# Supabase — MCP server on mcp.ai
> Supabase is an open-source backend-as-a-service providing a Postgres database, authentication, storage, and real-time subscription APIs for building modern applications

By: mcp.ai · official
Page: https://mcp.ai/supabase

## Connect (MCP protocol)
Remote MCP endpoint (HTTP, streamable): https://api.mcp.ai/p_supabase?ms=1781542320000
Add it as a custom/remote MCP connector, then authenticate when prompted.

## REST API (no MCP client required)
Every tool is also a REST endpoint, authed with a workspace API key.
Discover: GET https://api.mcp.ai/api/supabase/_endpoints   # public; lists every endpoint
Call:     POST https://api.mcp.ai/api/supabase/<endpoint>
  Authorization: Bearer sk_live_…   # create one at https://mcp.ai/settings/api-keys
  Content-Type: application/json
  Body: { …args }   →   { "ok": true, "tool": "<id>", "result": { … } }

## Developer docs
How to use (MCP or REST), markdown: https://mcp.ai/supabase/skill.md
Postman collection (v2.1): https://mcp.ai/supabase/postman.json

## Tools
- supabase_alpha_creates_a_new_api_key_for_the_project(ref: string, type: string, description?: string) — Creates a 'publishable' or 'secret' api key for an existing supabase project, optionally with a description; 'secret' keys can have customized jwt templates.
- supabase_alpha_deletes_an_api_key_for_the_project(id: string, ref: string) — Permanently deletes a specific api key (identified by `id`) from a supabase project (identified by `ref`), revoking its access.
- supabase_alpha_get_a_third_party_integration(ref: string, tpa_id: string) — Retrieves the detailed configuration for a specific third-party authentication (tpa) provider, identified by `tpa id`, within an existing supabase project specified by `ref`.
- supabase_alpha_lists_all_third_party_auth_integrations(ref: string) — Lists all configured third-party authentication provider integrations for an existing supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.
- supabase_alpha_removes_a_third_party_auth_integration(ref: string, tpa_id: string) — Removes a third-party authentication provider (e.g., google, github) from a supabase project's configuration; this immediately prevents users from logging in via that method.
- supabase_alpha_updates_an_api_key_for_the_project(id: string, ref: string, description?: string) — Updates an existing supabase project api key's `description` and/or `secret jwt template` (which defines its `role`); does not regenerate the key string.
- supabase_beta_activates_a_custom_hostname_for_a_project(ref: string) — Activates a previously configured custom hostname for a supabase project, assuming dns settings are verified externally.
- supabase_beta_activates_a_vanity_subdomain_for_a_project(ref: string, vanity_subdomain: string) — Activates a vanity subdomain for the specified supabase project, requiring subsequent dns configuration for the subdomain to become operational.
- supabase_beta_authorize_user_through_oauth(scope?: string, state?: string, client_id: string, redirect_uri: string, response_mode?: string, response_type: string, code_challenge?: string, code_challenge_method?: string) — Generates a supabase oauth 2.0 authorization url for user redirection, requiring a pre-registered `client id` and a `redirect uri` that matches one of its pre-registered uris.
- supabase_beta_checks_vanity_subdomain_availability(ref: string, vanity_subdomain: string) — Checks if a specific vanity subdomain is available for a supabase project; this action does not reserve or assign the subdomain.
- supabase_beta_enables_database_webhooks_on_the_project(ref: string) — Enables database webhooks for the supabase project `ref`, triggering real-time notifications for insert, update, or delete events.
- supabase_beta_get_project_s_ssl_enforcement_configuration(ref: string) — Retrieves the ssl enforcement configuration for a specified supabase project, indicating if ssl connections are mandated for its database.
- supabase_beta_gets_current_vanity_subdomain_config(ref: string) — Fetches the current vanity subdomain configuration, including its status and custom domain name, for a supabase project identified by its reference id.
- supabase_beta_gets_project_s_custom_hostname_config(ref: string) — Retrieves a supabase project's custom hostname configuration, including its status, ssl certificate, and ownership verification, noting that availability may depend on the project's plan.
- supabase_beta_gets_project_s_network_bans(ref: string) — Retrieves the list of banned ipv4 addresses for a supabase project using its unique project reference string; this is a read-only operation.
- supabase_beta_gets_project_s_network_restrictions(ref: string) — Retrieves the current network restriction settings (e.g., ip whitelists) for a supabase project using its reference id; this is a read-only operation for auditing or verifying network security.
- supabase_beta_gets_project_s_pgsodium_config(ref: string) — Retrieves the pgsodium configuration, including the root encryption key, for an existing supabase project identified by its `ref`.
- supabase_beta_remove_a_read_replica(ref: string, database_identifier: string) — Irreversibly initiates the removal of a specified read replica from an existing supabase project, confirming only the start of the process, not its completion.
- supabase_beta_remove_network_bans(ref: string, ipv4_addresses: string[]) — Removes specified ipv4 addresses from a supabase project's network ban list, granting immediate access; ips not currently banned are ignored.
- supabase_beta_run_sql_query(ref: string, query: string) — Executes a given sql query against the project's database; use for advanced data operations or when standard api endpoints are insufficient, ensuring queries are valid postgresql and sanitized. use th
- supabase_beta_set_up_a_read_replica(ref: string, read_replica_region: string) — Provisions a read-only replica for a supabase project in a specified, supabase-supported aws region to enhance read performance and reduce latency.
- supabase_beta_updates_project_s_network_restrictions(ref: string, dbAllowedCidrs?: string[], dbAllowedCidrsV6?: string[]) — Updates and applies network access restrictions (ipv4/ipv6 cidr lists) for a supabase project, which may terminate existing connections not matching the new rules.
- supabase_beta_upgrades_the_project_s_postgres_version(ref: string, target_version: string, release_channel: string) — Initiates an asynchronous upgrade of a supabase project's postgresql database to a specified `target version` from a selected `release channel`, returning a `tracking id` to monitor status; the `targe
- supabase_config_pgsodium_update_with_root_key_warning(ref: string, root_key: string) — Critically updates or initializes a supabase project's pgsodium root encryption key for security setup or key rotation, requiring secure backup of the new key to prevent irreversible data loss.
- supabase_create_a_database_branch(ref: string, region?: string, git_branch?: string, persistent?: boolean, branch_name: string, postgres_engine?: string, release_channel?: string, desired_instance_size?: string) — Creates a new, isolated database branch from an existing supabase project (identified by `ref`), useful for setting up separate environments like development or testing, which can optionally be linked
- supabase_create_a_function(ref: string, body: string, name: string, slug: string, import_map?: boolean, verify_jwt?: boolean, entrypoint_path?: string, import_map_path?: string) — Creates a new serverless edge function for a supabase project (identified by `ref`), requiring valid javascript/typescript in `body` and a project-unique `slug 1` identifier.
- supabase_create_a_project(name: string, plan?: string, region: string, db_pass: string, kps_enabled?: boolean, template_url?: string, organization_id: string, postgres_engine?: string, release_channel?: string, desired_instance_size?: string) — Creates a new supabase project, requiring a unique name (no dots) within the organization; project creation is asynchronous.
- supabase_create_an_organization(name: string) — Creates a new supabase organization, which serves as a top-level container for projects, billing, and team access.
- supabase_creates_a_new_sso_provider(ref: string, type: string, domains?: string[], metadata_url?: string, metadata_xml?: string, attribute__mapping__keys?: object) — Creates a new saml 2.0 single sign-on (sso) provider for a supabase project, requiring either `metadata xml` or `metadata url` for saml idp configuration.
- supabase_creates_a_new_third_party_auth_integration(ref: string, jwks_url?: string, oidc_issuer_url?: string) — Call this to add a new third-party authentication method (oidc or jwks) to a supabase project for integrating external identity providers (e.g., for sso); the api may also support `custom jwks` if sen
- supabase_custom_hostname_dns_verification(ref: string) — Re-verifies dns and ssl configurations for an existing custom hostname associated with a supabase project.
- supabase_delete_a_database_branch(branch_id: string) — Permanently and irreversibly deletes a specific, non-default database branch by its `branch id`, without affecting other branches.
- supabase_delete_a_function(ref: string, function_slug: string) — Permanently deletes a specific edge function (by `function slug`) from a supabase project (by `ref`); this action is irreversible and requires prior existence of both project and function.
- supabase_delete_custom_hostname_config(ref: string) — Deletes an active custom hostname configuration for the project identified by `ref`, reverting to the default supabase-provided hostname; this action immediately makes the project inaccessible via the
- supabase_delete_project_vanity_subdomain(ref: string) — Permanently and irreversibly deletes an active vanity subdomain configuration for the specified supabase project, reverting it to its default supabase url.
- supabase_deletes_the_given_project(ref: string) — Permanently and irreversibly deletes a supabase project, identified by its unique `ref` id, resulting in complete data loss.
- supabase_deploy_function(ref: string, file: string, slug?: string, bundleOnly?: boolean) — Deploys edge functions to a supabase project using multipart upload.
- supabase_disable_project_readonly(ref: string) — Temporarily disables a supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only.
- supabase_disables_preview_branching(ref: string) — Disables the preview branching feature for an existing supabase project, identified by its unique reference id (`ref`).
- supabase_exchange_o_auth_token(code?: string, client_id: string, grant_type: string, redirect_uri?: string, client_secret: string, code_verifier?: string, refresh_token?: string) — (beta) implements the oauth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on `grant type`.
- supabase_generate_type_script_types(ref: string, included_schemas?: string) — Generates and retrieves typescript types from a supabase project's database; any schemas specified in `included schemas` must exist in the project.
- supabase_get_database_branch_config(branch_id: string) — Retrieves the read-only configuration and status for a supabase database branch, typically for monitoring or verifying its settings.
- supabase_get_project_api_keys(ref: string) — Retrieves all api keys for an existing supabase project, specified by its unique reference id (`ref`); this is a read-only operation.
- supabase_get_project_s_pgbouncer_config(ref: string) — Retrieves the active pgbouncer configuration (postgresql connection pooler) for a supabase project, used for performance tuning, auditing, or getting the connection string.
- supabase_get_project_upgrade_eligibility(ref: string) — Checks a supabase project's eligibility for an upgrade, verifying compatibility and identifying potential issues; this action does not perform the actual upgrade.
- supabase_get_project_upgrade_status(ref: string) — Retrieves the latest status of a supabase project's database upgrade for monitoring purposes; does not initiate or modify upgrades.
- supabase_get_table_schemas(ref: string, table_names: string[], include_indexes?: boolean, exclude_null_values?: boolean, include_relationships?: boolean) — Retrieves column details, types, and constraints for multiple database tables to help debug schema issues and write accurate sql queries.
- supabase_gets_a_specific_sql_snippet(id: string) — Retrieves a specific sql snippet by its unique identifier.
- supabase_gets_a_sso_provider_by_its_uuid(ref: string, provider_id: string) — Retrieves the configuration details for a specific single sign-on (sso) provider (e.g., saml, google, github, azure ad), identified by its uuid, within a supabase project.
- supabase_gets_information_about_the_organization(slug: string) — Fetches comprehensive details for a specific supabase organization using its unique slug.
- supabase_gets_project_s_auth_config(ref: string) — Retrieves the project's complete read-only authentication configuration, detailing all settings (e.g., providers, mfa, email/sms, jwt, security policies) but excluding sensitive secrets.
- supabase_gets_project_s_postgres_config(ref: string) — Retrieves the current read-only postgresql database configuration for a specified supabase project's `ref`, noting that some advanced or security-sensitive details might be omitted from the response.
- supabase_gets_project_s_postgrest_config(ref: string) — Retrieves the postgrest configuration for a specific supabase project.
- supabase_gets_project_s_service_health_status(ref: string, services: string[], timeout_ms?: integer) — Retrieves the current health status for a supabase project, for specified services or all services if the 'services' list is omitted.
- supabase_gets_project_s_supavisor_config(ref: string) — Retrieves the supavisor (connection pooler) configuration for a specified supabase project, identified by its reference id.
- supabase_list_all_database_branches(ref: string) — Lists all database branches for a specified supabase project, used for isolated development and testing of schema changes; ensure the project reference id is valid.
- supabase_list_all_functions(ref: string) — Lists metadata for all edge functions in a supabase project (specified by 'ref'), excluding function code or logs; the project must exist.
- supabase_list_all_organizations() — Lists all organizations (id and name only) associated with the supabase account, excluding project details within these organizations.
- supabase_list_all_projects() — Retrieves a list of all supabase projects, including their id, name, region, and status, for the authenticated user.
- supabase_list_all_secrets(ref: string) — Retrieves all secrets for a supabase project using its reference id; secret values in the response may be masked.
- supabase_list_members_of_an_organization(slug: string) — Retrieves all members of a supabase organization, identified by its unique slug, including their user id, username, email, role, and mfa status.
- supabase_lists_all_backups(ref: string) — Lists all database backups for a supabase project, providing details on existing backups but not creating new ones or performing restores; availability may depend on plan and configuration.
- supabase_lists_all_buckets(ref: string) — Retrieves a list of all storage buckets for a supabase project, without returning bucket contents or access policies.
- supabase_lists_all_sso_providers(ref: string) — Lists all configured single sign-on (sso) providers for a supabase project, requiring the project reference id (`ref`) of an existing project.
- supabase_lists_sql_snippets_for_the_logged_in_user(project_ref?: string) — Retrieves a list of sql snippets for the logged-in user, optionally filtered by a specific supabase project if `project ref` is provided.
- supabase_removes_a_sso_provider_by_its_uuid(ref: string, provider_id: string) — Deletes a specific sso provider by its id (`provider id`) from a supabase project (`ref`), which disables it and returns its details; ensure this action will not inadvertently lock out users.
- supabase_resets_a_database_branch(branch_id: string) — Resets an existing supabase database branch, identified by `branch id`, to its initial clean state, irreversibly deleting all its current data and schema changes.
- supabase_restores_a_pitr_backup_for_a_database(ref: string, recovery_time_target_unix: integer) — Restores a supabase project's database to a specific unix timestamp using point-in-time recovery (pitr), overwriting the current state; requires a paid plan with pitr and physical backups enabled.
- supabase_retrieve_a_function(ref: string, function_slug: string) — Retrieves detailed information, metadata, configuration, and status for a specific edge function using its project reference id and function slug.
- supabase_retrieve_a_function_body(ref: string, function_slug: string) — Retrieves the source code (body) for a specified serverless edge function using its project reference and function slug; this is a read-only operation that does not execute the function or return runt
- supabase_returns_project_s_readonly_mode_status(ref: string) — Retrieves the read-only mode status for a specified supabase project to check its operational state; this action does not change the read-only state.
- supabase_update_a_function(ref: string, body?: string, name?: string, slug?: string, import_map?: boolean, verify_jwt?: boolean, function_slug: string, entrypoint_path?: string, import_map_path?: string) — Updates an existing supabase edge function's properties (like name, slug, source code, jwt settings, import map) identified by project `ref` and `function slug`, supporting plain text code or eszip fo
- supabase_update_database_branch_config(status?: string, branch_id: string, git_branch?: string, persistent?: boolean, branch_name?: string, reset_on_push?: boolean) — Updates the configuration of a supabase database branch, allowing modification of its name, associated git branch, reset-on-push behavior, persistence, and status.
- supabase_update_project_custom_hostname_action(ref: string, custom_hostname: string) — Updates the custom hostname for a supabase project, requiring subsequent dns changes to a user-controlled domain for ssl certificate issuance and domain ownership.
- supabase_update_ssl_enforcement_config(ref: string, requestedConfig__database?: boolean) — Updates the ssl enforcement configuration (enable/disable) for a specified supabase project's database.
- supabase_updates_a_sso_provider_by_its_uuid(ref: string, domains?: string[], provider_id: string, metadata_url?: string, metadata_xml?: string, attribute__mapping__keys?: object) — Updates an existing sso provider's saml metadata, associated email domains, or attribute mappings for a supabase project, identified by `ref` and `provider id`.
- supabase_updates_project_s_postgres_config(ref: string, work_mem?: string, max_wal_size?: string, wal_keep_size?: string, shared_buffers?: string, max_connections?: integer, statement_timeout?: string, effective_cache_size?: string, maintenance_work_mem?: string, max_parallel_workers?: integer, max_worker_processes?: integer, max_slot_wal_keep_size?: string, session_replication_role?: string, max_locks_per_transaction?: integer, max_standby_archive_delay?: string, max_standby_streaming_delay?: string, max_parallel_workers_per_gather?: integer, max_parallel_maintenance_workers?: integer) — Updates specified postgresql configuration parameters for an existing supabase project (`ref`) to optimize database performance; note that unspecified parameters remain unchanged, and caution is advis
- supabase_updates_project_s_postgrest_config(ref: string, db_pool?: integer, max_rows?: integer, db_schema?: string, db_extra_search_path?: string) — Updates postgrest configuration settings (e.g., `max rows`, `db pool`, `db schema`, `db extra search path`) for a supabase project to fine-tune api performance, data exposure, and database resource us
- supabase_updates_project_s_supavisor_config(ref: string, pool_mode?: string, default_pool_size?: integer) — Updates the supavisor (database pooler) configuration, such as `default pool size`, for an existing supabase project identified by `ref`; the `pool mode` parameter in the request is deprecated and ign

## Links
Docs: https://mcp.ai/docs/mcps/supabase
Website: https://mcp.ai/mcps/supabase