Supabase Skill for Claude: Safer Database, Auth and RLS Work

The Supabase skill makes your agent check current Supabase docs, follow a security checklist and use the CLI or MCP server for database and auth work.

Installs: 353.1K; on skills.sh
Stars: 3K; on GitHub
Files: 3; besides SKILL.md
Updated: Oct 2026; last repo commit

The supabase skill triggers on any Supabase task: database, auth, Edge Functions, Realtime, Storage, migrations, security audits, the Supabase CLI or MCP server, and error debugging. It first reads the Supabase changelog for breaking changes, then looks up docs instead of relying on memory, verifies each fix with a test query, and stops retrying after 2 or 3 failed attempts.

Its security checklist covers RLS on exposed tables, never using user_metadata for authorization, view settings that respect RLS, and keeping service_role keys out of browser code. It works best with the Supabase CLI installed and, optionally, the Supabase MCP server connected.

Good for

Developers building on Supabase Auth, Postgres, Storage or Edge Functions
Teams that want row-level security (RLS) and key handling checked on every change
Anyone debugging a Supabase error, a slow query or a failed migration

Install supabase

Claude Code

Copy this prompt.

Install the supabase skill in Claude Code. Run this command:

npx skills add https://github.com/supabase/agent-skills --skill supabase

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); debugging and troubleshooting errors or unexpected behavior on Supabase projects (HTTP errors, Postgres errors, RLS surprises, permission denied, schema cache issues, timeouts, Edge Function crashes, Realtime drops, Storage failures) and reading or querying logs (Logs Explorer, ClickHouse).

Sections in SKILL.md

Core Principles
Supabase CLI
Supabase MCP Server
Supabase Documentation
Making and Committing Schema Changes
Option A: Declarative schemas
Option B: Imperative migrations
Debugging
Reference Guides

Key facts

Author: supabase (owner of the supabase/agent-skills repo)
License: MIT
Installs on skills.sh: 353,111 as of 2026-11-02
GitHub stars: 2,977 for the whole supabase/agent-skills repo
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn
What is inside: 3 files besides SKILL.md (1 in folder root, 1 in assets/, 1 in references/)
Needs: Supabase CLI (db query needs v2.79.0 or newer, db advisors v2.81.3 or newer); the Supabase MCP server is optional; web access to supabase.com docs
Part of plugin: supabase
Last commit to the repo: 2026-10-02

What it includes

Reads supabase.com/changelog.md for breaking changes
Before implementing, the agent fetches the changelog index and follows links for breaking-change tags that match your task.
Try: “Add a profiles table with RLS to my Supabase project.”
Network · Check the changelog first
MCP search_docs, then docs pages as .md, then web search
Any docs page can be fetched as markdown by adding .md to its URL. The agent must read the Monitoring and Debugging guide before diagnosing an error.
Network · Look up docs in order
Auth, API key, RLS, view, storage and package rules
Covers user_metadata in JWT checks, service_role keys, security_invoker views, UPDATE policies that need USING and WITH CHECK, SECURITY DEFINER functions, storage upsert and pinned package versions.
Read · Security checklist
Finds commands with --help instead of guessing
Notes gotchas such as db query (CLI v2.79.0+), db advisors (v2.81.3+) and using a scoped SUPABASE_ACCESS_TOKEN in CI instead of the browser login.
Runs code · Supabase CLI via --help
Edits supabase/schemas or iterates with SQL, then builds a migration
Declarative projects edit the schema files. Imperative ones use execute_sql or db query, run advisors, then db pull to generate the migration. It says not to use apply_migration on a local database.
Runs code · Schema changes: declarative or imperative
Four ordered checks when the MCP tools do not show
Checks that mcp.supabase.com answers, that .mcp.json is correct, that you finished the sign-in, and that a scoped token has the needed permission.
Runs code · MCP connection troubleshooting
Reads references/skill-feedback.md when guidance was wrong
If you report that the skill gave wrong or missing guidance, the agent reads this file; the folder also carries a feedback issue template.
Read · Skill feedback

From the official docs

Permissions

Medium risk

The agent can run SQL and write migrations on your Supabase project. Use a scoped access token and try changes on a development project first.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can run SQL on your Supabase database
SKILL.md uses execute_sql and db query to change schemas. Start on a development project and review SQL before it runs.
The browser login gives full account access
SKILL.md says supabase login creates a classic token with access to every organization and project, and tells you to use a scoped token for scripts, CI and agents.
Database password commands ignore token limits
SKILL.md notes that commands using the database password, such as db push, are not limited by the token permissions.

Technical details

Talks to	supabase.com docs and changelog. mcp.supabase.com (if you connect the MCP server)
Scopes	Runs supabase CLI commands and, if connected, Supabase MCP tools Can run SQL, create migration files and read logs Fetches supabase.com docs and changelog

Questions

What does the Supabase skill do?

It makes your agent work from current Supabase docs and a security checklist instead of memory. It covers database, auth, Edge Functions, Storage, migrations, the CLI, the MCP server and debugging.

How do I install the Supabase skill?

Use the install box at the top of this page, which has tabs for Claude Code, the Claude app and Codex. The repo README also documents a Claude Code plugin route.

Do I need the Supabase MCP server?

No. SKILL.md lists the Supabase CLI and docs pages as ways to work, and names MCP tools such as execute_sql, get_advisors and search_docs as options (search_docs is its preferred docs lookup). For MCP setup it points to the Supabase MCP guide.

Does it need an API key?

No key is named in SKILL.md. It uses your Supabase CLI login, or a scoped personal access token in CI. The MCP server signs in with OAuth in the browser.

Can it change my database?

Yes. It can run SQL through the CLI or MCP, write migration files and run advisors. Use a scoped token and a development project first.

How is it different from supabase-postgres-best-practices?

The supabase skill covers the whole platform and its security rules. supabase-postgres-best-practices is a separate skill in the same repo for Postgres performance guidance, and you install it on its own.

Is the Supabase skill safe?

It is guidance plus CLI and MCP use, and it bundles no scripts, but the commands it runs can change your database. SKILL.md tells it to use scoped tokens and verify changes. See the audit results under key facts.

Information

updated Nov 2, 2026

Repository: supabase/agent-skills
Folder: skills/supabase

supabase/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

supabase SKILL.md · github.com
supabase/agent-skills README · github.com
supabase-postgres-best-practices SKILL.md · github.com
skills.sh listing and audits · skills.sh