Supabase Mcp Server

- 💻 Compatible with Cursor, Windsurf, Cline and other MCP clients supporting stdio protocol
- 🔐 Control read-only and read-write modes of SQL query execution
- 🔍 Runtime SQL query validation with risk level assessment
- 🛡️ Three-tier safety system for SQL operations: safe, write, and destructive
- 🔄 Robust transaction handling for both direct and pooled database connections
- 📝 Automatic versioning of database schema changes
- 💻 Manage your Supabase projects with Supabase Management API
- 🧑‍💻 Manage users with Supabase Auth Admin methods via Python SDK
- 🔨 Pre-built tools to help Cursor & Windsurf work with MCP more effectively
- 📦 Dead-simple install & setup via package manager (uv, pipx, etc.)

Since v0.3+ server provides comprehensive database management capabilities with built-in safety controls:

- SQL Query Execution: Execute PostgreSQL queries with risk assessment
- Three-tier safety system:
- safe: Read-only operations (SELECT) - always allowed
- write: Data modifications (INSERT, UPDATE, DELETE) - require unsafe mode
- destructive: Schema changes (DROP, CREATE) - require unsafe mode + confirmation

- SQL Parsing and Validation:
- Uses PostgreSQL's parser (pglast) for accurate analysis and provides clear feedback on safety requirements

- Automatic Migration Versioning:
- Database-altering operations operations are automatically versioned
- Generates descriptive names based on operation type and target

- Safety Controls:
- Default SAFE mode allows only read-only operations
- All statements run in transaction mode via asyncpg
- 2-step confirmation for high-risk operations

- Available Tools:
- get_schemas: Lists schemas with sizes and table counts
- get_tables: Lists tables, foreign tables, and views with metadata
- get_table_schema: Gets detailed table structure (columns, keys, relationships)
- execute_postgresql: Executes SQL statements against your database
- confirm_destructive_operation: Executes high-risk operations after confirmation
- retrieve_migrations: Gets migrations with filtering and pagination options
- live_dangerously: Toggles between safe and unsafe modes

Since v0.3.0 server provides secure access to the Supabase Management API with built-in safety controls:

- Available Tools:
- send_management_api_request: Sends arbitrary requests to Supabase Management API with auto-injection of project ref
- get_management_api_spec: Gets the enriched API specification with safety information
- Supports multiple query modes: by domain, by specific path/method, or all paths
- Includes risk assessment information for each endpoint
- Provides detailed parameter requirements and response formats
- Helps LLMs understand the full capabilities of the Supabase Management API
- get_management_api_safety_rules: Gets all safety rules with human-readable explanations
- live_dangerously: Toggles between safe and unsafe operation modes

- Safety Controls:
- Uses the same safety manager as database operations for consistent risk management
- Operations categorized by risk level:
- safe: Read-only operations (GET) - always allowed
- unsafe: State-changing operations (POST, PUT, PATCH, DELETE) - require unsafe mode
- blocked: Destructive operations (delete project, etc.) - never allowed
- Default safe mode prevents accidental state changes
- Path-based pattern matching for precise safety rules

Note: Management API tools only work with remote Supabase instances and are not compatible with local Supabase development setups.

I was planning to add support for Python SDK methods to the MCP server. Upon consideration I decided to only add support for Auth admin methods as I often found myself manually creating test users which was prone to errors and time consuming. Now I can just ask Cursor to create a test user and it will be done seamlessly. Check out the full Auth Admin SDK method docs to know what it can do.

Since v0.3.6 server supports direct access to Supabase Auth Admin methods via Python SDK:
- Includes the following tools:
- get_auth_admin_methods_spec to retrieve documentation for all available Auth Admin methods
- call_auth_admin_method to directly invoke Auth Admin methods with proper parameter handling
- Supported methods:
- get_user_by_id: Retrieve a user by their ID
- list_users: List all users with pagination
- create_user: Create a new user
- delete_user: Delete a user by their ID
- invite_user_by_email: Send an invite link to a user's email
- generate_link: Generate an email link for various authentication purposes
- update_user_by_id: Update user attributes by ID
- delete_factor: Delete a factor on a user (currently not implemented in SDK)