Evaluation record · mcp-server-supabase

MCP Supabase Server

v0.x (supabase/mcp monorepo, pre-1.0)

Supabase

MCPdatabasepostgresqlbackendmcp

Strong

About This MCP

Official Supabase MCP server: SQL execution, schema/migrations, type generation, Edge Function deploys, logs, storage, branching. Primarily a hosted remote at https://mcp.supabase.com/mcp with OAuth 2.1 dynamic client registration (PAT only for CI/CD), plus stdio and self-hosted modes. After 2025 prompt-injection/data-leak research, Supabase added mitigations: read-only mode, project_ref scoping, feature-group tool restrictions, and wrapping SQL results to deter embedded commands.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

api reliability

API stability and uptime analysis

Evidence

Supabase Status — 99.9% uptime SLA on Pro plan with PostgreSQL reliability

highVerified: 2026-07-09

query execution

Query execution testing

Evidence

Supabase PostgreSQL — Full PostgreSQL query support with optimized connection pooling

highVerified: 2026-07-09

schema management

Schema management testing

Evidence

Supabase Migrations — Schema design and migration support through CLI integration

highVerified: 2026-07-09

type generation

Type generation testing

Evidence

Supabase TypeScript — Automatic TypeScript type generation from database schema

highVerified: 2026-07-09

realtime support

Real-time functionality testing

Evidence

Supabase Realtime — Real-time subscriptions through PostgreSQL logical replication

mediumVerified: 2026-07-09

🛡️Security

authentication security

Authentication mechanism review

Evidence

Supabase MCP Documentation — Hosted server authenticates via OAuth 2.1 with dynamic client registration (browser consent flow) by default; personal access tokens are reserved for CI/CD and non-interactive use — the earlier service-role-key setup is no longer the documented path

highVerified: 2026-07-09

row level security

RLS implementation review

Evidence

Supabase RLS — PostgreSQL RLS policies for fine-grained access control

highVerified: 2026-07-09

sql injection protection

Prompt-injection and SQL execution risk assessment; lowered from 78 because the attack class was demonstrated in practice — mitigations reduce but do not eliminate the risk when the agent reads untrusted data with write or broad read access

Evidence

Supabase MCP Security Documentation — 2025 security research demonstrated prompt-injection attacks where instructions embedded in database rows caused agents with full SQL access to leak private data. Supabase responded with layered mitigations: SQL results wrapped with instructions discouraging the LLM from obeying embedded commands, read-only mode via a dedicated supabase_read_only_user, project scoping, and feature-group restrictions; manual tool-call approval is strongly recommended

highVerified: 2026-07-09

data encryption

Encryption review

Evidence

Supabase Security — Encryption at rest and in transit, SSL/TLS connections

highVerified: 2026-07-09

key management

Key management review; raised from 75 as the default auth path no longer places a full-access service role key in client configuration

Evidence

Supabase MCP Documentation — OAuth-based hosted mode avoids long-lived keys in client config; PATs (revocable, org-scoped) are only needed for CI/CD; feature groups and project_ref scoping constrain what an authenticated session can touch

mediumVerified: 2026-07-09

🔒Privacy & Compliance

data residency

Data residency review

Evidence

Supabase Regions — Multiple regions available; self-hosted option for full control

highVerified: 2026-07-09

gdpr compliance

GDPR compliance review

Evidence

Supabase GDPR — GDPR compliant with data processing agreements available

highVerified: 2026-07-09

data exposure to llm

Data flow analysis

Evidence

MCP Data Flow — Query results and schema information sent to LLM provider

highVerified: 2026-07-09

self hosted option

Self-hosting options review

Evidence

Supabase Self-Hosting — Full self-hosting support with Docker for complete data control

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

Supabase Docs — Excellent documentation with tutorials, guides, and API reference

highVerified: 2026-07-09

open source transparency

Source code review; minor adjustment from 95 — previous evidence cited the platform repo rather than the MCP server, which remains pre-1.0

Evidence

supabase/mcp Repository — MCP server itself is fully open source under Apache 2.0 in the supabase/mcp monorepo (2.8k+ stars, 38 releases); the underlying Supabase platform is also open source

highVerified: 2026-07-09

query logging

Logging capabilities assessment

Evidence

Supabase Logging — Query logging and monitoring available in dashboard

highVerified: 2026-07-09

community activity

Community engagement analysis

Evidence

Supabase Community — Very active community with frequent releases and updates

highVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment; small raise from 90 as the hosted OAuth flow removed manual key handling

Evidence

Supabase MCP Setup — Hosted mode: add https://mcp.supabase.com/mcp?project_ref=<project-ref> (optionally &read_only=true) and complete the browser OAuth flow — no token creation needed; local CLI mode available at http://localhost:54321/mcp

highVerified: 2026-07-09

developer experience

Developer experience assessment

Evidence

Supabase DX — Excellent developer experience with CLI, dashboard, and SDKs

highVerified: 2026-07-09

scalability

Scalability testing

Evidence

Supabase Scaling — Scales with PostgreSQL; connection pooling for high concurrency

highVerified: 2026-07-09

cost efficiency

Cost analysis

Evidence

Supabase Pricing — Generous free tier; predictable pricing on paid plans

highVerified: 2026-07-09

integration ecosystem

Integration ecosystem review

Evidence

Supabase Integrations — Rich ecosystem with framework integrations and extensions

highVerified: 2026-07-09

Strengths

+Full PostgreSQL power with AI-assisted query building, migrations, and type generation
+Hosted remote server with OAuth 2.1 dynamic client registration — no manual key handling
+Layered security controls: read-only mode, project scoping, and feature-group tool restrictions
+Prompt-injection mitigations wrap SQL results to discourage the LLM from obeying embedded commands
+Development-branch workflow lets agents work against non-production data
+Fully open source (Apache 2.0) with outstanding documentation and active community

Limitations

!Demonstrated 2025 prompt-injection/data-leak attack class: instructions hidden in database rows can subvert agents given broad SQL access
!Query results and schema exposed to LLM provider
!AI can execute potentially destructive SQL unless read-only mode is enabled
!Supabase recommends avoiding production data: use development branches, project scoping, and manual tool-call approval
!Pre-1.0 server: breaking changes possible between versions
!OAuth hosted mode has limited functionality for CLI/self-hosted environments

Metadata

license: Apache 2.0

supported platforms

0: Any MCP client (hosted remote); all platforms with Node.js (local)

programming languages

0: TypeScript

mcp version: 1.0

github repo: https://github.com/supabase/mcp

github stars: 2800

remote endpoint: https://mcp.supabase.com/mcp (supports project_ref, read_only, and feature-group query parameters)

api dependency: Supabase Management API / PostgreSQL

authentication: OAuth 2.1 with dynamic client registration (default); Personal Access Token for CI/CD

security controls

0: read-only mode

1: project scoping

2: feature groups

3: SQL result wrapping against prompt injection

first release: 2025-01

maintained by: Supabase

transport types

0: streamable-http (hosted)

1: stdio (local)

installation methods

0: Remote MCP endpoint

1: npx @supabase/mcp-server-supabase (local)

2: Supabase CLI local endpoint

Use Case Ratings

code generation

Excellent for full-stack development with auto-generated types

customer support

Good for building support ticket systems and user management

content creation

Great for CMS backends and content management

data analysis

Full SQL power for complex data analysis queries

research assistant

Good for building research databases and knowledge bases

legal compliance

RLS and audit logging support compliance requirements

healthcare

Self-hosted option needed; requires careful RLS configuration

financial analysis

Strong for financial data storage with proper access controls

education

Excellent for learning SQL and building educational apps

creative writing

Good for storing and organizing creative content