Supabase
Manage Supabase organizations and projects via MCP — run SQL, deploy Edge Functions, configure Auth, and manage secrets with a personal access token.
Overview
Connect Supabase so AI clients can manage your organizations and projects through the Management API — list projects, run SQL, apply migrations, deploy Edge Functions, configure Auth/PostgREST/Realtime/Storage, and manage secrets or API keys.
stackgate.ai stores your personal access token encrypted and calls https://api.supabase.com on your behalf. Tool results are returned to your AI client for that request.
Prerequisites
- A Supabase account
- A stackgate.ai account
Getting credentials
- Sign in to the Supabase Dashboard.
- Open Account → Access Tokens (or go to Account tokens).
- Create a personal access token, copy it once, and store it safely.
- In stackgate.ai, open My Integrations → Supabase.
- Paste the token into Personal access token and click Connect & enable.
- Optionally use Edit tool access to limit the connection to Read tools (or a custom tool allowlist).
Treat the token like a password. PATs carry the privileges of your Supabase user across organizations and projects. Revoke or rotate the token in Supabase if it is exposed.
Using with AI clients
- Dedicated endpoint:
POST /mcp/supabasewith a Sanctum bearer token - Private gateway: one config for all integrations — use
supabase__*namespaced tools
See Documentation for HTTP authentication and private gateway setup.
Suggested workflow
list_organizations/list_projects— find organization slugs and project refs.get_project/get_database_openapi— inspect a project and schema.- Prefer
run_sql_query_read_onlybeforerun_sql_query. - Use Edge Function, Auth config, branch, and secrets tools as needed for your task.
Troubleshooting
- 422 integration not configured — paste a personal access token in My Integrations.
- 401 Unauthorized — regenerate the token under Supabase Account → Access Tokens and update the integration.
- 403 Forbidden — your Supabase role may lack permission for that project or action.
- 429 Too many requests — the Management API limits requests to 120 per minute per project/organization (lower for some analytics endpoints). Wait and retry.
- Destructive actions — tools like
delete_project,rollback_migrations, andrestore_pitr_backupcan cause data loss; confirm intent in the AI client before approving Write access.
Available tools
-
get_profile
Get the Supabase account profile for the connected access token.
-
list_organizations
List Supabase organizations accessible to the connected account.
-
get_organization
Get a Supabase organization by slug.
-
get_organization_entitlements
Get entitlements for a Supabase organization.
-
list_organization_members
List members of a Supabase organization.
-
list_organization_projects
List projects in a Supabase organization.
-
create_organization
Create a Supabase organization.
-
list_projects
List all Supabase projects accessible to the connected account.
-
get_project
Get details for a Supabase project.
-
create_project
Create a new Supabase project.
-
update_project
Update a Supabase project.
-
delete_project
Permanently delete a Supabase project. Destructive — confirm with the user first.
-
list_available_regions
List available Supabase project regions for an organization.
-
get_project_health
Get health status for a Supabase project service.
-
pause_project
Pause a Supabase project.
-
restore_project
Restore a paused Supabase project.
-
get_project_restore_status
Get restore status for a Supabase project.
-
cancel_project_restore
Cancel an in-progress project restore.
-
restart_project
Restart a Supabase project.
-
get_upgrade_eligibility
Check whether a project is eligible for a database upgrade.
-
get_upgrade_status
Get database upgrade status for a project.
-
upgrade_project
Start a database upgrade for a project.
-
list_api_keys
List API keys for a Supabase project. Responses may include secret values — handle carefully.
-
get_api_key
Get one API key by id for a Supabase project.
-
create_api_key
Create an API key for a Supabase project.
-
update_api_key
Update an API key for a Supabase project.
-
delete_api_key
Delete an API key from a Supabase project.
-
list_legacy_api_keys
List legacy anon/service_role API keys for a project.
-
update_legacy_api_keys
Update legacy API keys for a project.
-
list_secrets
List Edge Function / project secrets. Values may be sensitive.
-
create_secrets
Create or update project secrets (array of name/value pairs).
-
delete_secrets
Delete project secrets by name.
-
get_pgsodium_config
Get pgsodium configuration for a project.
-
update_pgsodium_config
Update pgsodium configuration for a project.
-
run_sql_query_read_only
Run a SQL query as supabase_read_only_user. Prefer this for exploration.
-
run_sql_query
Run a SQL query with write privileges. Confirm destructive SQL with the user first.
-
get_database_openapi
Get the PostgREST OpenAPI specification for a project database.
-
generate_typescript_types
Generate TypeScript types from the project database schema.
-
get_database_context
Get database metadata context for a project. Deprecated and rate-limited — prefer OpenAPI/types tools.
-
list_migrations
List applied database migration versions.
-
get_migration
Fetch one migration history entry by version.
-
apply_migration
Apply a database migration.
-
upsert_migration
Upsert a migration history entry without applying it.
-
patch_migration
Patch an existing migration history entry.
-
rollback_migrations
Rollback database migrations and remove them from history. Destructive.
-
list_backups
List database backups for a project.
-
get_backup_schedule
Get the backup schedule for a project.
-
update_backup_schedule
Update the backup schedule for a project.
-
restore_pitr_backup
Restore a point-in-time backup. Destructive — confirm with the user.
-
get_readonly_status
Get database readonly mode status.
-
temporary_disable_readonly
Temporarily disable readonly mode for ~15 minutes.
-
get_postgres_config
Get Postgres configuration for a project.
-
update_postgres_config
Update Postgres configuration for a project.
-
get_pooler_config
Get Supavisor/pooler configuration.
-
update_pooler_config
Update Supavisor/pooler configuration.
-
get_pgbouncer_config
Get pgbouncer configuration for a project.
-
get_ssl_enforcement
Get SSL enforcement configuration.
-
update_ssl_enforcement
Update SSL enforcement configuration.
-
update_database_password
Update the database password for a project.
-
enable_database_webhooks
Enable database webhooks on the project.
-
setup_read_replica
Set up a read replica for the project.
-
remove_read_replica
Remove a read replica from the project.
-
list_sql_snippets
List SQL snippets for the logged-in user.
-
get_sql_snippet
Get a SQL snippet by id.
-
get_auth_config
Get Auth (GoTrue) configuration for a project.
-
update_auth_config
Update Auth configuration. Send only fields you intend to change.
-
list_sso_providers
List SAML SSO providers for a project.
-
get_sso_provider
Get a SAML SSO provider by id.
-
create_sso_provider
Create a SAML SSO provider.
-
update_sso_provider
Update a SAML SSO provider.
-
delete_sso_provider
Delete a SAML SSO provider.
-
list_third_party_auth
List third-party auth integrations for a project.
-
get_third_party_auth
Get a third-party auth integration by id.
-
create_third_party_auth
Create a third-party auth integration.
-
delete_third_party_auth
Delete a third-party auth integration.
-
list_signing_keys
List JWT signing keys for a project.
-
get_signing_key
Get a JWT signing key by id.
-
create_signing_key
Create a new JWT signing key (standby).
-
update_signing_key
Update a JWT signing key status.
-
delete_signing_key
Delete a revoked JWT signing key.
-
get_legacy_signing_key
Get legacy JWT secret imported as a signing key.
-
create_legacy_signing_key
Import the project's existing JWT secret as an in_use signing key.
-
list_functions
List Edge Functions for a project.
-
get_function
Get metadata for one Edge Function.
-
get_function_body
Download the body/source of an Edge Function.
-
create_function
Create an Edge Function.
-
update_function
Update an Edge Function.
-
delete_function
Delete an Edge Function.
-
bulk_update_functions
Bulk create/update Edge Functions.
-
deploy_function
Deploy an Edge Function (bundle upload flow).
-
list_branches
List database branches for a project.
-
get_branch
Get a database branch by id or ref.
-
get_branch_by_name
Get a database branch by name within a project.
-
create_branch
Create a database branch.
-
update_branch
Update a database branch.
-
delete_branch
Delete a database branch.
-
delete_all_branches
Delete all database branches for a project.
-
get_branch_diff
Get the migration diff for a database branch.
-
merge_branch
Merge a database branch into production.
-
push_branch
Push migrations from a database branch.
-
reset_branch
Reset a database branch.
-
restore_branch
Restore a scheduled branch deletion.
-
get_project_logs
Get project logs from the analytics log stream.
-
get_all_project_logs
Get all project logs (deprecated endpoint; stricter rate limits).
-
get_usage_api_counts
Get project API usage counts (rate-limited).
-
get_usage_api_requests_count
Get project API requests count (rate-limited).
-
get_functions_combined_stats
Get combined Edge Function statistics.
-
list_log_drains
List log drains for a project.
-
create_log_drain
Create a log drain for a project.
-
update_log_drain
Update a project log drain.
-
delete_log_drain
Delete a project log drain.
-
get_performance_advisors
Get performance advisors (deprecated/experimental).
-
get_security_advisors
Get security advisors (deprecated/experimental).
-
get_network_restrictions
Get network restrictions for a project.
-
update_network_restrictions
Update network restrictions configuration.
-
apply_network_restrictions
Apply network restrictions to a project.
-
retrieve_network_bans
Retrieve network bans for a project.
-
retrieve_network_bans_enriched
Retrieve enriched network bans for a project.
-
delete_network_bans
Remove network bans for a project.
-
get_custom_hostname
Get custom hostname configuration.
-
initialize_custom_hostname
Initialize a custom hostname.
-
reverify_custom_hostname
Reverify custom hostname DNS.
-
activate_custom_hostname
Activate a custom hostname.
-
get_vanity_subdomain
Get vanity subdomain configuration.
-
check_vanity_subdomain_availability
Check vanity subdomain availability.
-
activate_vanity_subdomain
Activate a vanity subdomain.
-
delete_vanity_subdomain
Delete vanity subdomain configuration.
-
get_storage_config
Get Storage configuration for a project.
-
update_storage_config
Update Storage configuration.
-
list_storage_buckets
List Storage buckets for a project.
-
get_realtime_config
Get Realtime configuration.
-
update_realtime_config
Update Realtime configuration.
-
shutdown_realtime
Shut down Realtime connections for a project.
-
get_postgrest_config
Get PostgREST configuration.
-
update_postgrest_config
Update PostgREST configuration.
-
get_disk_config
Get disk configuration for a project.
-
get_disk_util
Get disk utilization for a project.
-
get_disk_autoscale
Get disk autoscale configuration.
-
update_disk_config
Update disk configuration.
-
list_billing_addons
List billing addons and compute selections.
-
update_billing_addons
Apply or update billing addons including compute size.
-
remove_billing_addon
Remove a billing addon or revert compute sizing.
-
list_actions
List project actions / runs.
-
get_action
Get a project action run by id.
-
get_action_logs
Get logs for a project action run.
-
update_action_status
Update the status of an action run.
-
get_jit_access
Get temporary JIT access configuration for a project.
-
update_jit_access
Update temporary JIT access configuration.
-
list_database_jit_mappings
List user-id to role mappings for database JIT access.
-
get_database_jit_mappings
Get user-id to role mappings for database JIT access.
-
create_database_jit_mapping
Authorize user-id to role mappings for JIT access.
-
update_database_jit_mapping
Update a JIT access user mapping.
-
delete_database_jit_mapping
Delete JIT access by user id.
-
invite_database_jit
Invite an external user for database JIT access.
-
accept_database_jit_invite
Accept a JIT database access invitation.
-
delete_database_jit_invite
Delete a JIT database access invite.
-
create_cli_login_role
Create a temporary CLI login role (beta).
-
delete_cli_login_role
Delete temporary CLI login roles (beta).
MCP endpoint:
https://stackgate.ai/mcp/supabase
(HTTP) or via the
private gateway.