Supabase MCP Server: Database Context for AI Coding Assistants

What Is Supabase MCP?

Supabase MCP is an official Model Context Protocol server from Supabase that bridges your Supabase project to any MCP-compatible AI coding assistant. Rather than pasting schema snippets into prompts or guessing how tables relate, the AI connects directly to your live Supabase project and reasons about your actual database structure.

For teams using Supabase as their backend, this closes a significant context gap. Traditionally, an AI coding assistant working on a feature that involves the database has to work from code representations - your ORM models, your migration files, your type definitions. Supabase MCP gives it live access to what actually exists in production.

What You Get with Supabase MCP

Setup in 5 Minutes

You need two things: your Supabase project reference ID and a personal access token.

Step 1: Find your reference ID in Supabase dashboard under Settings > API.

Step 2: Generate a personal access token at supabase.com/account/tokens.

Step 3: Add to your MCP config file (~/.claude/mcp.json for Claude Code, or Cursor settings):

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": ["@supabase/mcp-server"],
      "env": {
        "SUPABASE_REF": "your-project-ref",
        "SUPABASE_ACCESS_TOKEN": "your-token"
      }
    }
  }
}

Step 4: Restart your editor. Ask "What tables does my database have?" and Claude will return your live schema.

Use Cases That Actually Save Time

Writing database queries: Paste a question like "How many users signed up in the last 30 days who have an active subscription?" and get a precise SQL query that matches your actual schema - not a guess based on hypothetical tables.

Refactoring safely: Before renaming a column, ask Claude "What Edge Functions and RLS policies depend on the user_id column?" It will map the full dependency tree so you refactor safely.

Debugging auth issues: When a user cannot access something they should, ask Claude to inspect the RLS policies on that table and explain why the access might be blocked.

Generating type-safe code: Ask for TypeScript types that match your database schema, generated directly from what exists rather than from stale ORM definitions.

Security Considerations

Supabase MCP uses your personal access token to connect to your project. The token has full access to everything your account can reach. Use a dedicated service account with minimal permissions for the MCP server rather than your main admin account.

For production databases, consider enabling table-level access restrictions and verifying that the MCP server account only has the read permissions needed for its tasks. Row Level Security policies are visible to the MCP server - understand what that means for sensitive tables before connecting.