Index live · v1.3.0 · MAY 26 2026

Supabase

Official
bySupabase

Supabase's official MCP server provides complete access to the Supabase platform. Manage Postgres databases, authentication, edge functions, file storage, and database branching. Hosted at mcp.supabase.com with ~42K weekly visitors.

Streamable HTTPTypeScriptAPI Key Required
~42K visitors/wk

Configuration

{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

Add this to your claude_desktop_config.json file.

Quick Stats

Trust LevelOfficial
TransportStreamable HTTP
API KeyRequired
LanguageTypeScript
CategoryDatabases & Data
Visit Website

Author

S

Supabase

Official

Tags

supabasepostgresauthstorageedge-functions

AgenticSkills Audit

Automated framework checks. Deep code review tracked separately. Read the methodology →

1/2
1 of 2 automated checks passed
Audited May 11, 2026
Hosted endpoint
TLS-only (HTTPS) endpoint
Mitigates: Plaintext credential interceptionResponded 404 over HTTPS
Evidence
OAuth 2.1 metadata (RFC 9728)
Mitigates: Token mismanagement, audience confusionNo /.well-known/oauth-protected-resource (status 404)
Repo-level checks
SECURITY.md published
Mitigates: Coordinated disclosure pathHosted server — repo-level check not applicable
Commit in last 90 days
Mitigates: Maintainer abandonmentHosted server — no public commit log
≥2 active contributors
Mitigates: Bus-factor of oneHosted server — no public contributor list
CI pipeline configured
Mitigates: Code health regressionHosted server — no public CI
Dependency lockfile committed
Mitigates: Dependency confusionHosted server — repo-level check not applicable
Signed releases (npm provenance)
Mitigates: Supply-chain backdoorHosted server — supply chain via vendor
Software Bill of Materials (SBOM)
Mitigates: Audit trailHosted server — repo-level check not applicable
License declared
Mitigates: Legal ambiguityHosted server — vendor terms of service apply

Deep framework checks (OAuth 2.1 / PKCE implementation, input validation, sandboxing) require human source review and are tracked separately. This scorecard covers programmatically verifiable signals only.

Used in 3 workflows

Full-Stack SaaS

The complete Next.js + Supabase + Vercel stack — from code to live URL in one session.

6 skills · 4 MCP

Indie Hacker MVP

Ship fast with four components — design, database, payments, and deployment. No overhead.

2 skills · 2 MCP

Database & Backend

Optimized PostgreSQL with live access — the skill teaches best practices, the MCP executes them.

2 skills · 2 MCP