LABSCO SUMMARY
The agent gets the tools you wrote, not a query interface.
This is the opposite trade from a generic SQL server: more setup, far narrower surface. Because each tool pins the table, the action, the columns and the filters, an agent cannot read a table you did not expose or write a column you did not list — and RLS applies underneath as a second boundary since it authenticates as a user rather than with a service key. The password sits in your client config, so treat that account as the blast radius.
What it is
An MCP server whose tool list you write. Instead of exposing generic database access, you hand it a JSON array describing the tools you want — each with a name, a description, a typed parameter schema and an action that maps to a select, insert, update or delete on a named table — and those are the only tools the agent sees. Jinja-style templates fill parameters into the action at call time.
What you get
- Custom tools generated at runtime from a JSON definition, each with its own name, description and parameter schema
- Four action types behind them —
select,insert,updateanddelete— bound to a table you name, with the columns, filters, values and returning list all fixed in the definition - Template variables in
{{name}}form substituted from the call's parameters, including into the table name itself when you want that - Configuration supplied either as a file path or inline as base64, so the whole tool set can live in a client config with no separate file
- Authentication by email and password with automatic JWT refresh and session management
- Row Level Security respected on every operation — the project is explicit that it uses user-level access, not admin
Requirements
A Supabase project and a user account in it. Four values, on the command line or as environment variables: SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_EMAIL and SUPABASE_PASSWORD. The tool definitions come from --config-path pointing at a JSON file or --tools-json-base64 carrying them inline. Run it with npx supamcpbuilder or install globally with npm. DEBUG=supamcpbuilder in front of the command turns on debug logging.
Setup effort
One command plus credentials — npm install -g supamcpbuilder, then supply credentials
USE CASES
01
Giving an agent one specific query rather than the database
Define a tool that selects named columns from one table with a limit, and that is the entire surface it sees.
02
Letting an assistant create records safely
Write an insert tool that fixes the table and the value mapping, with required parameters declared, so the shape of what gets written is decided by you.
03
Shipping a tool set without shipping a file
Base64-encode the JSON definitions into the client config so there is nothing else to distribute or keep in sync.
04
Keeping per-user permissions in force
Authenticate as an ordinary user so Row Level Security applies to every call, instead of bypassing it with a service key.
BEFORE YOU INSTALL
What to know first
Requires
- npx on PATH
- SUPABASE_ANON_KEY in your environment
- SUPABASE_PASSWORD in your environment
- SUPABASE_EMAIL in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g supamcpbuilderMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"supamcpbuilder": {
"command": "npx",
"args": [
"-y",
"supamcpbuilder",
"--url",
"https://<YOUR_PROJECT>.supabase.co",
"--anon-key",
"<YOUR_ANON_KEY>",
"--email",
"<YOUR_EMAIL>",
"--password",
"<YOUR_PASSWORD>",
"--tools-json-base64",
"<YOUR_BASE64_ENCODED_TOOLS>"
]
}
}
}Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"supamcpbuilder": {
"command": "npx",
"args": [
"-y",
"supamcpbuilder",
"--url",
"https://<YOUR_PROJECT>.supabase.co",
"--anon-key",
"<YOUR_ANON_KEY>",
"--email",
"<YOUR_EMAIL>",
"--password",
"<YOUR_PASSWORD>",
"--config-path",
"<YOUR_PATH_TO_TOOLS_CONFIG>"
]
}
}
}