Supabase MCP Server

The Supabase MCP Server connects agents to Supabase projects: schema and data operations, debugging, Edge Functions, account management, docs search, and experimental branching, organized as feature groups that can be narrowed per connection. The hosted deployment at https://mcp.supabase.com/mcp authorizes through OAuth with dynamic client registration (personal access tokens remain available for CI); a 2026-08-07 probe confirmed the OAuth requirement first-hand via an RFC 9728 resource_metadata challenge. A local stdio package exists for the CLI and self-hosted deployments, which Supabase notes offers a limited tool subset and no OAuth 2.1.

Two documented safety controls are worth knowing: read_only=true runs all queries as a read-only Postgres user, and project_ref scopes the connection to one project and drops account-level tools. Supabase's own security guide treats prompt injection as the primary attack vector, with a worked example of a poisoned support ticket steering a connected agent, and recommends development projects, internal-only use, and the narrowest feature set.

No surface names a supported MCP specification revision. The vendor docs link the 2025-06-18 spec's authorization section when describing dynamic client registration, which cites a feature rather than declaring a revision, and the SDK dependency (^1.25.2, deliberately pinned per the project's own PR notes) is not evidence either. spec_status is therefore unknown. The repository moved from supabase-community into the supabase org and is now a monorepo also hosting a PostgREST server package.