Database MCP for PostgreSQL and Supabase: SQL you can review

A Postgres MCP server lets an agent inspect a database and answer analytics questions through tools; for Supabase, use its official MCP server. Start with read-only access: a narrowly permitted database role for a direct PostgreSQL connection, or Supabase’s read-only setting with project scoping. Require the SQL alongside every answer so you can review how the result was produced (Supabase setup, Postgres MCP Pro).

What it can do

Useful questions are bounded: count active accounts by plan, explain which table supplies an order status, or investigate a slow reporting query. Ask the agent to inspect the relevant schema before proposing SQL, then distinguish the returned data from its interpretation.

There are different connection routes:

The Supabase documentation lists list_tables and execute_sql. Postgres MCP Pro’s tool definitions document schema inspection and query-plan tools, including explain_query. Tool names belong to their server; they are not interchangeable connector settings. These capabilities are documented as of 30 Oct 2026.

If the protocol is new to you, start with what MCP is. Browse other compatibility targets in MCP servers for apps.

Make the answer inspectable

Suppose your team has a reporting view named reporting.active_accounts, with an agreed definition of active and a plan_tier column. This fictional schema illustrates the workflow; it is not a built-in PostgreSQL or Supabase dataset.

Ask the agent:

Inspect the approved reporting view. Propose SQL to count active accounts by plan. Show the SQL before execution, wait for approval, then return the aggregate and explain what it cannot establish. Do not retrieve account identities.

A proposed query might be:

SELECT plan_tier, COUNT(*) AS active_accounts
FROM reporting.active_accounts
GROUP BY plan_tier
ORDER BY active_accounts DESC;

The PostgreSQL SELECT reference explains grouping and ordering. The business review remains yours: does each view row represent an account, does active mean recent activity or a paid subscription, and when was the underlying data refreshed?

Accept an answer only when it includes the executed SQL, the returned aggregate, the data scope and those assumptions. A current distribution does not explain why accounts changed plans. That would require a separately defined historical question and appropriate data.

How to connect it safely

1. Define the permitted question and dataset. Start with development data or an approved reporting dataset. Name the tables or views the task needs and exclude unrelated personal fields. Decide who may receive the result before connecting an agent.

2. For direct PostgreSQL, provision a dedicated reader first. Have the database administrator grant only the required access. For an already provisioned login role, this illustrative fragment grants access to the example view:

sql GRANT CONNECT ON DATABASE app_analytics TO mcp_reader; GRANT USAGE ON SCHEMA reporting TO mcp_reader; GRANT SELECT ON reporting.active_accounts TO mcp_reader;

Replace the example identifiers. This fragment adds privileges; it does not remove existing ones or create the login. Review ownership, role memberships and PUBLIC grants too: permissions accumulate. See PostgreSQL GRANT, as of 30 Oct 2026. Do not use the application owner or a superuser for this reader.

3. For Supabase, narrow the hosted connection. Replace PROJECT_REF in this endpoint:

text https://mcp.supabase.com/mcp?project_ref=PROJECT_REF&read_only=true&features=database,docs

Project scoping disables account tools; read-only mode runs queries as a read-only Postgres user. Limiting feature groups reduces exposed capabilities. Follow the current Supabase configuration and authentication instructions, as of 30 Oct 2026. Treat this as the hosted route, rather than pasting a database password into chat.

4. Add the server to your editor client. In VS Code, run MCP: Add Server from the Command Palette. Choose HTTP for the Supabase URL, or Command (stdio) for a locally provisioned Postgres MCP Pro process. Review the destination and trust prompts using the VS Code guide. Another editor may require a different configuration format.

5. Make the direct server restriction explicit. Follow the repository’s runtime setup, then launch postgres-mcp --access-mode=restricted; supply DATABASE_URI securely for the dedicated reader. The server implementation defaults to unrestricted access, so keep the flag explicit. A launch command does not prove isolation.

6. Verify effective access. Inspect the discovered tools and an actual tool result. Confirm the intended database and identity through administrator-approved diagnostics. Test denied access against a disposable fixture, separately from valuable data. A successful connection proves reachability, not a complete permission policy.

7. Approve and preserve the evidence. Keep interactive tool approvals enabled. Review the query before it runs and retain the SQL with its result and execution time. Use the MCP security checklist to review the surrounding client permissions, including where results may be sent.

When this does not work

Read-only does not mean confidential. A permitted query can still return sensitive information. Supabase’s security guidance describes prompt injection through stored content. Treat text in rows as data, never as authority to query elsewhere or send a report.

Read-only is also not a universal sandbox. PostgreSQL’s transaction documentation defines specific prohibited operations and warns that read-only transactions do not prevent every disk write. Combine server restrictions with least privilege and review callable routines.

Diagnostics need their prerequisites. Postgres MCP Pro’s workload and hypothetical-index features depend on pg_stat_statements and hypopg, as its README explains. Missing extensions or permissions are reasons to narrow the task, not to grant administrator access automatically.

A correct query can answer the wrong question. Ambiguous definitions, duplicated source rows and unsuitable comparison periods need human clarification. For repeated reporting with fixed definitions, consider a reviewed query or application integration; see MCP versus APIs and function calling.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension provides an editor entry for questions with selected context and task receipts. An appropriate workflow is to submit authorized schema details and proposed SQL for explanation, with a read-only role established before any separate database connection. Remove credentials and unnecessary row data first; review permissions and data flow.

TvijoCode embeds the extension in a Code - OSS editor test build. Tvijo MCP exposes Tvijo to an MCP client for consultation; editor integration and delegation remain planned work. Neither an installed extension nor Tvijo MCP establishes a ready PostgreSQL / Supabase integration. A database connection needs its own compatible client, server configuration and access review.

The Tvijo workspace offers, as of 30 Oct 2026, show Try at $0: up to 5 tasks, 50,000 tokens or $0.05 of sponsored usage, whichever is reached first, from a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 for requesting prepaid credit; usage is metered with an 8% service markup. Payment collection is not activated, and an order is not a charge. These offers do not establish database access or include a promised connector.

FAQ

Which Postgres MCP server should I evaluate?

For direct PostgreSQL, evaluate Crystal DBA’s Postgres MCP Pro with restricted mode and a dedicated reader. For a Supabase project, evaluate the official Supabase MCP route. Review each server’s current documentation before deployment.

Is a read-only prompt enough?

No. A request in chat is not a permission boundary. Establish effective database permissions, enable the server’s read-only restriction and review what data the client can export.

Can Tvijo connect to Supabase automatically?

A ready automatic connector is not established here. Tvijo can fit a review workflow using authorized context; live access requires a separately configured, verified database connection.

PostgreSQL / Supabase is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.