Supabase MCP: let your AI assistant work with your database

• Lists the Supabase projects in your account.

  Shows the Supabase projects in your account. This is an account-level tool.

  Try: “Which of my Supabase projects exist, and what are they called?”

  Read · list_projects

• Shows the details and status of one Supabase project.

  Returns the details and current status of a single project.

  Try: “Is my blog project on Supabase up right now?”

  Read · get_project

• Lists your database tables, with columns and keys on request.

  Lists the tables in one or more schemas. The short view shows names only. The detailed view adds columns, keys and foreign keys.

  Try: “Show me every table in my app's database and the columns in each one.”

  Read · list_tables

• Runs any SQL you give it against your database, and can change data.

  Runs raw SQL on the Postgres database. Results can include text from your data, so treat them as untrusted. It changes data unless the server is set to read-only mode.

  Try: “Count how many users signed up in the last 7 days.”

  Write · execute_sql

• Searches the Supabase documentation for answers.

  Searches Supabase's own documentation so the assistant can answer from it.

  Try: “How do I turn on row level security for a table in Supabase?”

  Read · search_docs

• Lists the database migrations on record.

  Lists the migrations recorded for the database, so you can see which schema changes have been made.

  Try: “What schema changes have already been applied to my database?”

  Read · list_migrations

• Applies a schema change to your database. Risky statements may ask first.

  Runs a migration, which is a database schema change such as adding a table or column. Destructive statements may ask you to confirm first. It changes data.

  Try: “Add a created_at column to the orders table with a default of now.”

  Write · apply_migration

• Lists the Postgres extensions your database can use and has installed.

  Shows the Postgres extensions that are available and the ones already installed.

  Try: “Is the pgvector extension installed on my database?”

  Read · list_extensions

• Lists the Edge Functions in a Supabase project.

  Shows the Edge Functions that exist in a project.

  Try: “Which Edge Functions are deployed in my project?”

  Read · list_edge_functions

• Shows the files that make up one Edge Function.

  Returns the files of a single Edge Function, so you can read its code.

  Try: “Show me the code of my send-welcome-email function.”

  Read · get_edge_function

• Deploys an Edge Function. It replaces the one with the same name and goes live at once.

  Publishes an Edge Function. An existing function with the same name is replaced, and the new version starts serving right away. It changes data.

  Try: “Deploy my updated send-welcome-email function.”

  Write · deploy_edge_function

• Asks you to enter an Edge Function secret in the Supabase dashboard.

  Points you to the Supabase dashboard to type in an Edge Function secret. It needs a connection that is not read-only.

  Try: “Add the Stripe key as a secret for my Edge Function.”

  Write · create_edge_function_secret

• Shows recent logs for one service, such as the API, Postgres or Edge Functions.

  Gets the logs for one service over a window of up to 24 hours. In some setups this tool is hidden in favor of the log query tool.

  Try: “Show me the API errors from my project in the last hour.”

  Read · get_logs

• Searches project logs with SQL to filter or count entries.

  Runs a read-only SQL query against project logs, to filter log fields or count them.

  Try: “Count the 500 errors in my API logs from the last day.”

  Read · query_logs

• Lists security, performance and health warnings for your project.

  Returns advisor notices for the project, such as tables that are missing row level security policies.

  Try: “Check my Supabase project for security warnings.”

  Read · get_advisors

• Writes TypeScript types that match your database schema.

  Generates TypeScript types from the database schema, so app code can match the tables.

  Try: “Generate TypeScript types for my current database schema.”

  Read · generate_typescript_types

• Returns the API URL for a project.

  Returns the API URL of a project.

  Try: “What is the API URL for my Supabase project?”

  Read · get_project_url

• Returns a project's public API keys, including the older anon key.

  Returns the publishable API keys of a project and the legacy anon key.

  Try: “Give me the publishable key for my staging project.”

  Read · get_publishable_keys

• Lists the development branches of a project.

  Shows the development branches that exist for a project.

  Try: “Which development branches does my project have?”

  Read · list_branches

• Creates a development branch with migrations applied and no production data.

  Creates a development branch with all migrations applied and no production data. A branch can add hourly charges.

  Try: “Make a test branch of my project so I can try a schema change.”

  Write · create_branch

• Moves a branch's migrations and Edge Functions into production.

  Merges migrations and Edge Functions from a development branch into production. This is destructive.

  Try: “Merge my finished feature branch into production.”

  Write · merge_branch

• Brings a branch up to date with production so it gets newer migrations.

  Rebases a development branch on production to apply newer migrations. This is destructive.

  Try: “Update my test branch so it has the newest production migrations.”

  Write · rebase_branch

• Resets a branch's migrations. Untracked changes on it are lost.

  Resets a development branch's migrations. Untracked data or schema changes on the branch are lost.

  Try: “Reset my test branch back to its starting migrations.”

  Delete · reset_branch

• Deletes a development branch. This is destructive.

  Try: “Delete the old test branch I made last week.”

  Delete · delete_branch

• Creates a new project. A paid cost must be agreed to first.

  Creates a new Supabase project, which can add to your bill. A cost above zero must be agreed before the project is made.

  Try: “Create a new Supabase project called staging-api.”

  Write · create_project

• Pauses a project.

  Pauses the project you name. This changes its state.

  Try: “Pause my side-project database while I am away.”

  Write · pause_project

• Brings a paused project back.

  Restores a project that was paused. This changes its state.

  Try: “Bring my paused side-project back online.”

  Write · restore_project

• Shows one organization's details, including its subscription plan.

  Returns the details of one organization, including its subscription plan. This is an account-level tool.

  Try: “Which plan is my Acme organization on?”

  Read · get_organization

• Lists the organizations your Supabase login belongs to.

  Shows every organization your login is a member of. Off in project-scoped mode.

  Try: “Which Supabase organizations am I part of?”

  Read · list_organizations

• Quotes the cost of a new project or branch before you create it.

  Returns the cost of a new project or branch, so you can decide before anything is created. This is an account-level tool.

  Try: “How much would a new Supabase project cost before I create it?”

  Read · get_cost

• Lists the file storage buckets in a project.

  Shows the storage buckets in a project. The storage group is off by default.

  Try: “Which storage buckets does my project have?”

  Read · list_storage_buckets

• Shows a project's file storage settings.

  Returns the storage configuration of a project. The storage tools are off by default.

  Try: “What are the current file storage settings for my project?”

  Read · get_storage_config

• Changes a project's file storage settings.

  Updates the storage configuration of a project. It changes data. The storage tools are off by default.

  Try: “Raise the upload size limit for my storage buckets.”

  Write · update_storage_config

• Used by the assistant behind the scenes

  Gets a confirmation ID for a quoted cost, used when creating a project or branch.

  Returns a confirmation ID for a quoted project or branch cost. The ID is passed to the create step. This is the legacy cost flow.

  Try: “Confirm the quoted cost so the new branch can be created.”

  confirm_cost

• Sends feedback about these tools to the Supabase team.

  Sends a note about the Supabase tools to the Supabase team. It is off in read-only mode.

  Try: “Tell Supabase that the log query tool returned an unclear error.”

  Network · submit_feedback

• Deletes feedback you sent earlier to the Supabase team.

  Removes feedback you sent earlier, using the token that the send step returned. It is off in read-only mode.

  Try: “Withdraw the feedback I sent about that log error.”

  Delete · delete_feedback

Watch out for

• Prompt injection can expose private tables

  Text stored in your data, such as a support ticket, can instruct the model to run SQL that reveals other tables. Supabase says read-only mode does not remove this risk. supabase.com

• Runs SQL with your developer permissions

  execute_sql and apply_migration can change or drop data and schema. The server acts with your account's rights, so Supabase says not to give it to customers or end users. supabase.com

• Paid-resource confirmation can be skipped by an agent

  An open report says confirm_cost involves no human and its token can be computed, so an agent could create billable projects or branches. Form confirmations depend on client support. github.com

• OAuth asks for full account access

  An open request asks Supabase to request only the scopes the enabled tools need; today sign-in grants broad account access unless you scope a PAT yourself. github.com

• No read-only switch on Claude.ai connector or plugin

  Read-only is set with a URL parameter, which the hosted connectors and the auto-updating Claude Code plugin do not expose. github.com

• Does not bypass Row Level Security

  Supabase says RLS stays enforced, but the server may run at a higher privilege than your app's users. supabase.com

Security advisories

In their words