Supabase MCP Server: How to Connect It and Lock It Down

What the Supabase MCP server is

The Model Context Protocol is "an open-source standard for connecting AI applications to external systems." Its docs compare it to "a USB-C port for AI applications." An MCP server exposes tools; a client such as Claude Code, Cursor or VS Code calls them.

Supabase's server connects those clients to your Supabase account. Once connected, your assistant can "interact with and query your Supabase projects on your behalf," according to the Supabase MCP docs. It is also listed as an official Claude connector, which Supabase announced on February 3, 2026, and it is available as a connector in the ChatGPT directory.

Hosted vs local: which endpoint to use

There are two common ways to connect:

• Hosted: https://mcp.supabase.com/mcp. This works against your cloud projects and authenticates with OAuth in the browser by default, so you do not need a personal access token.
• Local (Supabase CLI): http://localhost:54321/mcp. Available when you run Supabase locally with supabase start. The project README says this mode "offers a limited subset of tools and no OAuth 2.1." If you turn on the experimental [experimental] stack setting, read the MCP URL from supabase status instead, since ports are assigned per project.

Self-hosted Supabase also supports MCP, with a limited subset of tools and no OAuth 2.1; Supabase covers it on a separate "Enabling MCP server" page.

How to connect it

For Claude Code, Supabase's docs give this command:

claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp"

Or add this to .mcp.json:

{
  "mcpServers": {
    "supabase": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp"
    }
  }
}

Then run claude /mcp in a regular terminal, select the "supabase" server and choose "Authenticate."

For Cursor, the docs use .cursor/mcp.json:

{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com/mcp"
    }
  }
}

The same docs page has configs for Codex, Gemini CLI, GitHub Copilot, VS Code, Goose, Kiro, Warp and others. When you sign in, choose the organization that contains your project. To confirm it works, Supabase suggests a prompt like "What tables are there in the database? Use MCP tools."

For CI, where browser OAuth is not possible, create a scoped personal access token and pass it in an Authorization: Bearer header. Not every client supports custom headers.

Tools and feature groups

Tools are organized into feature groups. All groups except Storage are enabled by default.

• Database: list_tables, list_migrations, apply_migration, execute_sql. Core schema and query work.
• Debugging: query_logs, get_advisors. Logs and security/performance advisors.
• Development: get_project_url, get_publishable_keys, generate_typescript_types. Client setup and types.
• Edge Functions: list_edge_functions, deploy_edge_function. Deploy and inspect functions.
• Account management: list_projects, create_project, pause_project. Disabled when project_ref is set.
• Docs: search_docs. Searches Supabase documentation.
• Branching (experimental): create_branch, merge_branch, reset_branch. Requires a paid plan.
• Storage: list_storage_buckets, get_storage_config. Disabled by default.

Safe-use settings

Supabase's docs open with a caution: "Connecting an LLM to your Supabase projects carries security risks." The main risk they describe is prompt injection, where text stored in your data (their example is a support ticket) tells the model to run a query that exposes sensitive rows. Supabase wraps SQL results with extra instructions to discourage this, but says it "is not foolproof."

You control exposure with URL query parameters, which can be combined:

• read_only=true: "Execute all queries as a read-only Postgres user."
• project_ref=<id>: scopes the server to one project and disables account tools.
• features=database,docs: enables only the listed groups.
• skip_elicitations=<tools>: skips form confirmations for named tools. Leave this off unless you have a reason; it does not bypass permissions or charges, but it removes a prompt.

Supabase's own combined example:

https://mcp.supabase.com/mcp?project_ref=abc123&read_only=true

Development vs production. Supabase recommends connecting to production "only when the task requires production evidence," and then with project scoping, read-only mode and restricted feature groups. For changes, use a development branch so you can test before merging. Other recommendations from the docs:

• Keep manual approval of tool calls on for interactive work.
• Give unattended routines only pre-approved, project-scoped, read-only tools.
• Do not give the server to customers or end users, because it "operates under the context of your developer permissions."
• Treat confirmation dialogs (cost confirmation for create_project and create_branch, destructive SQL confirmation for execute_sql and apply_migration) as guardrails, not guarantees.

How it compares with other options

• Supabase MCP (hosted): database, logs, Edge Functions, branching and account tools, with read-only optional. Setup is a URL plus browser OAuth. Best for Supabase cloud projects.
• Supabase MCP (local CLI): a limited subset of tools and no OAuth 2.1. Run supabase start, then use localhost:54321/mcp. Best for local development.
• Postgres MCP reference server: one read-only query tool plus table schema resources, set up with a connection string via npx or Docker. Works with any Postgres for read-only inspection, but is now archived.
• Supabase CLI and SQL directly: whatever commands you or the assistant run in a terminal, using an installed CLI and credentials. Best for scripted, reviewable migrations.

The Postgres reference server from the MCP project states that "All queries are executed within a READ ONLY transaction," and takes a postgresql:// connection string. It has been moved to the servers-archived repository, so treat it as a reference rather than a maintained product. It knows nothing about Supabase features like Edge Functions or advisors.

Supabase also publishes @supabase/mcp-server-postgrest, which its README says lets you "connect your own users to your app via REST API." That is a different use case from the developer tool covered here.

If you want to see the Supabase MCP server next to related options like Neon MCP and the PostgreSQL reference server, BestMCPTools has a listing with a comparison table of database MCP servers and notes on alternatives.

How to choose

• Your app runs on Supabase cloud: use the hosted server, scoped with project_ref, and add read_only=true whenever the task is investigation rather than change.
• You are building locally: use the CLI endpoint. Fewer tools, but no cloud data at risk.
• You only need read access to a non-Supabase Postgres database: a read-only Postgres server is simpler, though the reference one is archived.
• You want every change reviewed as code: have the assistant write migration files and run them yourself with the CLI, and keep MCP for read-only questions.

FAQ

Is Supabase an MCP?

No. Supabase is a backend platform. It provides an official MCP server that connects AI tools to your Supabase projects, available hosted at https://mcp.supabase.com/mcp.

How do I configure Supabase MCP?

Add the server URL to your client's MCP config (for example .mcp.json for Claude Code or .cursor/mcp.json for Cursor), sign in through the browser, and append project_ref, read_only and features parameters to narrow access.

Where is the Supabase MCP server on GitHub?

At github.com/supabase/mcp, the repository Supabase's docs link to. Its README documents the @supabase/mcp-server-supabase package and states the project is licensed under Apache 2.0.

How do I install and run an MCP server?

It depends on the server. Remote servers like Supabase's hosted one need only a URL in your client config. Local servers run as a command your client launches, such as npx -y @modelcontextprotocol/server-postgres with a connection string for the Postgres reference server.

Does Firebase have an MCP server?

Yes. Firebase documents a local Firebase MCP server that works with clients supporting stdio transport. Its docs launch it with npx -y firebase-tools@latest mcp, and it uses the same credentials as the Firebase CLI.

Ethan Halfhide builds software products with AI tools and runs BestMCPTools, a directory of Model Context Protocol servers.

Sources

• Supabase Docs: Supabase MCP Server
• Supabase: MCP Server feature page
• Supabase Blog: Supabase is now an official Claude connector
• Supabase Docs: Local development
• GitHub: supabase/mcp (README)
• Model Context Protocol: What is MCP?
• GitHub: MCP PostgreSQL reference server (archived)
• Firebase Docs: Firebase MCP server