Because it is hosted and OAuth-backed, setup is a URL and a login rather than a service key sitting in a config file — and the tool set goes well past querying: migrations, edge function deploys, branch merges and the advisor warnings for the project. Read-only and single-project variants are just query parameters, which is the honest way to hand an agent less power.
Supabase's official MCP server, reached as a hosted HTTP endpoint at https://mcp.supabase.com/mcp. Your client prompts you to log in to Supabase during setup and you pick the organisation that holds the project, so there is no token to paste or store.
- The schema as the agent needs it — `list_tables`, `list_extensions`, `list_migrations`, and `generate_typescript_types` for types that match what is actually deployed
- Reads and changes against the database: `execute_sql`, and `apply_migration` for changes that should be recorded as one
- Operational answers instead of a dashboard tab — `query_logs` and `get_advisors` for the warnings Supabase already raises about your project
- Project and organisation management: `list_projects`, `get_project`, `create_project`, `pause_project`, `restore_project`, with `get_cost` and `confirm_cost` making the price of a new project an explicit step
- Edge functions end to end — `list_edge_functions`, `get_edge_function`, `deploy_edge_function`
- Branch workflows that mirror how you ship: `create_branch`, `list_branches`, `merge_branch`, `rebase_branch`, `reset_branch`, `delete_branch`
- `search_docs` for the Supabase documentation, and `get_project_url` and `get_publishable_keys` for wiring a client app
- Feature groups and a read-only mode can be pinned in the URL — project_ref, read_only and features are query parameters on the endpoint
A Supabase account, authorised through your client's login prompt — nothing to configure beyond an http entry pointing at https://mcp.supabase.com/mcp. Supabase publishes security guidance to read first, and a connection tab in the dashboard that builds a custom URL for one project. Running locally with the Supabase CLI, the same server answers on http://localhost:54321/mcp with a limited subset of tools and no OAuth; self-hosted installations are the same story. For library use, the npm package `@supabase/mcp-server-supabase` exports createToolSchemas() for the AI SDK's MCP client and createSupabaseMcpHandler() for serving the tools from your own endpoint.
One command plus a key — npx -y @supabase/mcp-server-supabase, then supply credentials