Skip to content
← Tools / Skills
ToolSupabase/10 trustVerified
Supabase MCP Server logo

Supabase MCP Server

Supabase's official MCP server — manage projects, tables, and SQL from your agent, hosted or local.

Visit official site →

About

supabase/mcp (2.9k stars, Apache-2.0) is Supabase's official MCP server. The easiest path is the hosted endpoint at https://mcp.supabase.com/mcp — OAuth login, pick an org and project, done — with project_ref and read_only URL parameters for scoping. Local/self-hosted variants ship as npm packages (@supabase/mcp-server-supabase).

Verified Oct 2026: the repo transferred from supabase-community/supabase-mcp to supabase/mcp (old URLs redirect). 25 releases in 12 months, pushed Oct 2026. Supabase's own docs include security best practices for connecting an LLM to your project — read them first; this tool can run SQL.

What it can do

  • Hosted OAuth endpoint — no local process needed for the managed path
  • Project management: tables, config inspection, SQL execution via natural language
  • project_ref and read_only scoping parameters
  • Local npm packages plus a PostgREST companion server in the same repo
  • Apache-2.0, official Supabase maintenance, 25 releases in 12 months

Setup

  1. Easiest: add the hosted server https://mcp.supabase.com/mcp to your MCP client (type: http).
  2. Complete the OAuth flow and select your org/project.
  3. Scope with URL params: ?project_ref=...&read_only=true for safe exploration.
  4. Or run locally: install @supabase/mcp-server-supabase per the repo README.
  5. Read Supabase's MCP security best practices before granting write access.

Prerequisites

A Supabase account/project (hosted) or the npm package (local); an MCP client with HTTP/streamable support.

Use cases

mcpmcp-serversdataautomation

Works with

Claude CodeCursorWindsurfAny agent (.md)

Trust score — 8/10

/10 trustVerified

Scored 8/10 (verified tier). Official Supabase project, Apache-2.0, active (25 releases/12mo), and the hosted OAuth path with read_only scoping is genuinely well-designed. Docked two points: (1) this is SQL execution from an LLM against your production database — the blast radius demands read-only-first and scoped credentials; (2) the repo transfer (supabase-community → supabase/mcp) means older guides and package references may point at stale locations.

★ 2,947 GitHub stars

How the trust score is built

Full methodology →
Adoption · stars/downloads, log-scaled vs peers
6.7/10
Maintenance · recency, releases, issue load
8.2/10
Openness · license + docs
10.0/10
Manual review · sanity read + red-flag check
8.0/10
  • · 2,947 GitHub stars (log-scaled vs catalog peers)
  • · last push 1d ago; 25 releases/12mo; 138 open issues
  • · manual review: official Supabase (2.9k stars), 25 releases/12mo, hosted OAuth + read_only scoping; repo transferred supabase-community -> supabase/mcp; SQL-from-LLM needs read-only-first

Sources

Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.