Supabase
supabase.com- Category
- Developer Tools
- Rank
- No. 199Tools index
- Listed in
- #2 Add vector search · #1 Add a backend · #2 Choose data infrastructure
- Pricing
- Freemium
- Type
- TOOL
- Use case
- Deployment & Operations · Security & Identity
- Interfaces
- API
- Builder
- supabase
- GitHub
- 110.7k stars
- Latest release
- v1.26.08
- Date
About
Open-source Firebase alternative — Postgres database, auth, realtime, storage, and edge functions in one
What it does
Supabase bundles several independently built open projects behind one dashboard so a Postgres instance you fully own gets a JWT-based sign-in layer, an API server that exposes tables as REST and GraphQL without writing controllers, an Elixir process that pushes row-level changes to clients over sockets, an S3-backed file layer, and a Deno sandbox for running custom logic outside the normal request cycle. You can use Supabase's hosted version or run every one of those pieces yourself with Docker.
Why it's ranked here
Its place here is earned by breadth of surface, not novelty of any one piece: a permissively licensed monorepo that ships an installable CLI, officially maintained client libraries in five languages plus several community ones, and a declared MCP server for agent tooling, all wired to a single Postgres database that stays fully exportable. Every layer, from auth to functions, is an independently swappable open source project rather than a proprietary lock-in, which is the actual bet this tool is making.
What's good
The client library layer is genuinely modular. Each language binding is assembled from separate, independently versioned packages, one per underlying service, so an app that only needs authentication and storage is not forced to carry a full realtime or functions dependency it never calls. The edge function runtime also verifies both older symmetric JWTs and newer asymmetric ones in the same request path, so a project can rotate its signing algorithm without a coordinated cutover for every client.
Tradeoffs
Self hosting means running eight separately maintained open source services in step with each other, from the authentication server to the edge proxy, rather than a single binary; keeping them compatible across upgrades is real ongoing work, not a one time setup. The project itself is a large multi application monorepo with its own generated code and a lint ratchet, so contributing requires learning that structure before touching a single feature.
How to use it well
It fits a team that wants a real Postgres database as the source of truth and is willing to reach into individual services as needs diverge, using the hosted dashboard to start and self-hosting later without a rewrite. It suits agent-based tooling too, since it declares its own MCP server out of the box. It is a poor fit for anyone who wants a single opaque managed service with no interest in how the underlying pieces fit together.
Technical notes+
The declared license in LICENSE and package.json is Apache-2.0. AGENTS.md and package.json show a pnpm plus Turborepo monorepo with apps/studio, apps/docs, apps/www and several other apps, and packages/pg-meta, packages/common, packages/api-types and packages/ai-commands among its internal libraries. packages/pg-meta/src/index.ts exports SQL-builder functions (roles, columns, schemas, tables, triggers, policies) plus safe/unsafe SQL fragment helpers (safeSql, untrustedSql, acceptUntrustedSql) used for Postgres introspection. packages/api-types/index.ts merges three generated OpenAPI-style type sets (api-v1, api-v2, platform) into combined paths, operations and components interfaces for the Management API. apps/studio/server.ts is a TanStack Start server entry that wraps a Sentry error handler around the fetch handler before the route tree runs. docker/volumes/functions/main/index.ts is the Deno-based edge function router: it authenticates requests by detecting the JWT algorithm (HS256 via a shared secret, ES256/RS256 via a JWKS set) before dispatching to a per-function Deno worker with a fixed memory limit and a timeout. .mcp.json declares an HTTP MCP server pointed at mcp.supabase.com. CONTRIBUTING.md and DEVELOPERS.md describe the fork-and-PR contribution flow and require running the build and Prettier checks locally before submitting.
Observed
- License
- Apache-2.0 license (LICENSE, package.json)
- Architecture
- Monorepo built with pnpm and Turborepo, containing separate apps for the studio dashboard, docs site, marketing site and other properties
- Interfaces
- A CLI, REST and GraphQL APIs generated from the database, realtime websocket subscriptions, and a declared MCP server for AI tool integration
- Deployment
- Runs as a hosted platform or self-hosted through Docker Compose
- Client libraries
- Official client libraries for JavaScript/TypeScript, Flutter, Swift and Python; community-maintained libraries for C#, Go, Java and Kotlin
- Edge functions
- Edge functions execute in a Deno-based worker runtime with a per-function memory ceiling and timeout
- Repo conventions
- Documented list of generated files and directories that must not be hand-edited
Read from README.md, package.json, Makefile, packages/pg-meta/src/index.ts, apps/studio/server.ts, packages/ai-commands/index.ts, packages/common/index.tsx, packages/api-types/index.ts, DEVELOPERS.md, CONTRIBUTING.md, AGENTS.md, LICENSE, apps/docs/content/guides/cli.mdx, docker/volumes/functions/main/index.ts, .mcp.json.
What it can do
Store and query relational data
SQL queries and data records → Query results and stored data in Postgres database
Authenticate users
User credentials (email/password, OAuth tokens, magic links) → Authentication tokens and user sessions
Sync data in real-time
Database changes and client subscriptions → Live data updates pushed to connected clients
Store and retrieve files
Files and media uploads → Stored files with access URLs and metadata
Execute serverless functions
JavaScript/TypeScript code and HTTP requests → Function responses and side effects
Generate database APIs automatically
Database schema and table definitions → RESTful API endpoints and GraphQL schema
Manage user permissions and access control
Row-level security policies and user roles → Authorized data access and restricted operations
Intel on Supabase
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.