABASE_URL

It opens one read-only session (BEGIN READ ONLY, six catalog queries, ROLLBACK) as your agent’s role, and lists every table that role can write, with its enabled triggers. A trigger is how one reported row becomes 301. The scan reads the variable’s name from you and its value from your shell; the value is never printed or saved.

4. Add the three suggested policies

The report ends with three starter policies matched to what it found. Save them, then lint and test them as in Your first policy.

Findings

Each finding has an id. SARIF output and the HTML report link to these anchors.

archived_postgres_mcp · high when its role can write. Anthropic archived its reference Postgres MCP server (@modelcontextprotocol/server-postgres) on 2025-05-28. Its read-only mode runs each query in a read-only transaction that a stacked COMMIT; can end (Datadog Security Labs), after which the role’s full rights apply. Fix: move to a maintained server, and put it behind deedglass mcp wrap.

database_url_in_client_args · medium. A database URL with a password sits in a client config’s arguments, where every process listing can read it. Fix: pass it through an environment variable.

security_definer_executable · medium. The role can run SECURITY DEFINER functions, which run with their owner’s rights. Fix: revoke EXECUTE from the agent’s role, or allow-list the functions in the Postgres connector.

no_primary_key_on_writable_table · low. A table the role can write has no primary key, so a change can’t be matched to one row. Fix: add a primary key.

wal_level_not_logical · info. wal_level isn’t logical, so L2 witnessing isn’t available on this database yet. Fix: set wal_level = logical and restart Postgres.

5. Next

Add the badge to show your grade in your README.
The full report with fixes for every finding: deedglass.com/pro ($29 once).

What it doesn’t do

It grades only your own setup. It doesn’t run your agent, call your tools or test a model.
It reads environment variable names, never their values, except the one database URL you name with --postgres-dsn-env.
A server it doesn’t recognise counts as a write path. When the scan can’t tell, the deduction says not shown to be routed.