Supabase

Name: Supabase MCP Server
Availability: InStock
Author: Supabase

HIPAA CompliantSOC2 ReadyISO 27001 Ready

Developer Tools32 tools

Run SQL, apply migrations, deploy Edge Functions and manage projects from an AI assistant. 32 tools, plus URL flags for read-only mode and project scoping.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 18 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Supabase via MCP

https://mcp.supabase.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Use in Agentman

Connect Supabase once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Supabase Tools & Capabilities (32)

list_organizations

get_organization

list_projects

get_project

get_cost

confirm_cost

create_project

pause_project

restore_project

create_branch

list_branches

delete_branch

merge_branch

reset_branch

rebase_branch

list_tables

list_extensions

list_migrations

apply_migration

execute_sql

get_logs

get_advisors

get_project_url

get_publishable_keys

generate_typescript_types

search_docs

list_storage_buckets

get_storage_config

update_storage_config

list_edge_functions

get_edge_function

deploy_edge_function

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

secrets:read is a grantable scope, and its platform reach is wider than the connector's tools. Supabase's Management API specification attaches secrets:read to seven read endpoints covering project secrets, API keys and JWT signing keys, and the secrets response schema has a required value field. The only tool that touches any of them is get_publishable_keys, which hardcodes reveal to false and returns client-safe keys only. Grant deliberately: this is the one scope on the consent screen whose name describes credentials.
execute_sql runs arbitrary SQL. There is no statement allowlist. Its reach is whatever the connected Postgres role permits, DDL included, unless you connect with read_only=true.
Supabase says not to point this at production. Its security documentation states the server is designed for development and testing, and repeats the warning in both manual-authentication sections. Use a development project, a branch, or read_only=true if you must use real data.
The prompt-injection mitigation is explicitly partial. Supabase wraps SQL results in an untrusted-data boundary and states it is not foolproof, asking you to keep manual tool-call approval on and review calls before they execute.
The manual OAuth route offers no scope narrowing. Supabase's documentation instructs you to grant write access to all available scopes and says finer-grained scopes are a future change. Narrowing on that path comes from the URL parameters instead.
Branching is experimental and paid. Supabase marks the group experimental in its MCP docs and requires a paid plan; its pricing page lists branching as not included on the Free Plan.
Storage is off by default. Three tools stay unregistered unless you pass features=storage.
plain PKCE is still accepted. The authorization server advertises both S256 and plain in code_challenge_methods_supported. Most servers in this catalogue advertise S256 alone.
The tool list is not fixed. features, read_only and project_ref each change which tools are registered, so no single count describes every connection. 32 is the full catalogue.
The documentation names one tool the server does not ship. query_logs appears in Supabase's docs; the directory and the published source both have get_logs.
The server is in beta. Its OAuth descriptor names it "Supabase MCP (Beta)".
Stateless transport, POST only. The endpoint's own API reference states it operates in stateless mode and supports POST requests only.
We could not read tool schemas or annotations from the wire. The endpoint requires authentication, so the 32 count and the names are the directory's, and the annotations quoted above are read from Supabase's published source. We never authenticated, called a tool, or ran any SQL.

Frequently asked questions

Only publishable keys through its tools. The get_publishable_keys tool calls Supabase's API-keys endpoint with reveal set to false and filters the response to anon and publishable keys, per the server's published source. The secrets:read scope itself is broader, so grant it only when you accept that reach.

Append read_only=true to the endpoint URL. Supabase documents this parameter as executing all queries as a read-only Postgres user. In the published source the flag also hides every write tool from the tool list and makes apply_migration throw before it runs, so the restriction is enforced twice.

Supabase advises against it. Its security documentation tells you not to connect the server to production and to use a development project with non-production or obfuscated data instead. The same page states the server is designed for development and testing purposes only.

It wraps SQL results in an untrusted-data boundary. The published source surrounds every execute_sql result with a randomly generated delimiter and instructions telling the model never to follow commands inside it. Supabase calls this not foolproof and asks you to keep manual tool-call approval enabled.

Yes, but only after a confirmation step it cannot skip. Both create_project and create_branch require a confirm_cost_id, and the published source rejects the call unless that value hashes to the current cost. Supabase's pricing lists branches at 0.01344 dollars per branch per hour.

Storage is the only group off by default. Supabase's MCP documentation states all feature groups except Storage are enabled by default, and the published source confirms storage is absent from the default feature list. Add features=storage to the endpoint URL to enable list_storage_buckets, get_storage_config and update_storage_config.

A paid plan. Supabase's MCP documentation marks the branching group experimental and notes it requires a paid plan, and its pricing page lists branching as not included on the Free Plan and available from the Pro Plan upward at 0.01344 dollars per branch per hour.