# Supabase (MCP Server)

> Manage Supabase databases, migrations, edge functions and logs

- Type: MCP server
- Publisher: Supabase (official)
- Categories: Development, Data & Analytics
- Website: https://supabase.com/docs/guides/getting-started/mcp
- Source: https://github.com/supabase-community/supabase-mcp
- Transport: streamable-http
- Server URL: https://mcp.supabase.com/mcp
- Sign-in: oauth
- GitHub stars: 2900
- Listed: 2025-04-04

## Overview

Supabase's MCP server lets an agent work on your Supabase project while you build: read the schema, write and apply migrations, run SQL, generate TypeScript types, deploy Edge Functions, read logs and run the security and performance advisors. In practice that covers requests like "add a profiles table with row-level security", "why is this insert failing? check the logs" or "run the advisors before we launch".

It's a developer tool. Supabase says not to hand it to customers or end users, because it acts with your own developer permissions.

## From the publisher

Supabase's official MCP server connects AI assistants to Supabase projects for table management, SQL execution, migrations, edge functions, logs, advisors and docs search. The hosted server uses OAuth dynamic client registration and supports read-only mode, project scoping and feature-group filtering via URL parameters.

## What you need

- **A Supabase account.** The hosted server at `https://mcp.supabase.com/mcp` signs you in with OAuth and dynamic client registration, so you don't create a token. Pick the organization that holds your project when you log in.
- **A client that speaks remote MCP.** For Codex, Supabase documents `codex mcp add supabase --url https://mcp.supabase.com/mcp` followed by `codex mcp login supabase`. For ChatGPT, Supabase points to its listing in the directory.
- **For CI or headless agents:** a personal access token sent as a bearer header, scoped to one project with only the permissions your tools need.
- **For local development:** the Supabase CLI serves the server at `http://localhost:54321/mcp`, with fewer tools and no OAuth.

## Good to know

- **It can run any SQL you can.** `execute_sql` and `apply_migration` are on by default, along with deploying Edge Functions and, without project scoping, creating and pausing projects.
- **Three URL options cut that down.** `read_only=true` runs queries as a read-only Postgres user, `project_ref=<id>` limits the server to one project and drops account tools, and `features=database,docs` enables only the tool groups you list.
- **Your data can carry instructions.** Supabase's own example is a support ticket whose text tells the model to dump a sensitive table. Results are wrapped with a warning to the model, which Supabase calls not foolproof. Keep manual approval on.
- **Confirmations depend on your client.** Destructive SQL and paid actions such as creating a project or branch can trigger a confirmation form, but only in clients that support MCP elicitation. Supabase calls these a guardrail, not a guarantee.
- **Some tools cost money or a paid plan.** Creating projects and branches can add charges, and branching tools need a paid plan.

## Install

1. **Connect it in ChatGPT** Turn on Developer mode in ChatGPT (Settings → Security and login), open Plugins, select + and paste https://mcp.supabase.com/mcp as the MCP server URL, then sign in with OAuth. Add it to a chat from the composer's tools menu.

2. **Or add it to Codex or the API**

   Codex CLI:

   ```bash
   codex mcp add supabase --url https://mcp.supabase.com/mcp
   codex mcp login supabase
   ```

   config.toml:

   ```toml
   [mcp_servers.supabase]
   url = "https://mcp.supabase.com/mcp"
   ```

   Responses API:

   ```python
   import os
   from openai import OpenAI
   
   client = OpenAI()
   
   response = client.responses.create(
       model="gpt-6-astra",
       tools=[{
           "type": "mcp",
           "server_label": "supabase",
           "server_url": "https://mcp.supabase.com/mcp",
           "authorization": os.environ["SUPABASE_API_KEY"],
           "require_approval": "never",
       }],
       input="List the tables in my Supabase project",
   )
   print(response.output_text)
   ```

## Remove it

1. **In ChatGPT** Open the connection's details page in your plugin settings (chatgpt.com/plugins) and disconnect or delete it.

2. **In Codex**

   Codex CLI:

   ```bash
   codex mcp remove supabase
   ```

## Tools

- `list_tables`
- `execute_sql`
- `apply_migration`
- `list_migrations`
- `get_logs`
- `get_advisors`
- `generate_typescript_types`
- `deploy_edge_function`
- `list_edge_functions`
- `search_docs`

## Example prompts

- "List the tables in my Supabase project"
- "Create a migration that adds a profiles table with RLS"
- "Generate TypeScript types for my database"
- "Check the security advisors for my project"

## Also available as

- plugin: [Supabase](https://chatgptplugins.directory/plugins/supabase.md)
- app: [Supabase](https://chatgptplugins.directory/apps/supabase.md)

## Supabase alternatives

- [Chrome DevTools MCP](https://chatgptplugins.directory/mcp/chrome-devtools.md): Let coding agents control and debug a live Chrome browser
- [Playwright MCP](https://chatgptplugins.directory/mcp/playwright.md): Browser automation for agents via Playwright accessibility snapshots
- [GitHub](https://chatgptplugins.directory/mcp/github.md): Manage repos, issues, pull requests and Actions from your AI agent
- [Context7](https://chatgptplugins.directory/mcp/context7.md): Pull up-to-date, version-specific library docs into your coding agent
- [Stripe](https://chatgptplugins.directory/mcp/stripe.md): Query and act on your Stripe account and search Stripe docs from any agent
- [Atlassian Rovo (Jira & Confluence)](https://chatgptplugins.directory/mcp/atlassian-rovo.md): Work with Jira issues and Confluence pages through Atlassian's hosted MCP

## FAQ

### Is the Supabase MCP server safe to use with production data?

Supabase advises against it unless a task really needs production evidence. If it does, scope the server to that project, turn on read-only mode, limit the feature groups and ask for the narrowest query. For schema work, use a development branch instead. The main risk is prompt injection from rows in your own tables, so review every tool call before approving it.

### How do I make the Supabase MCP server read-only?

Add query parameters to the server URL, for example `https://mcp.supabase.com/mcp?project_ref=<id>&read_only=true`. Read-only mode runs all SQL as a read-only Postgres user, and project scoping removes the account-level tools. The configuration panel in Supabase's docs and the MCP tab in the dashboard can build the URL for you.

### What's the difference between the Supabase MCP server, app and plugin?

The [Supabase app](/apps/supabase) is the ChatGPT listing that Supabase's docs point ChatGPT users to. The [Supabase plugin](/plugins/supabase), made by Supabase for OpenAI's curated marketplace, packages that app, a connection to this hosted MCP server and two skills, `supabase` and `supabase-postgres-best-practices`. Add the MCP server directly when you want URL options such as read-only mode, or for the OpenAI API and other clients.

_Guide updated 2026-10-24. Sources: https://supabase.com/docs/guides/getting-started/mcp, https://github.com/supabase-community/supabase-mcp, https://github.com/openai/plugins/tree/main/plugins/supabase, https://learn.chatgpt.com/docs/extend/mcp._

---
Source: https://chatgptplugins.directory/mcp/supabase · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.