Supabase MCP — Postgres + Auth Server for AI Agents

What it is

Supabase MCP is a Model Context Protocol server that connects AI agents to Supabase services. It provides access to PostgreSQL databases, authentication, file storage, and edge functions through the MCP tool interface.

Supabase MCP targets AI developers building agents that need to query databases, manage users, or interact with Supabase-hosted applications -- all through natural language commands in their AI client.

How it saves time or tokens

Instead of writing SQL queries manually or building API integrations, developers can ask their AI agent to query data, create users, or manage storage directly. The MCP server handles the Supabase API calls and returns structured results. Token estimate is approximately 2400 tokens per session.

How to use

1. Add Supabase MCP to your .mcp.json:

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": ["-y", "@supabase/mcp-server"],
      "env": {
        "SUPABASE_URL": "https://your-project.supabase.co",
        "SUPABASE_SERVICE_KEY": "eyJ..."
      }
    }
  }
}

1. Get your keys from Supabase Dashboard > Settings > API.

1. Restart your AI client and start querying your database.

Example

-- Example queries the agent can execute via Supabase MCP:
-- 'Show me all users who signed up this week'
SELECT id, email, created_at
FROM auth.users
WHERE created_at >= NOW() - INTERVAL '7 days'
ORDER BY created_at DESC;

-- 'Count active projects by status'
SELECT status, COUNT(*) as total
FROM projects
WHERE deleted_at IS NULL
GROUP BY status;

Related on TokRepo

• MCP Supabase Integration -- Supabase MCP deep dive
• Database Tools -- Database management and query tools

Common pitfalls

• The SUPABASE_SERVICE_KEY has admin-level access. Never expose it in client-side code or public repositories.
• MCP tool calls execute real queries against your database. Use a development project for testing before connecting production.
• Row-level security (RLS) policies are bypassed when using the service key. Ensure your agent queries do not expose sensitive data.