Supabase

Developer Tools

Supabase's official MCP server for database management, Edge Functions, branching, and project administration.

Provides full Supabase platform access including SQL execution, migration management, database branching (create/merge/rebase/reset), Edge Function deployment, project lifecycle (create/pause/restore), TypeScript type generation, log retrieval, security advisory checks, and documentation search.

Supabase dashboard OAuth integration guide MCP server docs

Install

INSTALL

Add Supabase to your zone and connect it to your MCP client.

Step 1 - Start the install in Keycard Console

In your zone’s Keycard Console, go to Applications -> Add Application -> Explore MCP Servers.
Search for Supabase and click Install.
The install dialog shows a Redirect URI. Copy it - you’ll paste it into Supabase in Step 2. Leave this Keycard tab open.

Step 2 - Create the OAuth app for Supabase

Supabase’s MCP server uses an organization-level OAuth App registered under your Supabase organization’s settings. This is different from project anon / service_role keys (which authenticate your app’s users against a single project) and different from the Auth -> Providers screen (which is for adding social login to a project). You need a Management API OAuth App to act on the whole organization on behalf of a Supabase user.

Create an OAuth App in your organization

Sign in to supabase.com/dashboard and switch to the organization you want the MCP server to act on.
Go to Organization Settings -> OAuth Apps, or open https://supabase.com/dashboard/org/<org-slug>/apps directly.
Click Add application.
Fill in:
- Application name: something memorable like Keycard - <zone-name>
- Website: any URL you control (e.g. your zone’s Keycard Console URL)
- Redirect URIs: the redirect URI shown in the Keycard install dialog, pasted verbatim
Click Confirm.

Configure permissions

When you create the OAuth app, Supabase shows a scope picker. The official Supabase MCP setup currently requires the OAuth app to grant write access on every scope (Projects, Database, Edge Functions, Branches, Storage, Secrets, Auth, Analytics, Domains, Organizations, Environment). Granting a narrower set causes some MCP tools (apply_migration, deploy_edge_function, create_branch, etc.) to fail at call time.

Get the Client ID and Client Secret

After you click Confirm, Supabase shows the Client ID and Client secret on a one-time confirmation screen.

Copy the Client ID.
Copy the Client secret immediately.

Step 3 - Finish the install in Keycard Console

Switch back to the Keycard install dialog you left open in Step 1.
Paste the Client ID and Client Secret from Step 2.
Click Install. Supabase appears on the Applications page with a Keycard MCP Gateway URL.

Step 4 - Connect your MCP client

On the Applications page, click Add to Coding Agent next to Supabase and pick how you want to install:

Cursor - opens a deeplink that hands the MCP config straight to Cursor. Click Install inside Cursor to finish.
Claude Code - opens a dialog with a claude mcp add command. Pick a scope (User, Project, or Local), then copy and run the command in your terminal.
Install manually - reveals the Server Name and Server URL to paste into any other MCP-compatible client.

Once connected, Supabase’s tools are available to the agent, scoped to whoever signs in to your zone.

Tools

TOOLS

What Supabase can do once installed.

Supabase provides 29 tools:

apply_migration: Apply a migration to the database (DDL operations)
confirm_cost: Ask the user to confirm cost understanding before creating a project or branch
create_branch: Create a development branch on a Supabase project
create_project: Create a new Supabase project
delete_branch: Delete a development branch
deploy_edge_function: Deploy an Edge Function to a Supabase project
execute_sql: Execute raw SQL in the Postgres database
generate_typescript_types: Generate TypeScript types for a project
get_advisors: Get advisory notices for security vulnerabilities or performance improvements
get_cost: Get the cost of creating a new project or branch
get_edge_function: Retrieve file contents for an Edge Function
get_logs: Get logs for a Supabase project by service type (last 24h)
get_organization: Get details for an organization including subscription plan
get_project: Get details for a Supabase project
get_project_url: Get the API URL for a project
get_publishable_keys: Get all publishable API keys for a project
list_branches: List all development branches of a project
list_edge_functions: List all Edge Functions in a project
list_extensions: List all extensions in the database
list_migrations: List all migrations in the database
list_organizations: List all organizations the user is a member of
list_projects: List all Supabase projects for the user
list_tables: List all tables in one or more schemas
merge_branch: Merge migrations and edge functions from a branch to production
pause_project: Pause a Supabase project
rebase_branch: Rebase a development branch on production
reset_branch: Reset migrations of a development branch
restore_project: Restore a Supabase project
search_docs: Search Supabase documentation using GraphQL

Next steps

NEXT STEPS

What to do once Supabase is installed.

Now do this

Confirm the gateway works by asking your AI client to call one of the Supabase tools above.

Recommended

Decide who can use it - write access policies scoped to the Supabase resource so only the right users and agents reach the tools.
Watch the calls - every tool call lands in your audit log with user identity, resource, and policy decision.