Supabase MCP Server

Official MCP server for Supabase. Manage projects, query databases, run migrations, deploy edge functions, fetch logs, and generate TypeScript types.

Developer Tools by Supabase OAuth2 active

Connect (Remote Server) GitHub Docs

Overview

The Supabase MCP server connects AI assistants like Claude, Cursor, and Windsurf to Supabase projects through the Model Context Protocol. It is maintained by the Supabase community organization and is the canonical implementation referenced from Supabase's official documentation. The server is available as a hosted remote endpoint at https://mcp.supabase.com/mcp (recommended) and as open source code you can run locally via the Supabase CLI or self-hosted setups.

Tools are grouped into eight feature areas: account and organization management, knowledge base search over Supabase docs, database operations (list tables, execute SQL, apply migrations), debugging (logs and advisors), development helpers (project URL, publishable keys, TypeScript type generation), edge functions (list, get, deploy), branching for paid plans, and storage (disabled by default). Tool groups can be enabled selectively via the features URL parameter.

The hosted server uses OAuth 2.1 with dynamic client registration so users authenticate against Supabase in the browser rather than passing personal access tokens. For CI or self-hosted environments without OAuth support, personal access tokens can be used via Authorization headers. The server can be locked down with read_only=true and scoped to a single project via project_ref=<id>. Supabase recommends using it against development projects rather than production data because of prompt injection risk.

Tools

Tool	Description
`list_projects`	List all projects in the authenticated user's organizations.
`get_project`	Fetch details for a specific project.
`create_project`	Create a new Supabase project.
`pause_project`	Pause a project.
`restore_project`	Restore a paused project.
`list_organizations`	List organizations the user belongs to.
`get_organization`	Fetch details and plan for an organization.
`get_cost`	Estimate the cost of creating a project or branch.
`confirm_cost`	Confirm an estimated cost before a billable action.
`search_docs`	Search the Supabase documentation knowledge base.
`list_tables`	List tables in the project's database, optionally filtered by schema.
`list_extensions`	List installed Postgres extensions.
`list_migrations`	List database migrations that have been applied.
`apply_migration`	Apply a SQL migration to the project's database.
`execute_sql`	Run raw SQL against the project's database.
`get_logs`	Retrieve logs for a service (api, postgres, auth, storage, edge functions, etc.).
`get_advisors`	Get security and performance advisor notices.
`get_project_url`	Return the project's API URL.
`get_publishable_keys`	Return the project's publishable (anon) API keys.
`generate_typescript_types`	Generate TypeScript types from the project's database schema.
`list_edge_functions`	List edge functions in the project.
`get_edge_function`	Fetch the source and metadata for an edge function.
`deploy_edge_function`	Deploy or update an edge function.
`create_branch`	Create a development branch (paid plan).
`list_branches`	List development branches for a project.
`delete_branch`	Delete a development branch.
`merge_branch`	Merge a development branch into production.
`reset_branch`	Reset a branch to a clean state.
`rebase_branch`	Rebase a branch onto the latest production schema.
`list_storage_buckets`	List storage buckets (disabled by default).
`get_storage_config`	Get storage configuration (disabled by default).
`update_storage_config`	Update storage configuration (disabled by default).

Setup Guide

Hosted setup (recommended)

Add the Supabase MCP server to your client config. For Claude Desktop, edit claude_desktop_config.json:

{
  "mcpServers": {
    "supabase": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp"
    }
  }
}

On first use, the client opens a browser window to authenticate with Supabase via OAuth 2.1 and select the organization or project to grant access to.

Recommended security flags

Scope the server to a single project and restrict to read-only by appending URL parameters:

{
  "mcpServers": {
    "supabase": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true&features=database,docs,development"
    }
  }
}

Supported parameters:

project_ref: limit access to a single project
read_only=true: disable SQL mutations and write tools
features: comma separated list of tool groups to enable (e.g. account,database,docs,debugging,development,functions,branching,storage)

Local CLI setup

Run the local Supabase stack with the CLI and point your client at:

http://localhost:54321/mcp

CI and self-hosted environments do not support OAuth and instead authenticate using a Supabase personal access token in the Authorization header.

Prerequisites

Supabase account and at least one project
MCP-compatible client (Claude Desktop, Cursor, Windsurf, VS Code, etc.)
Paid Supabase plan for branching tools

Use Cases

Iterate on schema changes during development by asking the agent to draft and apply migrations, then verify with list_tables and execute_sql.
Generate fresh TypeScript types after schema edits so the frontend stays in sync without manual CLI runs.
Debug failing requests by pulling recent logs across api, postgres, and auth services and asking the model to summarize errors.
Audit a project for security and performance issues using get_advisors and triage findings in chat.
Deploy and update edge functions from a coding agent without leaving the IDE.

Example Prompts

"List the tables in the public schema of project abc123 and show the columns for orders."
"Apply a migration that adds a deleted_at timestamptz column to users and regenerate the TypeScript types."
"Search Supabase docs for how to set up row level security on a multi-tenant table."
"Pull the last hour of postgres logs and tell me what's causing the spike in errors."
"Deploy an edge function called stripe-webhook from the files in ./functions/stripe-webhook."

Pros

Official, hosted by Supabase at mcp.supabase.com with OAuth 2.1, so no manual token handling.
Broad tool coverage across database, edge functions, logs, advisors, branching, and docs search.
Granular safety controls via read_only, project_ref, and features URL parameters.
Open source code available for self-hosting and inspection.

Limitations

Pre-1.0; the README warns that breaking changes are expected between versions.
Supabase explicitly recommends against using it with production projects due to prompt injection risk in database content.
Branching tools require a paid Supabase plan, and storage tools are disabled by default.

Alternatives

Postgres MCP server for raw Postgres access without Supabase-specific tools.
Neon MCP server for a similar managed Postgres workflow on Neon.
Self-hosting supabase-community/supabase-mcp locally if you need to avoid the hosted endpoint.