Supabase MCP Server

What is Supabase MCP Server?

The Supabase MCP Server connects your Supabase projects to AI assistants like Cursor, Claude, and Windsurf. It uses the Model Context Protocol (MCP) to let LLMs manage tables, fetch configuration, query data, and perform other Supabase tasks.

How to use Supabase MCP Server?

Configure your MCP client with the URL https://mcp.supabase.com/mcp and authenticate via OAuth. You can also use the Supabase CLI (local) or self‑hosted instances, though those have limited tools. Options like read_only, project_ref, and features are set as query parameters to restrict or customize tool access.

Key features of Supabase MCP Server

• Tools grouped into account, database, knowledge base, debugging, development, edge functions, branching, and storage.
• Read‑only mode restricts the server to non‑mutating queries.
• Project‑scoped mode limits access to a single Supabase project.
• Feature groups let you enable only the tools you need.
• Supports OAuth 2.1 (cloud version) and works with most MCP clients.
• Pre‑1.0 – breaking changes may occur between versions.

Use cases of Supabase MCP Server

• Let an AI assistant manage Supabase projects (create, pause, restore).
• Run SQL queries or apply migrations through natural language.
• Search Supabase documentation for up‑to‑date guidance.
• Deploy and manage Edge Functions from a chat interface.
• Debug performance or security issues using logs and advisors.

FAQ from Supabase MCP Server

What tools are available?

Tools are grouped into account (project management), database (SQL, migrations), knowledge base (docs search), debugging (logs, advisors), development (keys, types), edge functions, branching (paid plan), and storage. Use the features parameter to select groups.

How do I restrict the server to read‑only operations?

Set the read_only=true query parameter. This disables all mutating tools and runs execute_sql as a read‑only Postgres user.

Can I limit the server to a single project?

Yes, set the project_ref query parameter to your project’s ID. This disables account‑level tools and scopes the server to that project.

Is the server available for local development?

Yes, when using the Supabase CLI locally, it’s available at http://localhost:54321/mcp but with a limited tool set and no OAuth.

What are the main security risks?

Connecting an LLM to your Supabase project carries risks. Supabase recommends reviewing their security best practices and using read‑only or project‑scoped mode by default.