MCP · Databases and backend · Supabase

Supabase MCP

Inspect and work on Supabase projects through an AI host, with project scoping, read-only mode and selectable feature groups.

Source reviewHosted connection checksReviewed Oct 18, 2026Editorial position 9 in mcp servers

Official documentation ↗GitHub repository ↗See an example ↓Add to comparison →

Check before use

Developer authority. Do not assume the connection is limited like a normal application user. Broad queries can expose sensitive data.

Understand the tool

What it does.

Supabase's MCP server connects a coding host to project capabilities using developer permissions. It differs from an MCP server built for application customers; do not expose this developer connection to them.

Why use it?

Use it to connect a development question to schema or diagnostic evidence. Work in a designated development project and separate proposed changes from the observations that justify them.

A useful fit for

Development database inspection
Backend diagnosis
Migration planning

From need to output

Ways to put it to work.

These are suggested workflows based on the documented capabilities. They are not recorded runtime results.

Use case 01

Explain a schema

A developer needs to understand the data behind an unfamiliar feature.

Connect to one development project in read-only mode.
Inspect the relevant tables and relationships.
Describe the flow without retrieving unrelated rows.

Intended outputA focused schema explanation with identified uncertainties.

Use case 02

Prepare a migration

A feature requires a new field and its constraints.

Inspect the current development schema.
Draft a migration and rollback considerations.
Review and test the change in a development branch.

Intended outputA proposed migration, not an unreviewed production edit.

A concrete starting point

Illustrative prompt: schema explanation

Configure project scope, read-only mode and necessary feature groups.

text · illustrative example

Using only the development project I select, explain the tables supporting the booking feature. Inspect schema metadata with read-only access. Do not retrieve customer rows, run writes, create resources or change policies.

What this can change

Query results enter the AI host. Write-enabled connections can change data, schema and other project resources.

This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.

Before you start

Setup and access.

What you’ll need

A compatible MCP host and authorized Supabase developer account.
A deliberately selected project; an unscoped hosted connection can expose all accessible projects.
Restrict feature groups and use read-only mode for investigation.

Authentication: Hosted OAuth or a scoped personal access token for supported automation. Local and self-hosted variants have different access models and no equivalent OAuth setup.
Can read: Permitted project metadata, query results and diagnostics
Can write or change: Enabled database, migration and project operations
Network and data flow: mcp.supabase.com and Supabase services
AI host/model provider
Approval and control: Keep tool approval enabled for interactive work. Read-only mode and project scope are connection controls; a prompt is not a substitute.

Check your environment

Compatibility, costs and license.

Compatibility notes

Hosted remote MCP clients
Local/self-hosted variants offer a subset of tools
Self-hosted MCP must stay behind a VPN or SSH tunnel, not public Internet access

Costs and account requirements

Supabase resources and plan limits apply, including chargeable resources an agent might create. AI host charges are separate.

Current pricing or plan information ↗

Apache-2.0

Source license; hosted Supabase service terms and resource billing remain separate.

Read the license or service terms ↗

Keep the boundaries visible

Concerns and limitations.

Developer authority

Do not assume the connection is limited like a normal application user. Broad queries can expose sensitive data.

Instructions inside query results

Rows and logs are untrusted content. Built-in warnings do not make prompt-injection defenses foolproof.

Where it may fall short

No database connection, query or migration was executed.
This review does not validate row-level security, credential scope or SQL confirmations.

Observed behavior · 2026-10-18

Runtime and security findings.

Hosted connection checks

Supabase required authentication on both tested configurations. The read-only database variant advertised fewer scopes, but no SQL or project permission was tested.

These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.

What we found

Observed in this evaluation

Read-only configuration changes discovery

Both the default endpoint and ?read_only=true&features=database returned 401. Default metadata advertised 13 scopes; the read-only variant advertised 8, all ending in :read, including secrets:read. Metadata alone does not establish actual token grants or SQL enforcement.

In practice: Combine project_ref, read_only=true and only needed feature groups. Inspect the token permissions as well as the connection URL before reading sensitive data.

Documented concern

Developer access is broader than an application user

Supabase describes this MCP as a developer tool, warns against giving it to end users, and recommends project scoping, read-only mode and reviewed tool calls. SQL-result warnings are not a foolproof prompt-injection defense.

In practice: Use a designated development project and narrow queries. Treat returned rows as evidence, never as instructions for another tool call.

Version, environment and fixture

Version or deployment: Remote deployment version not disclosed by the observed responses
Tested target: https://mcp.supabase.com/mcp
Artifact identity: HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 8af236d8e6652ae5c8df672a7ba9379f1ee259587961a31c3ef3d7c0520737be. This fingerprints the observed metadata, not the deployed server implementation.
Environment and fixture: Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.
No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
Observed 2026-10-19T00:47:11.082043+00:00 through 2026-10-19T00:47:52.509957+00:00 UTC.
One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures.

Checks and results

4 recorded checks. Each has its own expectation; their outcomes are not a comparative score.

Credential-free initializationMet expectation

Method: POST https://mcp.supabase.com/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}
Expected: Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
Observed: HTTP 401 at 2026-10-19T00:47:11.082043+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp. Parsed error indicator: No access token provided.

Public authentication discoveryMet expectation

Method: GET https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.
Expected: Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
Observed: HTTP 200 at 2026-10-19T00:47:21.086335+00:00; Content-Type: application/json; charset=utf-8. Resource: https://mcp.supabase.com/mcp. 13 supported scopes: organizations:read, projects:read, projects:write, database:write, database:read, analytics:read, secrets:read, edge_functions:read, edge_functions:write, environment:read, environment:write, storage:read, storage:write. Authorization server: https://api.supabase.com. Bearer methods: header.

Read-only variant: Credential-free initializationMet expectation

Method: POST https://mcp.supabase.com/mcp?read_only=true&features=database; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}
Expected: Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
Observed: HTTP 401 at 2026-10-19T00:47:24.673580+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp?read_only=true&features=database. Parsed error indicator: No access token provided.

Read-only variant: Public authentication discoveryMet expectation

Method: GET https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp?read_only=true&features=database; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.
Expected: Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
Observed: HTTP 200 at 2026-10-19T00:47:52.509957+00:00; Content-Type: application/json; charset=utf-8. Resource: https://mcp.supabase.com/mcp?read_only=true&features=database. 8 supported scopes: organizations:read, projects:read, database:read, analytics:read, secrets:read, edge_functions:read, environment:read, storage:read. Authorization server: https://api.supabase.com. Bearer methods: header.

Practical caveats

An unscoped connection can reach all projects available to the authorized account. No project identifier was supplied in this account-free test.
Read-only access still permits disclosure. Keep secrets and unrelated customer rows out of prompts and reports.
The skip_elicitations option changes confirmation behavior for named tools; it does not remove permissions, charges or read-only restrictions.

What this evaluation does not establish

OAuth or scoped PAT authentication, project isolation, row-level security and credential revocation.
Actual SQL read-only enforcement, denied writes, migrations, cost confirmation and prompt-injection resistance.
Local/self-hosted variants and every authenticated database example.
These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.

Read the evaluation record (JSON) →

Sources for the evaluation and controls

The basis for this review

Why it’s in the collection.

Clear developer value and documented scoping controls, balanced against database access and migration consequences.

The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.

What we reviewed

Hosted configuration
Security guidance
Local/self-hosted distinctions

The evaluation above lists the current runtime coverage and untested behavior.

Source review

Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.

Read the ranking and review method →

Follow the evidence

Official sources.

Official configuration and security guide ↗supabase.com
Current official repository ↗github.com
Self-hosted access boundary ↗supabase.com
Supabase pricing ↗supabase.com