Supabase MCP server for Claude, Codex and Cursor

What your AI apps can do with Supabase

Inspect database structure
Work with project development resources

Supabase MCP tools

31 tools, taken from the publisher's documentation on 29 October 2026. The server decides what it offers and can add or rename tools at any time; after you connect, Toolstile shows the current list.

Tool	What it does
`search_docs`	Searches the Supabase documentation
`list_projects`	Lists projects or reads one project's details
`get_project`	Lists projects or reads one project's details
`list_organizations`	Lists organizations or reads one
`get_organization`	Lists organizations or reads one
`list_tables`	Lists tables in the database
`list_extensions`	Lists Postgres extensions
`list_migrations`	Lists applied migrations
`execute_sql`	Runs raw SQL against the database
`apply_migration`	Applies a schema migration
`query_logs`	Reads project logs
`get_advisors`	Reads security and performance advisor notices
`get_project_url`	Returns the project API URL
`get_publishable_keys`	Returns the project's publishable API keys
`generate_typescript_types`	Generates TypeScript types from the schema
`list_edge_functions`	Lists Edge Functions or reads one
`get_edge_function`	Lists Edge Functions or reads one
`deploy_edge_function`	Deploys an Edge Function
`create_edge_function_secret`	Creates a secret for Edge Functions
`get_cost`	Shows and confirms the cost of a new project or branch
`confirm_cost`	Shows and confirms the cost of a new project or branch
`create_project`	Creates a new project, which may be billed
`pause_project`	Pauses or restores a project
`restore_project`	Pauses or restores a project
`list_branches`	Lists development branches
`create_branch`	Creates a development branch
`merge_branch`	Merges a branch's migrations into production
`reset_branch`	Resets or rebases a branch
`rebase_branch`	Resets or rebases a branch
`delete_branch`	Deletes a branch
`update_storage_config`	Changes storage settings (storage group is off by default)

Suggested starting access

Toolstile read each Supabase tool's description and wrote these starting selections by hand. They are a suggestion reviewed by Toolstile, not a guarantee: Supabase decides what each tool does and can change it, so check that a selection fits each app before you save it.

Inspect projects and schema

Read projects, tables, migrations, advisors and Edge Functions, and search the docs. Reading logs and running raw SQL, which can change data, wait for approval.

Allow: search_docs, list_organizations, get_organization, list_projects, get_project, list_tables, list_extensions, list_migrations, get_advisors, list_edge_functions, get_edge_function, list_branches, generate_typescript_types
Require approval: execute_sql, query_logs

Search Supabase documentation

Search the Supabase documentation only. No access to your projects.

Allow: search_docs

In the access editor, choosing a suggestion adds the listed tools this server offers to your draft. Existing access stays as it is, blocks and approval requirements stay in force, and the suggestion doesn't grant tool names the server adds later. Nothing is saved until you choose Save changes.

Suggested access for each AI app

The documentation this list comes from doesn't mark Supabase's tools as read-only or destructive. Read each tool's description and decide per app before allowing it.

Coding agent in Claude Code or Cursor. Allow the read tools so the agent can look things up without stopping, and require approval for tools that change shared data.

Chat or research app in Claude Desktop. Allow reading and searching. Allow writes only where you want the app to act for you.

Unattended agent, such as a scheduled Codex job. No one is watching the session, so keep it narrow: allow what the job needs, require approval for changes and block the rest.

Blocked tools are removed from the tool list an app sees, so it won't try them. Because rules apply per app, the same Supabase connection can be broad in one app and read-only in another, and the credential stays in Toolstile instead of each app's config file.

How it works with Toolstile

Connect once. Add Supabase to a workspace (browser sign-in). Toolstile keeps the credential, so no agent config holds it.
Choose access per app. Give Claude Code every Supabase tool, give Cursor only the read tools, or keep Supabase away from an app entirely.
Share approved accounts. Teammates use the connection without copying tokens, and you can remove access in one place.
Review activity. See which app called which tool and when, so you can tighten access with evidence.

Add the Supabase MCP server to an AI app

Through Toolstile, every AI app uses one gateway entry, whichever servers you connect. In Claude Code:

Shell

claude mcp add --transport http toolstile 'https://toolstile.com/mcp'

Then connect Supabase in your workspace and choose which of its tools that app may use. Client setup covers Codex, Cursor and Claude Desktop.

To connect directly instead, add the Supabase endpoint to each app separately. In Claude Code:

Shell

claude mcp add --transport http supabase 'https://mcp.supabase.com/mcp'

In Cursor's mcp.json:

JSON

{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com/mcp"
    }
  }
}

Some servers accept only clients they have approved, or need a token header. Check the Supabase MCP documentation for what your client needs.

Before you connect

A Supabase account. Prefer a development project and read-only access when appropriate.

Settings you can choose when you connect:

Project reference. Optional. Restrict this connection to one Supabase project.
Read-only access. Limit the server to read operations.

Server details

Detail	Value
Publisher	Supabase
Endpoint	`https://mcp.supabase.com/mcp`
Authentication	Browser sign-in
Categories	Development, Data & infrastructure
Tool list	31 tools, observed 29 October 2026 (docs)

Supabase MCP documentation