// the find
supabase/mcp
Connect Supabase to your AI assistants
An MCP server that gives AI assistants like Claude and Cursor direct access to your Supabase project — managing tables, running queries, checking config, deploying edge functions, through tools exposed over MCP. It's for developers who want their AI coding assistant to act on a live Supabase project instead of just reading docs about one. The hosted endpoint at mcp.supabase.com is the primary path; CLI and self-hosted deployments get a cut-down version.
Security guardrails are first-class, not bolted on: there's a confirmation.ts tool for destructive operations, a dedicated destructive-sql.ts guard, and an advisories module that flags tables with RLS disabled — the three things that actually matter when you're letting an LLM run SQL against production. Test coverage is split by domain (account, branching, database, functions, storage, notebooks) plus a dedicated prompt-injection e2e test, which is a rare and honest acknowledgment that an MCP server fetching untrusted content is itself an attack surface. Scoping is practical: read_only, project_ref, and features params let you hand a client a narrowed token instead of full account access. createToolSchemas() exporting typed Zod-backed schemas for Vercel AI SDK consumers is a nice touch if you're in that stack already.
The README admits the CLI and self-hosted paths get 'a limited subset of tools and no OAuth 2.1' — if you're running Supabase yourself rather than paying for their cloud, you're explicitly on the second-class path. There's no structuredContent in tool results, so AI SDK clients have to parse JSON back out of plain text, which is a workaround baked into the public API rather than a fixed gap. The self-hosting handler (createSupabaseMcpHandler) has lifecycle rules that are easy to get wrong in production — close on the response's 'close' event rather than the handler's own promise, or you cut off streaming responses mid-flight. Fundamentally this still hands an LLM a path to mutate a real database; the guardrails help, but the actual safety depends on reading and following a linked best-practices doc rather than anything enforced by default.