Works where your app already lives.

PatchLabs reads public GitHub repos: code, migrations and full git history. You prove a repo is yours by committing a one-time file; we never need write access.

1. Paste the repo URL on the home page, or add it as an app in your workspace.
2. Commit patchlabs-verify.txt with the one-time code (one-click link to GitHub’s new-file page).
3. The check starts. Delete the file once it has.

Re-check your app every time a migration lands on the default branch. The action waits for the lab result, writes it to the job summary and can fail the build while a leak is open.

1. Add and verify the app; copy its ID.
2. Create a workspace API key; save it as the secret PATCHLABS_API_KEY and the app ID as the variable PATCHLABS_APP_ID.
3. Add the workflow below.

on:
  push:
    branches: [main]
    paths: ['supabase/migrations/**']
jobs:
  leak-check:
    runs-on: ubuntu-latest
    steps:
      - uses: manra399/patchlabs/action@main
        with:
          api-key: ${{ secrets.PATCHLABS_API_KEY }}
          app-id: ${{ vars.PATCHLABS_APP_ID }}
          fail-on-leak: true

One webhook URL per workspace. Every finished check POSTs a JSON event with a one-line text field, so a Slack incoming webhook works as-is. Requests are HMAC-SHA256 signed.

1. In Settings → Webhook, paste an https URL (for Slack: an incoming webhook URL).
2. Press “Send test” to check delivery.
3. Optional: verify X-PatchLabs-Signature with your workspace secret.

Ask your coding agent to check an app. Works with Claude Code, Cursor, VS Code, Windsurf and other MCP clients: run the free RLS check, start full checks, read fixes and re-check monitored apps.

1. Add the server to your client (Claude Code below; snippets for the others in the docs).
2. Optional: add a workspace key as the X-API-Key header for list_apps and run_check.
3. Ask: “Check this repo for leaks with PatchLabs.”

claude mcp add --transport http patchlabs https://api.patchlabs.dev/mcp

Start checks, read results and findings, and manage apps from your own tools with a workspace API key.

1. Create a key in Settings → API keys (shown once).
2. Send it as X-API-Key.
3. POST /v1/apps/{id}/checks, then poll GET /v1/checks/{id}.

Every member of the workspace gets an email when a check of one of its apps finishes. The subject says “new leak” only when there is one.

1. Invite your team in Settings → Team.
2. Choose a re-check schedule per app.
3. That’s it: alerts follow the schedule.