Supabase
Supabase MCP is the official Model Context Protocol server from Supabase that connects AI assistants like Cursor, Claude and Windsurf to your…
Project links
How to use it
- Open the listing page and read the server's documentation.
- Copy the configuration or command into your MCP client.
- Restart the client and try one of the server's tools.
Copy setup details
Use these instructions in your own environment. Copying text here does not run it.
MCP configuration 1
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"supabase": {
"command": "npx",
"args": [
"-y",
"@supabase/mcp-server-supabase@latest",
"--access-token",
"YOUR_SUPABASE_ACCESS_TOKEN"
]
}
}
}MCP configuration 2
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"supabase": {
"url": "https://mcp.supabase.com/mcp"
}
}
}MCP configuration 3
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"supabase": {
"type": "http",
"url": "https://mcp.supabase.com/mcp"
}
}
}Security checks
Automated checks, last run Nov 2, 2026. They can miss problems and do not guarantee a listing is safe. Read the source and what you are asked to run before you use it.
- PassedSetup commands and descriptionLayer 1
No blocking patterns. Notes are listed in the evidence.
Evidence (1)
- note: unpinned-package
- supabase: npx runs "@supabase/mcp-server-supabase@latest" without a pinned version, so whoever owns that package name can change what runs
Source: AIWantsThis screening rules
- PassedInstall scripts and package statusLayer 2
The npm package runs no code at install time and is not deprecated.
Source: npm registry
- PassedKnown vulnerabilities in the packageLayer 2
OSV.dev lists no advisories for this package.
Evidence (1)
- @supabase/[email protected]
- No advisories listed in OSV.dev.
Source: OSV.dev
- PassedSource repositoryLayer 2
The repository is public, not archived and has recent activity.
Evidence (3)
- Last push
- 2026-10-31
- Archived
- no
- License
- Apache-2.0
Source: GitHub