Supabase and MCP: schema help without production writes

The Supabase MCP server connects a compatible coding agent to Supabase for database inspection, SQL queries and project context. For schema and query help, use a development project with project scoping, read-only mode and restricted feature groups; keep production writes outside the agent's access. Supabase's remote MCP overview explains the connection and these controls.

What it can do

Start with a question you can verify against your application's code. For example, ask the agent to inspect a development schema before proposing a join between orders and customers. Require it to name the actual columns it found, explain its assumptions and return proposed SQL for review.

Supabase's MCP tool permission table, as of 30 Oct 2026, includes list_tables, execute_sql and list_migrations. These support a useful investigation: discover the tables, run an approved diagnostic query, then compare migration history with the repository. Ask for only the fields needed to explain the problem. A schema question rarely needs customer messages or payment details.

For documentation questions, search_docs can retrieve Supabase guidance. The remote server announcement describes documentation search and feature groups. A practical request is to find relevant documentation, compare it with the development schema, and identify what still needs testing. Retrieved guidance is evidence to inspect, rather than permission to execute a change.

For other connections, browse MCP servers for apps. The Postgres MCP guide helps frame the database access decision.

What is read-only, and what changes data?

Read-only is an enforced connection setting. Supabase implements it at the Postgres role level, as described in the remote MCP overview. A request in the prompt to avoid writes does not establish that boundary.

Separate inspection from execution:

The permission table associates apply_migration with Migrations Read-write and deploy_edge_function with Edge Functions Read-write. It also lists Database Read for execute_sql. That permission label alone is insufficient evidence that SQL writes are blocked: retain the read-only connection setting.

How to connect it safely

1. Choose a development project. Use synthetic or anonymized data and record the intended project reference in your task brief. Keep production credentials out of the editor environment. Supabase's defense-in-depth guidance explains why environment separation matters even when write protection exists.

2. Build a narrowly scoped hosted URL. Use the official MCP configuration to set project_ref, read_only=true and features=database,docs. Project scoping disables account tools; feature groups restrict exposed tools. Replace the placeholder below with the development project's reference:

text https://mcp.supabase.com/mcp?project_ref=YOUR_DEV_PROJECT_REF&read_only=true&features=database,docs

Treat these settings as separate controls. Selecting a project does not itself make the connection read-only.

3. Add it to a compatible editor client. In VS Code, run MCP: Add Server, choose HTTP, enter the URL and assign a recognizable server ID. Review the configuration destination for your active agent client. Microsoft's MCP setup guide explains the available destinations; our MCP in VS Code guide provides background. Installing an unrelated chat extension does not establish that its chat can call this server.

4. Authenticate and inspect the grant. The official repository describes browser sign-in and choosing the organization containing your project. The normal hosted flow does not require manually creating a PAT. If your client needs a manually registered OAuth app, the MCP documentation currently requires write access to all available OAuth scopes; do not describe that grant as narrowly read-only.

5. Scope alternative credentials separately. For token-based automation, follow the PAT documentation: restrict the token to the project and permissions its tools require. Avoid legacy full-access tokens. Keep credentials out of prompts and committed configuration. Credential scope, project selection and read-only execution each need review.

6. Verify an actual read. Keep manual tool approval enabled. Ask the agent to list the development tables, inspect the tool arguments and returned result, then request a small diagnostic query. Confirm the effective connection URL retains its restrictions and that mutation tools are unavailable. If they appear, stop and investigate configuration before continuing. Microsoft's verification instructions distinguish a successful tool call from a plausible answer. Record the project and configuration with your result; use the MCP security checklist before widening access.

When this does not work

Read-only does not make private data public-safe. An agent can still disclose information it reads. Database text may contain malicious instructions; treat returned rows as untrusted data and review subsequent calls. Supabase's security analysis describes this risk. Prefer schema evidence and anonymized examples over full row exports.

The wrong organization or client configuration breaks discovery. Check the authenticated account, selected organization, project reference and configuration destination. Inspect the client error and tool output before reconnecting. Do not broaden credentials just to make an error disappear. The repository setup instructions also note that clients have different configuration formats.

Missing tools can be intentional. A docs-and-database connection should not be expanded merely because a suggested task wants deployment access. Return a proposal for human review instead. A SQL failure under read-only access may be the boundary working correctly.

Local and self-hosted deployments differ from hosted MCP. The official repository documents a smaller tool subset and no OAuth for those environments. Supabase's self-hosting guide says to keep its MCP endpoint off the public Internet and access it through a VPN or SSH tunnel. Check the current documentation for that deployment rather than reusing hosted authentication assumptions.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension provides an editor entry point for questions with attached context. Use it to discuss a sanitized development schema or review proposed SQL. TvijoCode is a test build with the extension embedded. Neither description establishes a ready Supabase connector.

Tvijo MCP makes Tvijo consultation available to an MCP client; supplied-diff review is prepared with publication pending, while editor integration and delegation are planned separately. A compatible client must connect to Supabase independently. Keep production writes off and review any proposed database change through your normal development process.

At dsh.tvijo.com, as of 31 Oct 2026, Try costs $0: sponsored use ends at 50 tasks, 100,000 tokens or $0.05 of usage, whichever comes first, within a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 for requested prepaid credit, with metered provider usage plus an 8% service markup. Payment collection is not activated; an order is not a charge. These offers do not establish Supabase access or pricing.

FAQ

Do I need a personal access token for Supabase MCP?

The normal hosted browser sign-in flow avoids manual PAT creation. Token-based automation is a separate setup; restrict its project and permissions using the official PAT guidance above.

Can a Supabase AI agent change my database?

A write-capable configuration can expose mutation operations. This workflow uses an explicitly read-only development connection and keeps migration application and deployment outside its scope.

Does installing Tvijo connect my Supabase project automatically?

There is no documented ready Supabase connection established by that installation. Use a compatible MCP client for the separately scoped Supabase connection, or submit sanitized context for discussion in Tvijo.

Supabase is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.