Supabase MCP Server — Postgres + Admin Tools (API Key Gate)

Practical Notes

• Quant: the README notes an API-key requirement (from thequery.dev), which acts as a gate against accidental public exposure.
• Quant: Claude Desktop requires an absolute binary path—treat that as a deployment checklist item to avoid spawn errors.

Rollout pattern

• Start with database read-only tasks (schema + queries) before enabling management or auth-admin capabilities.
• Separate environments: local dev uses local ref; production uses project ref with least-privilege keys.
• Record which tools are used in the first 10 sessions and tighten configuration based on observed needs.

Watchouts

Any server that can touch auth/admin APIs is high-impact. Keep keys scoped, avoid running on shared machines, and add audit logging before you allow write operations.

FAQ

Q: Do I have to use pipx? A: No. The README shows uv and source installs too, but pipx is the recommended isolated install path.

Q: Why does Claude Desktop need the full path? A: Claude Desktop spawns processes from a config file and often can’t resolve PATH the same way as your shell.

Q: What should I enable first? A: Start with schema exploration and simple SELECT queries; add management API access only if you truly need it.