Supabase MCP

What it gives the AI

The AI runs your Supabase project from the chat: it designs and creates tables, writes and applies migrations, runs SQL queries, reads logs, deploys Edge Functions and pulls up Supabase documentation. A full backend loop by voice, without switching to the dashboard.

Example: "Create a posts table with RLS and a migration" — the AI generates the DDL, wraps it in a migration and applies it to the project you named.

Setup (exact steps)

The hosted remote server is https://mcp.supabase.com/mcp. The key parameters go in the URL query string: read_only, project_ref, features.

Claude Code

Connecting to a single project and read-only (recommended):

claude mcp add --transport http supabase \
  "https://mcp.supabase.com/mcp?read_only=true&project_ref=YOUR_REF&features=database,docs"

After adding it, run /mcp to sign in to your Supabase account (OAuth).

Cursor / Claude Desktop

{
  "mcpServers": {
    "supabase": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp?read_only=true&project_ref=YOUR_REF&features=database,docs"
    }
  }
}

If you're running Supabase locally via the CLI, the server is available at http://localhost:54321/mcp.

Usage example

Say: "Show me the database schema and find tables without RLS policies" → the AI reads the project structure (read-only) and flags tables with a potential security hole. To apply changes, you temporarily drop read_only.

Security

• read_only=true by default: that way the AI can't run destructive SQL or migrations. Remove the flag deliberately and only when you need it.
• project_ref=<ref>: bind the server to one project — otherwise the AI sees your whole organization.
• features=...: enable only the groups you need (database,docs) instead of opening up extras (storage, branching, functions).
• Authorization goes through a Supabase OAuth sign-in; don't hand the server a production project without read-only.

Gotchas

• Without project_ref the server runs in account mode and sees every project — easy to hit the wrong one.
• Writing to a live project is dangerous (migrations aren't reversible) — always use read_only in production and run changes on a branch or staging.
• It's an external hosted service: for a strict perimeter, consider the local CLI endpoint.