LabscoMCP early access ↗
QuegenxMCP SERVER

Supabase MCP Server by Quegenx

Full administrative control of a Supabase Postgres database — tables, records, policies, roles, storage, realtime and raw SQL — from a chat window.

Relational SQL DatabasesCommunity

LABSCO SUMMARY

Administrative reach, with an administrative blast radius.

The coverage is unusually wide for a database server: RLS policies, roles, realtime channels and storage all sit next to ordinary CRUD, so an agent can do the things you would normally open the dashboard for. That is also the caution — drop_table, delete_role and a raw query tool are in the same list, and the connection string carries your database password, so scope the credential to what you are willing to have changed.

What it is

An MCP server that connects to your Supabase Postgres instance with a pooler connection string and exposes the whole administrative surface as tools. Not just queries: schema changes, row-level security policies, database roles, storage buckets, enumerated types, publications and the realtime configuration are all reachable, plus a query tool for arbitrary SQL when nothing else fits.

What you get

  • Tables created, renamed and dropped, columns added, altered and dropped, and rows read and written — list_tables, create_table, drop_table, rename_table, add_column, drop_column, alter_column, fetch_records, create_record, update_record, delete_record
  • Indexes and constraints managed as first-class objects — list_indexes, create_index, delete_index, update_index, list_constraints, add_constraint, remove_constraint, update_constraint
  • Database functions and triggers written and replaced — list_functions, create_function, update_function, delete_function, list_triggers, create_trigger, update_trigger, delete_trigger
  • Row-level security policies and database roles, the part most agents cannot reach — list_policies, create_policy, update_policy, delete_policy, list_roles, create_role, update_role, delete_role
  • Storage buckets, files and folders — list_buckets, create_bucket, delete_bucket, delete_file, bulk_delete_files, list_folders
  • Realtime policies, channels and messages, plus its status and views — list_realtime_policies, create_realtime_policy, update_realtime_policy, delete_realtime_policy, list_realtime_channels, manage_realtime_channels, send_realtime_message, get_realtime_messages, manage_realtime_status, manage_realtime_views
  • Enumerated types, publications and auth users — list_enumerated_types, create_enumerated_type, update_enumerated_type, delete_enumerated_type, list_publications, create_publication, update_publication, delete_publication, list_users, create_user, update_user, delete_user
  • Arbitrary SQL when the typed tools do not cover it — query

Requirements

Node.js >= 16.x and npm >= 8.x, then npm install and npm run build — there is no published package, you run dist/index.js yourself. The Supabase project ID, the database password and the pooler connection string go on the command line as a single argument, so the credential sits in your client config; keep that file out of version control. Use absolute paths for both the node binary and dist/index.js, which is the most common reason the server fails to appear. DEBUG=true in front of the command prints detailed logs. On Windsurf/Cascade only tools are supported — no prompts, no resources, stdio only — and tool calls consume credits whether they succeed or fail.

Setup effort

Build from source — git clone https://github.com/Quegenx/supabase-mcp-server.git

See installation options