Supabase MCP Server

Most database access work still happens through a UI a human drives. Supabase MCP server moves it into the conversation instead. Enables Cursor and Windsurf to manage Supabase databases and execute SQL queries safely.

The short version

• Functionality — Enables operations not possible with SQL alone (invites, magic links, MFA)
• Accuracy — More reliable then creating and executing raw SQL queries on auth schemas
• Simplicity — Offers clear methods with proper validation and error handling
• Response format:
• All methods return structured Python objects instead of raw dictionaries
• Object attributes can be accessed using dot notation (e.g., user.id instead of user["id"])

The tools it exposes

The server publishes 12 tools. What each one is for:

• get_user_by_id — Retrieve a user by their ID
• list_users — List all users with pagination
• create_user — Create a new user
• delete_user — Delete a user by their ID
• invite_user_by_email — Send an invite link to a user's email
• generate_link — Generate an email link for various authentication purposes
• update_user_by_id — Update user attributes by ID
• delete_factor — Delete a factor on a user (currently not implemented in SDK)
• Prerequisites — Installing the server requires the following on your system: - Python 3.12+ - PostgresSQL 16+
• Cursor — Go to Settings -> Features -> MCP Servers and add a new server with this configuration: bash
• Windsurf — Go to Cascade -> Click on the hammer icon -> Configure -> Fill in the configuration: json { "mcpServers": { "supabase": { "command"
• Troubleshooting — Here are some tips & tricks that might help you: - Debug installation - run supabase-mcp-server directly from the terminal to see if it works. If

Getting it running

Installation goes through your MCP client rather than a global install: point it at @smithery/cli on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.

What it needs from you

Configuration is passed through the environment: SUPABASE_PROJECT_REF, SUPABASE_DB_PASSWORD, SUPABASE_REGION, SUPABASE_ACCESS_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

Installing the server requires the following on your system: - Python 3.12+ - PostgresSQL 16+ If you plan to install via uv, ensure it's installed.

How it compares

Among the database access options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Supabase's toolset — get_user_by_id, list_users, create_user and 9 more — is a fair guide to whether it matches your workflow. It is maintained by Deploya-labs; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Supabase's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 12 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Supabase.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.