RowAttest MCP server

• Registry namecom.rowattest/rowattestverified in the MCP registry

The registry name sits under rowattest.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-27
• Tools6
• Server calls itselfrowattest
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-27 the server answered initialize and tools/list without a sign-in. First answer in 195 ms.

• Its tools do every use case we checked: test whether Supabase row level security blocks cross-tenant data reads; share a public link that verifies a report's authenticity.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score97 of 100answers 100 · does the job 100 · definitions 86 · context 100 · connects 100
• What an agent can do with it2 of 2 use cases
• Answered100% of days7 of 7 daily checks
• Median first answer158 ms
• Space in an agent's context≈ 770 tokensthe definitions of all its tools (6), which an agent carries on every turn
• Tool definitionsB · 86 of 100
• Typed results0 of 6 toolsdeclared outputSchema: results come typed, read once

• Parameters without a description: in 5 of 6

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• list_projects

  Lists the Supabase projects connected to this account with id, name, connection state and whether each is ready to run. Call this first to get a project_id.

• run_review

  Starts an authorization test run on a connected project and returns the run_id and status. If the project already has a run waiting to start, returns that run instead of starting another. Runs that do not fail count against the monthly…

• get_run_status

  Returns a run's status (queued, running, complete or failed), its current stage, timestamps and, when a signed report exists, its verify_url.

• wait_for_run

  Waits up to timeout_seconds (1 to 60) for a run to finish, then returns the same information as get_run_status. Call it again while the status is still queued or running.

• get_findings

  Returns the cells that did not pass in a complete run that has a signed report — verdict, surface, operation, boundary, identity, layer outcomes and notes — plus tenancy flags, blocking findings and, when the report includes catalog…

• get_report

  Returns the full signed report of a complete run as the exact stored JSON, with its verify_url and report_sha256 (sha256 of the canonical signed bytes, the fingerprint shown on the verify page). Use get_findings for the compact view.