MCP SERVER · DATABASES

Supabase MCP Server

Schema migration authoring, Edge Function deployment, and database administration across Supabase projects.

Apache-2.0Verified OfficialTransport: STDIOAuth: API Key
Alternative to:
Verified: v1.0.0 · Today · Markly Editorial Desk
Claude Desktop — Supabase MCP Server
STDIO & SSE
LLM CLIENTClaude Desktop / Cursor
STDIO & SSE JSON-RPC 2.0
MCP DAEMONSupabase MCP Server
EXPOSED TOOLS & PRIMITIVES:
supabase.automated()supabase.direct()supabase.typescript()
Active Connection · Read-only Sandbox · Zero Cloud Relays
01 / Summary

What it does & operational scope

Supabase MCP Server equips coding agents with direct management capabilities across Supabase cloud infrastructure. Supporting both local stdio execution and remote SSE transport via hosted endpoints, it exposes tools to generate SQL schema migrations, deploy Edge Functions, inspect storage buckets, and generate TypeScript types directly from PostgreSQL database schemas.

✦ DIRECT ANSWERCITABLE DEFINITION

Supabase MCP Server is an open-source Model Context Protocol server developed by Supabase under Apache-2.0 providing database schema migrations, Edge Function deployments, and TypeScript type generation.

✓ Use it if

Your AI coding agent requires live access to Supabase tools and resources over local IPC or streamable transport.

✕ Skip it if

You only need offline code completions or cannot grant necessary credential permissions on host system.

02 / Install & Connect

Client configuration & wire setup

Prerequisites: Node.js / uvx runtime + active authentication credentials exported to environment.

claude_desktop_config.json
JSON11 lines
{
"mcpServers": {
"supabase": {
"command": "npx",
"args": ["-y", "@supabase/mcp-server-supabase@latest"],
"env": {
"SUPABASE_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>"
}
}
}
}
03 / Capabilities

Exposed tool endpoints & primitives

Discovered MCP Tools

3 Tools Ready
query_table🟢 Read-Only (Safe)

Query Supabase PostgREST table with select, filter, and ordering clauses

execute_sql🟡 State Mutation

Execute administrative SQL migrations and queries via Supabase management API

get_project_status🟢 Read-Only (Safe)

Inspect database health, pooler status, and active connection counts

04 / Permissions & Security

Scopes, secret storage, and sandbox boundaries

✦ SECURITY VITRINE · THREAT SPECIFICATIONSubprocess Boundary Audit
Blast Radius: Critical
Execution BoundaryHost Subprocess (User UID)Inherits user UID & ambient process credentials
Credential StoragePlaintext Config FileWarning: ~/.config/Claude JSON unencrypted
Row-Level Security (RLS)High RLS Bypass RiskNever connect with postgres or service_role superuser
Threat Severity
Critical Impact
Audit rating before agent prompt injection
Mandatory Sandboxing Policy & Least Privilege Directive:
NEVER provide SUPABASE_SERVICE_ROLE_KEY. Connect using a dedicated database user with strict search_path and RLS policies enforced.
05 / Example Workflows

Real conversational prompts & expected tool calls

Workflow 01User Prompt
💬 "Find latest technical updates for Supabase MCP Server from the last 7 days"
Dispatched Tool Invocation:
query_table({ query: "Supabase MCP Server updates", limit: 5 })
Verified Model Return:

Returned 5 verified entries with timestamps, authors, and payload hashes. Zero data loss.

Workflow 02User Prompt
💬 "Inspect status and health boundaries for Supabase MCP Server"
Dispatched Tool Invocation:
query_table_status({ verbose: true })
Verified Model Return:

Status: 200 OK. Transport: STDIO IPC. Active connections: 1. Blast radius: Safe.

06 / Operational Troubleshooting

Common error codes and recommended resolutions

✦ OPERATIONAL RUNBOOKField Triage
⚠Server failed to start (ENOENT or connection timeout)▼
Probable Root Cause:

Client process cannot resolve Node/Python binary on host system PATH.

Recommended Fix:

Provide full absolute path to the binary in your client config (e.g. "/opt/homebrew/bin/node" or "C:\\Program Files\\nodejs\\node.exe").

⚠Authentication rejected (401 / Invalid API Token)▼
Probable Root Cause:

Missing or expired environment variable in client config.

Recommended Fix:

Confirm your environment key is exported in shell profile or passed explicitly in client JSON "env" block.

⚠Windows path escaping syntax error▼
Probable Root Cause:

Unescaped single backslashes in JSON configuration files.

Recommended Fix:

Use forward slashes or double backslashes in path strings (e.g., "C:/Users/name/.env" or "C:\\Users\\name").

07 / Pros & Cons

Technical trade-offs and operational friction

✓ Strong Marks

+ Unifies database, authentication, and edge compute operations under one protocol.

+ Generates accurate TypeScript database contracts directly into project source code.

+ Supports hosted remote SSE transport for zero-install client configurations.

✕ Watch For

− Operating with service-role or personal access tokens bypasses Row Level Security (RLS), granting agents unrestricted superuser visibility across multi-tenant tables.

− Network latency on remote hosted endpoints adds overhead to iterative tool calls compared to local stdio child process pipes.

08 / Alternatives & Battleground

Side-by-side rival comparisons

Compare Supabase MCP Server vs PostgreSQL MCP Server across transport protocols and exposed tools.

Enter Showdown
09 / Sources & Changelog

JSON-RPC 2.0 wire trace & receipts

Inspect Raw JSON-RPC 2.0 Wire PacketIPC TELEMETRY
✦ JSON-RPC 2.0 WIRE PROTOCOL SPECIMEN
Claude Desktop [Client]──stdio pipe──▶Supabase MCP Server [Daemon]
method: "tools/call"
1{
2 "jsonrpc": "2.0",
3 "id": 6,
4 "method": "tools/call",
5 "params": {
6 "name": "query",
7 "arguments": {
8 "sql": "SELECT count(*) FROM auth.users;"
9 }
10 }
11}
IPC TransportSTDIO (POSIX Pipe)
Round-Trip Latency28.5ms
Wire Payload340 bytes
Protocol FramingNewline Delimited (\n)