| name | review-security |
| description | Review a pREST project for security issues in configs, SQL routes, auth, and AI/MCP exposure. Use when auditing prest.toml, queries, or docker setups. |
Review pREST security
When to use
- Before exposing pREST beyond localhost
- After generating a config or SQL route
- When the user asks for a security review of their pREST project
Checklist
Inspect available prest.toml, .env*, Docker Compose, and queries/**:
- Hardcoded credentials — passwords, JWT keys, DSNs committed in plain text
- Overexposed tables —
access.restrict = false (or unset) in non-demo contexts; missing [[access.tables]]
- Missing auth — JWT/auth disabled or misconfigured (
jwt.default false/unset while claiming auth; empty HMAC key behavior)
- Public write access — write/delete permissions broader than needed
- Dangerous SQL — unchecked deletes, dynamic SQL fragments, unbounded scans
- Overly privileged DB user — superuser / owner used for the API role
- Exposed AI/MCP surface — public unauthenticated
/_mcp, prest-mcp, or direct Postgres access
- Missing environment variables — secrets only in TOML instead of env (
PREST_MCP_TOKEN, DB passwords, JWT keys)
- Debug mode —
debug = true in shared/staging/prod (bypasses JWT)
- Catalog exposure —
/databases, /schemas, /tables left open when they should not be ([expose])
- SSL — Postgres SSL mode inappropriate for the environment
Instructions
- Read the user's files first; ask only for missing paths.
- Report findings by severity: Critical / High / Medium / Low.
- For each finding: cite the file/setting, explain risk, propose a concrete fix.
- Prefer least privilege: read-only roles, restricted tables, env-based secrets, JWT with proper verification material.
- Flag unsafe MCP patterns: unauthenticated
/_mcp, missing PREST_MCP_TOKEN on exposed endpoints, write-capable MCP database access.
Output format
- Summary (1–3 sentences)
- Findings (severity-ordered)
- Recommended remediations (copy-paste config snippets when helpful)
- Residual risks / questions for the user
