Supabase MCP Server

What it does (plain English)

Supabase is a hosted Postgres database with login, file storage and serverless functions built in. Its MCP server (a plug-in that gives Claude a new ability) lets Claude work inside your Supabase account: list tables, write and apply migrations, run SQL, read logs, check security and performance advisors, generate TypeScript types and deploy Edge Functions.

Supabase hosts it at https://mcp.supabase.com/mcp. You sign in once through your browser and Claude gets access with your developer permissions.

Tools come in feature groups you can switch on or off:

Group	Example tools	On by default?
Database	list_tables, apply_migration, execute_sql	Yes
Debugging	query_logs, get_advisors	Yes
Development	get_project_url, get_publishable_keys, generate_typescript_types	Yes
Edge Functions	list, get and deploy functions	Yes
Account	project, organization and cost tools	Yes (off in project-scoped mode)
Docs	search_docs	Yes
Branching (experimental)	create, merge, reset, rebase branches	Yes (needs a paid plan)
Storage	bucket listing and config	No

Is it for you?

Pick it if your app’s backend is Supabase and you want Claude to change the schema or chase down a bug without you writing SQL by hand.

Be careful if your project holds real customer data. Supabase’s docs say to connect to a production project “only when the task requires production evidence” and to prefer a development project or branch. If you are not sure, use read-only mode.

What you can do with it

• Design a table by describing it: “Create a waitlist table with email (unique), signup source and created_at, and enable row level security.” Claude writes a migration and applies it.
• Ask questions of your data: “How many waitlist signups came from the Product Hunt link this week?” via execute_sql.
• Find what’s broken: “Check the API logs for errors in the last hour” with query_logs.
• Run a health check: ask Claude to run get_advisors and explain each warning Supabase’s advisors report for your project.
• Keep your app in sync: “Regenerate TypeScript types for my database and save them to src/types/supabase.ts.”

How to set it up

1. Read the risks. Supabase asks you to read its security best practices before connecting: https://supabase.com/docs/guides/ai-tools/mcp#security-risks

2. Claude Code. From your project folder:

   claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp?features=docs%2Caccount%2Cdatabase%2Cdebugging%2Cdevelopment%2Cfunctions%2Cbranching"

   This writes the server into .mcp.json so teammates get it too.

3. Sign in. From a regular terminal (Supabase notes this, not the IDE extension), run claude /mcp, pick supabase, choose Authenticate, log in and grant access to the organization that contains your project.

4. Lock it down (recommended). Change the URL to scope it:

   https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true

   project_ref limits Claude to one project and turns off account tools. read_only=true runs all SQL as a read-only Postgres user. features=database,docs limits which groups load. The Supabase dashboard’s Connect > MCP tab can build this URL for you.

5. claude.ai or Claude Desktop. Settings > Connectors > Add custom connector, and paste the same URL. Anthropic lists custom connectors for Pro, Max, Team and Enterprise plans.

Watch out for

• Prompt injection. Supabase’s own example: a support ticket in your database could contain text that tricks Claude into running queries it shouldn’t. Keep manual approval of tool calls on for interactive work.
• Developer-level access. The server runs with your permissions. Supabase says not to give it to your customers; it is for internal use.
• Confirmations are guardrails, not guarantees. The server asks before creating billable resources, but Supabase notes some clients can answer those prompts automatically.
• Local and self-hosted are limited. With the Supabase CLI the server lives at http://localhost:54321/mcp, but it offers a smaller tool set and no OAuth. The same applies to self-hosted Supabase.
• Test schema changes on a branch before merging to production.

Alternatives

• Neon MCP if your Postgres is on Neon; it has similar read-only and project-scoping options.
• Airtable MCP if you want a spreadsheet-style database rather than SQL.
• Context7 to fetch current Supabase client-library docs while Claude writes your app code.