Supabase

§1What it does

Supabase's MCP server lets agents manage tables, run SQL, fetch config and query docs. The hosted server supports scoping to a single project and a read-only mode.

§2Setup

{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com/mcp?project_ref=<project-ref>&read_only=true"
    }
  }
}

Snippets adapted from the official documentation. Check the official page for current options and auth requirements.

§2bWhen you disconnect

1. Removed locallyClear the sign-in or remove the server in your MCP client (for example claude mcp logout or claude mcp remove in Claude Code, or log out of the server in Cursor). This only deletes the client's copy of the tokens.
2. Authorization revokedFind Supabase's connected-apps / authorized applications page and revoke the grant there. We haven't found an official page for it yet. This is what stops the refresh token; clearing the client alone is not enough.

Why both steps: OAuth token refresh in the security checklist.

§3Prompts to try

1. “Show me the schema for the profiles table.”Copy
2. “Write and apply a migration adding a created_at column to posts.”Copy