Model Context Protocol moderate risk

Supabase

This MCP server enables IDEs to interact with Supabase, offering SQL execution, schema management, and access to Supabase Management API and Auth Admin SDK with safety controls.

Connections & Capabilities

Connects To

GitHubPostgreSQLSupabaseAWS

Capabilities

readwriteadminexec

Quickstart

Install

brew install postgresql@16

Config

{
    "mcpServers": {
      "supabase": {
        "command": "/Users/username/.local/bin/supabase-mcp-server",  // update path
        "env": {
          "QUERY_API_KEY": "your-api-key",  // Required - get your API key at thequery.dev
          "SUPABASE_PROJECT_REF": "your-project-ref",
          "SUPABASE_DB_PASSWORD": "your-db-password",
          "SUPABASE_REGION": "us-east-1",  // optional, defaults to us-east-1
          "SUPABASE_ACCESS_TOKEN": "your-access-token",  // optional, for management API
          "SUPABASE_SERVICE_ROLE_KEY": "your-service-role-key"  // optional, for Auth Admin SDK
        }
      }
    }
}

Exposed MCP Tools (5)

high

SQL Query Execution

Executes SQL queries against the Supabase database.

Allows arbitrary SQL execution, potentially leading to data modification or deletion.

high

Schema Management

Manages database schema changes, including creating, altering, and dropping tables.

Modifying the database schema can have significant impact on application functionality and data integrity.

high

Supabase Management API Access

Provides access to the Supabase Management API for managing Supabase projects.

Allows administrative actions on the Supabase project, such as managing users and settings.

high

Auth Admin SDK Methods

Provides access to Supabase Auth Admin SDK for managing users.

Allows administrative actions on user accounts, such as creating, deleting, and modifying users.

safe

Database Schema Versioning

Automatically versions database schema changes.

Primarily a read operation to track schema changes.

Safety Assessment

This MCP server provides a degree of safety through its tiered system and query validation. However, the ability to perform write operations and access administrative functions introduces risk, especially if the API key and other credentials are not properly secured.

Three-tier safety system for SQL operations (safe, write, destructive)
Runtime SQL query validation with risk level assessment
Transaction handling for both direct and pooled database connections
Requires API key for all operations

Allows write operations to the Supabase database
Access to Supabase Management API and Auth Admin SDK
Relies on environment variables for sensitive information
No explicit sandboxing mentioned