Home / Directory / Supabase MCP
Supabase MCP: let the agent see the project, preferably read-only
Supabase's MCP server gives an assistant project context: tables, config, logs, SQL. That is powerful and, on a production project, easy to regret.
What it does
The hosted endpoint is https://mcp.supabase.com/mcp. Clients use HTTP MCP and OAuth. You can generate a project-scoped URL in the dashboard. Docs also describe http://localhost:54321/mcp for the local CLI, with fewer tools and no OAuth.
Query parameters matter. project_ref pins one project. read_only=true runs SQL as a read-only role. Self-hosted Supabase has a more limited MCP.
The repo and the docs page both resolved. The docs walk through security practices; read those before you paste the JSON into Cursor.
Who it is for
Next.js + Supabase teams whose agent keeps guessing the schema. A read-only connection is a reasonable default during feature work.
Not for a shared workshop laptop pointed at prod. Not a replacement for typed clients or for migrations you review.
Our take
First-party, Apache 2.0, and a real read-only switch. Those three are why this belongs in a short directory.
Limits: any LLM connected to a database is a prompt-injection and data-exfil surface. The agent can still emit a migration that creates a table with RLS off; the MCP will not stop that unless you block writes. Local and self-hosted feature sets lag the hosted server.
We have no partnership with Supabase. Check their security page, not just this summary, before you enable writes.
Compared with AgentKit Drawer
Our Supabase + Next.js Agent Kit and the free RLS rule live in the repo: enable RLS in the same migration, per-command policies, never disable RLS to "make it work." The MCP can show the agent the current schema; the kit tries to stop the next bad migration.
Use read-only MCP for inspection. Use the kit (or the free .mdc) for the files the agent edits. Writes through MCP are a separate decision.
Related AgentKit pack
Rules, a read-only migration-reviewer and a hook that blocks a new Supabase table without RLS. Complements a live MCP connection; it does not replace one.
One-time payment · instant download · 14-day refund. We do not claim this third-party kit is affiliated with AgentKit Drawer.