This is the opposite trade from a generic SQL server: more setup, far narrower surface. Because each tool pins the table, the action, the columns and the filters, an agent cannot read a table you did not expose or write a column you did not list — and RLS applies underneath as a second boundary since it authenticates as a user rather than with a service key. The password sits in your client config, so treat that account as the blast radius.
An MCP server whose tool list you write. Instead of exposing generic database access, you hand it a JSON array describing the tools you want — each with a name, a description, a typed parameter schema and an action that maps to a select, insert, update or delete on a named table — and those are the only tools the agent sees. Jinja-style templates fill parameters into the action at call time.
- Custom tools generated at runtime from a JSON definition, each with its own name, description and parameter schema
- Four action types behind them — `select`, `insert`, `update` and `delete` — bound to a table you name, with the columns, filters, values and returning list all fixed in the definition
- Template variables in `{{name}}` form substituted from the call's parameters, including into the table name itself when you want that
- Configuration supplied either as a file path or inline as base64, so the whole tool set can live in a client config with no separate file
- Authentication by email and password with automatic JWT refresh and session management
- Row Level Security respected on every operation — the project is explicit that it uses user-level access, not admin
A Supabase project and a user account in it. Four values, on the command line or as environment variables: `SUPABASE_URL`, `SUPABASE_ANON_KEY`, `SUPABASE_EMAIL` and `SUPABASE_PASSWORD`. The tool definitions come from `--config-path` pointing at a JSON file or `--tools-json-base64` carrying them inline. Run it with `npx supamcpbuilder` or install globally with npm. `DEBUG=supamcpbuilder` in front of the command turns on debug logging.
One command plus a key — npm install -g supamcpbuilder, then supply credentials