Maintained by Supabase, the Supabase MCP server exposes the full platform surface to LLM agents: SQL queries against your Postgres, Auth user management, Storage bucket operations, and Edge Function invocation. Combines the safety story of Postgres MCP with Supabase opinionated auth and storage. Best fit: teams already on Supabase who want their internal tooling to be agent-driven.
Pricing
Free · Open source (Apache 2.0) · Supabase plan applies
Developer Consensus: Pros
Single MCP server covers database + auth + storage + edge functions28× mentioned
Supabase auth user management from prompts works cleanly17× mentioned
Edge function invocation lets agents trigger your existing serverless code12× mentioned
Common Friction Points
Only useful if you are already on Supabase11× mentioned
Storage operations on large files chew bandwidth8× mentioned
Service-role key in MCP config is a sensitive secret to manage7× mentioned
Documentation lagged the early releases — better now5× mentioned
Verified Peer Reviews
S
@supabase_native
Full-Stack Engineer · TypeScript · Startup
Verified
The whole platform is suddenly agent-callable. Auth + DB + Storage from one prompt.
Supabase MCP is the kind of all-in-one I want for our stack. The agent can provision a user, set their role, write the seed data, all in one conversation. Saves 20 minutes of admin per new customer onboarding.
R
@rls_inherit
Security Engineer · Mixed · Mid
Verified
RLS inheritance is the right default. Agent cannot read what the user cannot read.
Other MCP database servers give the agent service-role access by default. Supabase MCP respects the connecting user RLS. Agent is scoped, blast radius limited. This is the right model.
S
@sb_locked
Engineering Manager · TypeScript · Mid
Verified
Great if you are on Supabase. Useless otherwise.
No criticism, just truth: this MCP is for Supabase customers. If you are on RDS or Neon, use Postgres MCP instead. We are on Supabase, so this is a clean win.
Every review on this page is verified through GitHub OAuth and weighted by reviewer credibility, use-case match, and conflict-of-interest disclosure. Aggregate scores combine with recency decay so rankings reflect current reality.
Read full methodology →