Supabase Project & Database

Add to your mcp.json

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": [
        "-y",
        "@supabase/mcp-server-supabase"
      ],
      "env": {
        "SUPABASE_ACCESS_TOKEN": "<SUPABASE_ACCESS_TOKEN>"
      }
    }
  }
}

Attach in a FrootAI play (fai-manifest)

mcp_scope:
  attached:
    - supabase

Authentication

create a personal access token at supabase.com/dashboard/account/tokens, then set SUPABASE_ACCESS_TOKEN; scope the server to one project with `--project-ref` and prefer `--read-only`.

Required credential: SUPABASE_ACCESS_TOKEN

Environment variables

Sample tools

• supabase.list_projects

  List all Supabase projects for the user (account-scoped).

• supabase.list_tables

  List all tables within the specified schemas.

• supabase.execute_sql

  Execute raw SQL against the database (runs as a read-only Postgres user in read-only mode).

• supabase.search_docs

  Search the Supabase documentation for up-to-date guidance.

• supabase.get_logs

  Get logs for a project by service type (api, postgres, auth, storage, …).

• supabase.generate_typescript_types

  Generate TypeScript types from the database schema.

• supabase.list_edge_functions

  List all Edge Functions in a project.

Destructive-action audit

1 destructive tool — confirm per call

Each runs only when the trust policy allows it; under allowDestructive: false they prompt per call.

• supabase.delete_branch

Destructive-action audit (X2.18): delete_branch is flagged in `destructive_tools` and is blocked when the trust policy sets `allowDestructive: false`.

Known limitations

• Requires a Supabase personal access token (SUPABASE_ACCESS_TOKEN); without it the server cannot authenticate to the Management API and tools return an auth error.
• Without `--project-ref` the server can access every project in your Supabase account; scope it to a single project (account-level tools like list_projects are then disabled).
• Mutating tools (apply_migration, create_project, deploy_edge_function, branch operations) act on real infrastructure — Supabase recommends `--read-only` and a non-production project; read-only mode runs execute_sql as a read-only Postgres user and disables mutating tools.

Spec contributors

Maintainers who landed commits onmcp-specs/supabase.json.

• pspsbali

Freshness

When this spec was last reviewed by a maintainer and last machine-validated against the live server.

Spec last reviewed

1 months ago(2026-06-25)

Auto-validated

never