Supabase
by Supabase
Run SQL, apply migrations, deploy Edge Functions and manage projects from your AI assistant. 32 tools, OAuth sign-in, and URL flags for read-only mode, project scoping and tool groups.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Supabase via MCP
https://mcp.supabase.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Supabase Tools & Capabilities (32)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
secrets:readis a grantable scope, and its platform reach is wider than the connector's tools. Supabase's Management API specification attachessecrets:readto seven read endpoints covering project secrets, API keys and JWT signing keys, and the secrets response schema has a requiredvaluefield. The only tool that touches any of them isget_publishable_keys, which hardcodesrevealtofalseand returns client-safe keys only. Grant deliberately: this is the one scope on the consent screen whose name describes credentials.execute_sqlruns arbitrary SQL. There is no statement allowlist. Its reach is whatever the connected Postgres role permits, DDL included, unless you connect withread_only=true.- Supabase says not to point this at production. Its security documentation states the server is designed for development and testing, and repeats the warning in both manual-authentication sections. Use a development project, a branch, or
read_only=trueif you must use real data. - The prompt-injection mitigation is explicitly partial. Supabase wraps SQL results in an untrusted-data boundary and states it is not foolproof, asking you to keep manual tool-call approval on and review calls before they execute.
- The manual OAuth route offers no scope narrowing. Supabase's documentation instructs you to grant write access to all available scopes and says finer-grained scopes are a future change. Narrowing on that path comes from the URL parameters instead.
- Branching is experimental and paid. Supabase marks the group experimental in its MCP docs and requires a paid plan; its pricing page lists branching as not included on the Free Plan.
- Storage is off by default. Three tools stay unregistered unless you pass
features=storage. plainPKCE is still accepted. The authorization server advertises bothS256andplainincode_challenge_methods_supported. Most servers in this catalogue advertiseS256alone.- The tool list is not fixed.
features,read_onlyandproject_refeach change which tools are registered, so no single count describes every connection. 32 is the full catalogue. - The documentation names one tool the server does not ship.
query_logsappears in Supabase's docs; the directory and the published source both haveget_logs. - The server is in beta. Its OAuth descriptor names it "Supabase MCP (Beta)".
- Stateless transport, POST only. The endpoint's own API reference states it operates in stateless mode and supports POST requests only.
- We could not read tool schemas or annotations from the wire. The endpoint requires authentication, so the 32 count and the names are the directory's, and the annotations quoted above are read from Supabase's published source. We never authenticated, called a tool, or ran any SQL.
Frequently asked questions
Can the Supabase MCP server read your API keys and secrets?
Only publishable keys through its tools. The get_publishable_keys tool calls Supabase's API-keys endpoint with reveal set to false and filters the response to anon and publishable keys, per the server's published source. The secrets:read scope itself is broader, so grant it only when you accept that reach.
How do you stop the Supabase MCP server from writing to your database?
Append read_only=true to the endpoint URL. Supabase documents this parameter as executing all queries as a read-only Postgres user. In the published source the flag also hides every write tool from the tool list and makes apply_migration throw before it runs, so the restriction is enforced twice.
Does the Supabase MCP server work with a production database?
Supabase advises against it. Its security documentation tells you not to connect the server to production and to use a development project with non-production or obfuscated data instead. The same page states the server is designed for development and testing purposes only.
How does Supabase protect the MCP server against prompt injection?
It wraps SQL results in an untrusted-data boundary. The published source surrounds every execute_sql result with a randomly generated delimiter and instructions telling the model never to follow commands inside it. Supabase calls this not foolproof and asks you to keep manual tool-call approval enabled.
Can an AI assistant create a Supabase project or branch that costs money?
Yes, but only after a confirmation step it cannot skip. Both create_project and create_branch require a confirm_cost_id, and the published source rejects the call unless that value hashes to the current cost. Supabase's pricing lists branches at 0.01344 dollars per branch per hour.
Which Supabase tools are turned off by default in the MCP server?
Storage is the only group off by default. Supabase's MCP documentation states all feature groups except Storage are enabled by default, and the published source confirms storage is absent from the default feature list. Add features=storage to the endpoint URL to enable list_storage_buckets, get_storage_config and update_storage_config.
Which Supabase plan do you need for MCP branching tools?
A paid plan. Supabase's MCP documentation marks the branching group experimental and notes it requires a paid plan, and its pricing page lists branching as not included on the Free Plan and available from the Pro Plan upward at 0.01344 dollars per branch per hour.
Sources
- Supabase MCP Server documentation (retrieved 2026-08-18; HTTP 308 to
https://supabase.com/docs/guides/ai-tools/mcp, read as Markdown athttps://supabase.com/docs/guides/ai-tools/mcp.mdvia the.mdsuffix the host advertises inllms.txt) · retrieved 2026-08-18 - Supabase MCP server source,
github.com/supabase/mcp(cloned and read 2026-08-18; repository linked from the MCP documentation page). Tool registrations, annotations, feature-group defaults, read-only enforcement, the untrusted-data boundary, the cost-confirmation hash check and thereveal: 'false'constant were all read frompackages/mcp-server-supabase/src. · retrieved 2026-08-18 - Supabase Management API specification (retrieved 2026-08-18). Source for the
secrets:readendpoint set, theSecretResponseandApiKeyResponseschemas, and therevealparameter. · retrieved 2026-08-18 - Supabase Branching (retrieved 2026-08-18) · retrieved 2026-08-18
- Supabase Pricing (retrieved 2026-08-18). Branching at $0.01344 per branch per hour, not included on the Free Plan. · retrieved 2026-08-18
- Supabase MCP endpoint API reference (retrieved 2026-08-18; nominated by the
resource_documentationfield of the server's own OAuth descriptor, and served over unauthenticated GET from the same host that returns 401 to POST) · retrieved 2026-08-18 supabase.com/robots.txt—Allow: /withContent-Signal: ai-train=yes, search=yes, ai-input=yes(retrieved 2026-08-18). Supabase expressly permits AI synthesis of this documentation. · retrieved 2026-08-18- Live auth posture check against
https://mcp.supabase.com/mcp— anonymousinitializereturned HTTP 401 withWWW-Authenticate: Bearer error="invalid_request"and aresource_metadatapointer;/.well-known/oauth-protected-resource/mcpreturned HTTP 200 with 13 scopes and authorization serverhttps://api.supabase.com;api.supabase.com/.well-known/oauth-authorization-serverreturned HTTP 200 with the same 13 (2026-08-18) · retrieved 2026-08-18 - Anthropic Connectors Directory entry (snapshot 2026-08-16) · retrieved 2026-08-16
- Supabase support — the directory publishes , which returned HTTP 301 to on 2026-08-18; the repository was renamed and the directory's URL is stale · Privacy · retrieved 2026-08-18
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Supabase
- Tools
- 32
- Domain
- mcp.supabase.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.