MCP server · Data + databases
Supabase MCP
Supabase's official MCP server: lets an agent manage tables, run SQL, read logs and deploy Edge Functions in your project — scope it read-only.
Quick verdict
It is vendor-maintained, published in the official MCP Registry, and its scoping controls are first-class: project_ref, read_only and features narrow what the agent can reach, and the docs spell out how to keep it away from production.
- MaintainerSupabase (official)
- Security scopeRead-write
- Transportsstreamable-http, stdio
- Install channelremote · https://mcp.supabase.com/mcp
- EvidenceHands-on Verified · 1 configuration
- LicenseApache-2.0 · Open source
Supabase's official MCP server, offered primarily as a hosted remote endpoint (https://mcp.supabase.com/mcp) that signs you in with OAuth — no personal access token needed — plus a local stdio package (@supabase/mcp-server-supabase) for CLI and self-hosted setups. Tool groups cover the database (list tables, apply migrations, execute SQL), debugging (logs, advisors), development (project URL, keys, TypeScript types), Edge Functions, account management, docs search, branching and storage. URL parameters scope it to one project (project_ref), restrict it to read-only queries (read_only=true) and choose tool groups (features).
Install Supabase MCP
http https://mcp.supabase.com/mcp
{
"mcpServers": {
"supabase": {
"type": "http",
"url": "https://mcp.supabase.com/mcp?project_ref=<YOUR_PROJECT_REF>&read_only=true"
}
}
}Hosted server (OAuth). Local stdio alternative: npx -y @supabase/mcp-server-supabase --read-only --project-ref=<ref> with SUPABASE_ACCESS_TOKEN; the Supabase CLI serves one at http://localhost:54321/mcp.
Credentials
| Name | Required | What it is for |
|---|---|---|
SUPABASE_ACCESS_TOKEN | Optional | Personal access token — needed only for the local stdio package or for CI (sent as a Bearer header). The hosted server signs you in with OAuth via dynamic client registration and needs no token. |
Verified configurations
Each row is one client + runtime + OS combination that was actually run, with what was verified in that session.
| Configuration | Install | Auth | Discovery | Execution | Read | Write | Destructive | Errors |
|---|---|---|---|---|---|---|---|---|
| Claude Code | Verified | Partial | Verified | Verified | Verified | Not tested | Not tested | Verified |
Evidence — Claude Code
- Install: `claude mcp list` → `claude.ai Supabase: https://mcp.supabase.com/mcp - ✔ Connected`: the hosted server (the profile's primary install path) was reached over streamable HTTP through the connector; nothing was installed locally.
- Auth: OAuth sign-in through the claude.ai connector was accepted — account-scoped calls (list_projects) answered — but the connector was not scoped with read_only=true or a project_ref as the profile recommends, so the grant is broader than the declared read-only posture; only read-only tools were exercised.
- Discovery: tools/list exposed 29 tools: search_docs, list_organizations, get_organization, list_projects, get_project, get_project_url, get_publishable_keys, get_cost, confirm_cost, create_project, pause_project, restore_project, list_tables, list_extensions, list_migrations, apply_migration, execute_sql, get_advisors, query_logs, generate_typescript_types, list_edge_functions, get_edge_function, deploy_edge_function, list_branches, create_branch, delete_branch, merge_branch, rebase_branch, reset_branch.
- Execution: `search_docs` (GraphQL: searchDocs(query: "row level security policies", limit: 3)) → totalCount 3 with titles and hrefs (Row Level Security, Securing your API, Glossary); `list_projects` → 1 project returned with status ACTIVE_HEALTHY, region and Postgres 17 (identifiers deliberately not recorded here).
- Read: Both calls were read-only; no table, SQL, log or migration tool was invoked.
- Errors: `get_project` with an invalid ref (nonexistent-ref-0000) returned a clean structured validation error ("ref must contain only lowercase alphabetic characters") without crashing or hanging.
The local stdio package (npx -y @supabase/mcp-server-supabase --read-only --project-ref=<ref>) was not exercised — this configuration is the hosted OAuth endpoint. Supabase's own guidance (do not connect to production, prefer read_only=true and project scoping) still applies; this verification touched a real account read-only and changed nothing.
Best for
Developers who want a coding agent to inspect and iterate on a Supabase development project — schema, SQL, logs, Edge Functions — from their editor.
Why use it
It is vendor-maintained, published in the official MCP Registry, and its scoping controls are first-class: project_ref, read_only and features narrow what the agent can reach, and the docs spell out how to keep it away from production. The hosted endpoint removes token handling entirely.
Tradeoffs
Read-write by default: execute_sql, apply_migration and deploy_edge_function change real projects, so Supabase's own guidance is unambiguous — do not connect it to production, do not give it to end users, and prefer read_only=true plus project scoping. Supabase wraps SQL results to discourage prompt injection but calls that mitigation not foolproof. Requires a Supabase account and network access — not an air-gapped tool.
Upstream state
repository active · in the official MCP Registry (active). Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.
Official MCP Registry name: com.supabase/mcp
Editorial review
Grade A — Hands-on Verified. Re-review is due by 2026-12-16. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.
Sources
Related MCP servers
- Tavily MCPSearch, extract, map and crawl live web content through Tavily's official hosted MCP server.
- ClickHouse MCPQuery ClickHouse databases through the official MCP server, with read-only SQL enforced by default and separate write opt-ins.
- DuckDB / MotherDuck MCPQuery local DuckDB files or MotherDuck through MCP, with read-only defaults and optional write-enabled SQL.