# How to connect the Supabase MCP server

To connect the official Supabase MCP server, add https://mcp.supabase.com/mcp to your MCP client as a Streamable HTTP server, then sign in with OAuth when your client prompts you. For CI or headless use, use a personal access token. Supabase documents setup for Claude Code, Codex, Cursor, VS Code and ChatGPT.

- Endpoint: https://mcp.supabase.com/mcp
- Transport: Streamable HTTP
- Registry: com.supabase/mcp 0.14.0
- Publisher documentation reviewed: 2026-11-05 (not a tested connection)
- Guide page: https://apitracker.io/mcp-guides/supabase-mcp

## Before you start

- A Supabase account. During sign-in you choose the organization that contains your project.
- The server acts with your developer permissions in the chosen organization. Entering Edge Function secrets also needs permission to read and write secrets for the project.
- Branching is experimental and requires a paid plan. Creating projects and branches asks you to confirm the cost.
- Supabase warns about prompt injection and says not to give the server to customers or end users. Keep manual approval of tool calls on, and consider project scoping, read-only mode and restricted feature groups.

## Steps

1. **Open Supabase's MCP setup instructions for your client** <https://supabase.com/docs/guides/getting-started/mcp>
2. **Add the Supabase MCP server to your client** Add https://mcp.supabase.com/mcp as a remote MCP server that uses the Streamable HTTP transport (often labelled "http"). Optional query parameters: project_ref limits the server to one project and disables account management tools; read_only=true runs queries as a read-only Postgres user; features limits the enabled tool groups. Parameters can be combined.
3. **Sign in to Supabase, choose your organization and approve access**
4. **For CI or headless use, use a personal access token** Create a Supabase personal access token, scope it to the project and grant only the permissions the enabled tools need. Send it as a bearer token in the Authorization header. Keep it in an environment variable or secret store, not in shared configuration.
5. **If your client requires a client ID and secret** Create an OAuth app in your organization's OAuth apps settings and give its client ID and secret to the client. Supabase says to grant write access to all scopes, because finer scopes are not supported yet.
6. **List the server's tools**

## Questions

### What is the Supabase MCP server URL?

The official Supabase MCP server is at https://mcp.supabase.com/mcp and uses the Streamable HTTP transport.

### How do I authenticate with the Supabase MCP server?

Sign in with OAuth when your client prompts you. For CI or headless use, use a personal access token: Create a Supabase personal access token, scope it to the project and grant only the permissions the enabled tools need. Send it as a bearer token in the Authorization header. Keep it in an environment variable or secret store, not in shared configuration.

### Which AI clients can use the Supabase MCP server?

Supabase's documentation covers Claude Code, Codex, Cursor, VS Code and ChatGPT. Other clients that support remote Streamable HTTP MCP servers may also work.

### What do I need before connecting Supabase MCP?

A Supabase account. During sign-in you choose the organization that contains your project. The server acts with your developer permissions in the chosen organization. Entering Edge Function secrets also needs permission to read and write secrets for the project. Branching is experimental and requires a paid plan. Creating projects and branches asks you to confirm the cost. Supabase warns about prompt injection and says not to give the server to customers or end users. Keep manual approval of tool calls on, and consider project scoping, read-only mode and restricted feature groups.

### Has this Supabase MCP guide been tested?

Supabase's documentation was reviewed on 2026-11-05. It is not a tested connection; your account and permissions decide which tools work.

## Sources

- https://supabase.com/docs/guides/getting-started/mcp (checked 2026-11-05)
- https://registry.modelcontextprotocol.io/v0.1/servers/com.supabase%2Fmcp/versions/0.14.0 (checked 2026-11-05)
- https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization (checked 2026-11-05)

Guide JSON: https://github.com/apideck-libraries/mcp-connect/blob/626f6a146170ded34891b30dca3af26f09e07466/proposals/connection-guide/0.1/reviewed/guides/supabase-mcp.json