Query | Supabase MCP Server

Safely run SQL, manage schema, call the Supabase Management API & Auth Admin from your IDE — with built-in safety controls.

Unverified

stdio (local)

API key

Python

View repo 826 Website

Add to your client

Copy the config for your MCP client and paste it into its config file.

Install / run

pipx install supabase-mcp-server

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "query-supabase-mcp-server": {
      "command": "/full/path/to/supabase-mcp-server",
      "args": [],
      "env": {
        "QUERY_API_KEY": "your-api-key",
        "SUPABASE_PROJECT_REF": "your-project-ref",
        "SUPABASE_DB_PASSWORD": "your-db-password",
        "SUPABASE_REGION": "us-east-1",
        "SUPABASE_ACCESS_TOKEN": "your-access-token",
        "SUPABASE_SERVICE_ROLE_KEY": "your-service-role-key"
      }
    }
  }
}

Step-by-step guides: Add to Claude Desktop · Add to Cursor · Add to Windsurf

Before you start

Python 3.12+
uv (if installing via uv) or pipx (recommended)
PostgreSQL 16+ only if running a local Supabase instance
A free QUERY_API_KEY from thequery.dev (required for all operations since v0.4)
Supabase project reference and database password (for remote projects)
SUPABASE_ACCESS_TOKEN for Management API tools (optional, remote only)
SUPABASE_SERVICE_ROLE_KEY for Auth Admin tools (optional)

About Query | Supabase MCP Server

Query MCP (supabase-mcp-server) is a stdio MCP server that enables end-to-end management of Supabase via a chat interface. It exposes tools for read & write SQL query execution with a three-tier safety system, automatic migration versioning, secure access to the Supabase Management API, direct use of Auth Admin SDK methods, and retrieval of logs across the Supabase stack. It works with any MCP client supporting the stdio protocol and is explicitly tested with Cursor, Windsurf, Cline, and Claude Desktop.

Tools & capabilities (13)

get_schemas

Lists database schemas with their sizes and table counts.

get_tables

Lists tables, foreign tables, and views with metadata for a given schema.

get_table_schema

Gets detailed table structure including columns, keys, and relationships.

execute_postgresql

Executes SQL statements against your Supabase database, with risk assessment and safety controls.

confirm_destructive_operation

Executes high-risk (destructive) operations after explicit 2-step confirmation.

retrieve_migrations

Gets database migrations with filtering and pagination options.

live_dangerously

Toggles between safe (read-only) and unsafe operation modes for database and API operations.

send_management_api_request

Sends arbitrary requests to the Supabase Management API with auto-injection of the project ref.

get_management_api_spec

Gets the enriched Management API specification with safety/risk information; supports querying by domain, by specific path/method, or all paths.

get_management_api_safety_rules

Gets all Management API safety rules with human-readable explanations.

get_auth_admin_methods_spec

Retrieves documentation for all available Supabase Auth Admin SDK methods.

call_auth_admin_method

Directly invokes Auth Admin methods (get_user_by_id, list_users, create_user, delete_user, invite_user_by_email, generate_link, update_user_by_id, delete_factor) with proper parameter handling.

retrieve_logs

Accesses logs and analytics from any Supabase service (postgres, api_gateway, auth, postgrest, pooler, storage, realtime, edge_functions, cron, pgbouncer) with time, text, field, or custom SQL filters.

What this server can do

Query | Supabase MCP Server provides tools for these capabilities — tap one to see every MCP server that does the same:

Execute SQL Inspect database schema

When to use it

Run read-only and read-write SQL queries against a Supabase Postgres database from your IDE with safety guardrails
Automatically version database schema changes by generating migration scripts for write and destructive operations
Manage Supabase projects programmatically via the Management API through a chat interface
Create, list, update, delete, and invite test users via the Auth Admin SDK without writing raw SQL
Debug and monitor applications by retrieving logs across the Supabase stack (database, auth, storage, edge functions, etc.)

Security notes

Requires a free QUERY_API_KEY from thequery.dev for all operations (since v0.4). Defaults to a SAFE read-only mode; write operations require enabling unsafe mode via the live_dangerously tool, and destructive operations additionally require explicit 2-step confirmation. Extreme-risk operations (e.g. deleting a project) are blocked entirely. SUPABASE_SERVICE_ROLE_KEY (for Auth Admin) and SUPABASE_ACCESS_TOKEN (for the Management API) are highly privileged credentials and should be handled accordingly. Only supports official Supabase.com hosted projects and local development — no self-hosted support.

Query | Supabase MCP Server FAQ

Is this the official Supabase MCP server?

No. This is an independent open-source server by alexander-zuev. The README notes that Supabase has since released its own official MCP server (supabase-community/supabase-mcp), and the author has decided to no longer actively maintain this one.

Do I need an API key?

Yes. Since v0.4, the server requires a QUERY_API_KEY which you can get for free at thequery.dev; it is required for all operations.

Which MCP clients are supported?

Any MCP client supporting the stdio protocol. It was explicitly tested with Cursor, Windsurf, Cline, and Claude Desktop, and can also be installed via Smithery.ai.

Does it support self-hosted Supabase?

No. It only supports official Supabase.com hosted projects and local development. Custom connection strings and session pooling are also not supported (only transaction pooling).

How does the safety system work?

Operations are categorized by risk: safe/low (read-only) are always allowed; write/medium require enabling unsafe mode via live_dangerously; destructive/high additionally require explicit 2-step confirmation; and extreme-risk operations (like deleting a project) are blocked entirely.

#supabase #postgresql #sql #database #migrations #auth-admin #management-api #cursor #windsurf #cline

Alternatives to Query | Supabase MCP Server

Compare all alternatives →

MCP Toolbox for Databases (BigQuery)

Databases

16k

Google's official MCP server with prebuilt BigQuery tools, querying datasets via Application Default Credentials.

Verified

stdio (local)

OAuth

10 tools

Updated 15 days agoRepo

Postgres MCP Pro

Databases

2.9k

Read/write Postgres access plus index tuning, EXPLAIN plans, and database health analysis for AI agents.

Verified

stdio (local)

API key

Python

9 tools

Updated 3 months agoRepo

Supabase MCP Server

Databases

2.7k

Official Supabase server: manage tables, run SQL, branches, configs and edge functions from your AI client.

Verified

HTTP (remote)

OAuth

TypeScript

12 tools

Updated 1 month agoRepo

Compare Query | Supabase MCP Server with:

vs MCP Toolbox for Databases (BigQuery)vs Postgres MCP Pro vs Supabase MCP Server vs Neon MCP Server