What Is Supabase MCP? Setup, Read-Only Mode, Security Risks and Pricing

MCP is the standard for AI programs to connect to outside tools. With Supabase MCP your assistant accesses your Supabase project directly: you ask "what tables are in the database", which is the test prompt the documentation suggests. The assistant can apply schema changes as migrations, query project logs, read security and performance advisors, and list and deploy Edge Functions.

The tools are split into groups: database, debugging, development (URL, keys, TypeScript types), Edge Functions, account management, docs search, development branches and storage. The storage group is off by default. The documentation names 33 tools; some are conditional.

Who it is for: people building apps with Supabase who want to speed up database work with an assistant. The documentation explicitly says not to give it to your customers or end users; it is designed as a developer tool.

You connect to the hosted server; there is no package to install on your computer. You narrow access with URL parameters. The commands are taken verbatim from the Supabase documentation.

Do your first test in a separate test project, not in production, and start with read_only=true.

Once connected, you tell the assistant what you want in plain language; it picks the tools itself. The first test the documentation suggests: "What tables are there in the database? Use MCP tools."

Most MCP clients ask you to approve each tool call. For interactive work, keep that approval on and read each call before it runs.

There is an open GitHub issue reporting an error during the apply_migration confirmation in the Codex desktop app (issue #472, October 14, 2026). The list is compiled from the parts of the documentation available as static text.

!The Supabase documentation says connecting an LLM to a data source carries inherent risks and that the main attack is prompt injection: text in user content can trick the assistant into following untrusted commands. On the destructive-SQL confirmation form, the documentation's own words: "not a security guarantee". Some clients support rules that answer confirmations automatically. A search of GitHub Security Advisories shows no published advisories. That does not mean it is "secure".

The documentation's recommendations: protect production projects with sensitive data, turn on read_only, limit the server to a single project, narrow the feature groups, use development branches, and read and approve every tool call.

No separate fee is listed for the MCP server; your Supabase plan applies. However, the documentation has no explicit sentence saying whether MCP works on a Free project. Only for Branching does the documentation say "requires a paid plan", and the pricing page lists Branching as "Not included" on the Free plan. So it would not be accurate to say "it works on the free plan"; the way to find out is to create a project on the Free plan and connect it.

Creating projects and branches requires a cost confirmation; no confirmation is asked for a zero-cost project. Paid plan amounts are unclear in the official source. Prices are in US dollars; no lira price is listed.

Source: Supabase pricing page, MCP documentation and repository docs. Commercial use depends on your Supabase account and plan terms; the code is Apache-2.0 licensed. This is not legal advice.

1. 1In the client: delete the supabase entry from the MCP server list (in Claude Code, remove it from the project's .mcp.json file; the Supabase documentation has no separate command).
2. 2If you used a token: delete the personal access token you created for CI on the Supabase access tokens page. If you set up a manual OAuth app, remove it from your organization's OAuth apps page.
3. 3Regular OAuth authorization: the documentation does not name the screen for revoking it from your account; check the authorized apps in your Supabase account settings.