Supabase MCP

Why it's ranked here

The project combines a simple hosted HTTP setup with unusually useful controls for narrowing access. Project scoping, read-only mode, and feature filtering reduce unnecessary exposure. Typed schemas for the Vercel AI SDK add client-side validation, while unit, integration, and end-to-end test configurations show serious engineering discipline.

What's good

Access can be limited to one project, non-mutating operations, or selected feature groups such as database and documentation. The published package supplies input and output schemas for static AI SDK tools, enabling inferred TypeScript types and client-side validation. It also supports hosted, local CLI, and self-hosted connections.

Tradeoffs

Local CLI and self-hosted environments expose only a limited tool subset and lack OAuth 2.1. Tool results do not provide structured MCP content, so the AI SDK parses JSON from text instead. Connecting an LLM to project data also carries enough risk that the setup guide explicitly directs users to security practices first.

How to use it well

Use it when developers already work in Supabase and want an assistant involved in database, configuration, or project maintenance tasks. Start project-scoped and read-only, then enable only the feature groups the workflow needs. It does not replace the separate PostgREST MCP server for connecting an application's own users through its REST API.

Observed

License

Apache 2.0

Primary language

TypeScript

Interface

Model Context Protocol over HTTP, with a stdio build entry

Packaging

Monorepo with Supabase, PostgREST, and shared utility packages

Build outputs

CommonJS and ESM bundles with TypeScript declarations and source maps

Platform support

Hosted Supabase, local Supabase CLI, and self-hosted Supabase

Testing structure

Unit, integration, and end-to-end Vitest workspaces