How to connect the Supabase MCP server

Before you start

• A Supabase account. During sign-in you choose the organization that contains your project. supabase.com/docs
• The server acts with your developer permissions in the chosen organization. Entering Edge Function secrets also needs permission to read and write secrets for the project. supabase.com/docs
• Branching is experimental and requires a paid plan. Creating projects and branches asks you to confirm the cost. supabase.com/docs
• Supabase warns about prompt injection and says not to give the server to customers or end users. Keep manual approval of tool calls on, and consider project scoping, read-only mode and restricted feature groups. supabase.com/docs

Authentication

Your client → Supabase MCP

OAuth sign-in, handled by your MCP client. supabase.com/docsmodelcontextprotocol.io/specification

Supabase MCP → Supabase API

The server acts on your account with the access you approve. supabase.com/docs

Steps

1. Open Supabase's MCP setup instructions for your client

   supabase.com/docs/guides/getting-started/mcp
2. Add the Supabase MCP server to your client

   Add https://mcp.supabase.com/mcp as a remote MCP server that uses the Streamable HTTP transport (often labelled "http"). Optional query parameters: project_ref limits the server to one project and disables account management tools; read_only=true runs queries as a read-only Postgres user; features limits the enabled tool groups. Parameters can be combined.

   supabase.com/docsregistry.modelcontextprotocol.io/v0.1
3. Sign in to Supabase, choose your organization and approve access
   supabase.com/docs
4. For CI or headless use, use a personal access token

   Create a Supabase personal access token, scope it to the project and grant only the permissions the enabled tools need. Send it as a bearer token in the Authorization header. Keep it in an environment variable or secret store, not in shared configuration.

   supabase.com/docs
5. If your client requires a client ID and secret

   Create an OAuth app in your organization's OAuth apps settings and give its client ID and secret to the client. Supabase says to grant write access to all scopes, because finer scopes are not supported yet.

   supabase.com/docs
6. List the server's tools

   Your client should list the server's tools. That confirms the connection, not every API permission.

   supabase.com/docs

What we observed

• 5 Nov 2026: HTTP 401 with WWW-Authenticate resource_metadata https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp, which names the authorization server https://api.supabase.com, the resource name "Supabase MCP (Beta)", and scopes such as organizations:read, projects:read, projects:write, database:read and database:write.