Your AI assistant, now with the keys to your Postgres

What it does It’s an MCP server that exposes your Supabase project to AI assistants as a set of tools: listing tables, running SQL, applying migrations, deploying Edge Functions, pulling logs, even creating and merging development branches. The assistant logs in via OAuth 2.1 and can also search Supabase’s own docs, so it answers with current information instead of 2023-era hallucinations.

The interesting bit The security posture is unusually honest for an AI tool. The README opens with a prompt-injection walkthrough — a malicious support ticket tricking Cursor into dumping a sensitive table — before anything else. Mitigations are real, not vibes: a read_only mode that runs SQL as a read-only Postgres user, project_ref scoping so the server can’t touch your whole org, and SQL results wrapped with instructions telling the model to ignore embedded commands.

Key highlights

• ~30 tools grouped into feature sets (database, debugging, functions, branching, etc.) you can toggle via a features URL parameter
• apply_migration tracks DDL inside the database, so schema changes made by the LLM stay in your migration history
• generate_typescript_types produces schema-derived types the assistant can drop straight into your code
• Works hosted, via the local Supabase CLI, or self-hosted — though the latter two get a reduced toolset and no OAuth 2.1
• Storage tools are disabled by default purely to keep the tool count down for the LLM

Caveats

• Pre-1.0; expect breaking changes between versions
• Branching tools are experimental and require a paid plan
• The anti-injection wrapping is explicitly “not foolproof” — the README’s own advice is don’t connect it to production

Verdict If you build on Supabase and live in Cursor or Claude, this is the most useful MCP server you’re not using yet. If your database holds data you’d rather not explain to a regulator, keep it pointed at a dev project.