Connect Supabase to Andromity with the Supabase MCP server

Supabase hosts an official MCP server at https://mcp.supabase.com/mcp. Connected to Andromity, the agent can look at your real schema while it writes queries, apply migrations to a development project, check logs and advisors, and generate TypeScript types.

Signing in uses OAuth with automatic client registration: you approve the connection in your browser and choose the Supabase organization.

What the agent can do with Supabase

• Database: list tables, extensions and migrations, run SQL (execute_sql) and apply migrations (apply_migration).
• Debugging: query logs and get security and performance advisors.
• Development: get the project URL and publishable keys, and generate TypeScript types.
• Edge Functions: list, read and deploy functions.
• Account: list, create, pause and restore projects and organizations.
• Branching (experimental, paid plans): create, merge, reset and rebase branches.
• Search the Supabase documentation.

Example prompts

Ask for the work in plain language. Naming the server helps, for example “use the Supabase MCP server”.

• Look at the schema of the orders table in Supabase and write the query for this report endpoint.
• Create a migration that adds a status column to invoices, apply it to the dev project and regenerate the TypeScript types.
• Check the Supabase advisors for this project and fix any missing row level security policies in our migrations.

Connect Supabase

1. In VS Code, open Andromity Hub → MCP Servers → Discover. In the terminal app, open /settings → MCP → + Connect an app. Find Supabase and select Connect.
2. Approve the connection in your browser and choose the organization.
3. For a safer setup, add Supabase by hand in mcp.json with a scoped, read-only URL such as https://mcp.supabase.com/mcp?project_ref=YOUR_REF&read_only=true, then sign in from its card.

See Connect an app for how Andromity stores connectors and tokens.

Access and safety

• Supabase warns about prompt injection: data in your database, such as a support ticket, could instruct the model to run harmful queries. Keep tool approvals on.
• Supabase advises connecting to production only when a task needs it, and then with project scoping, read_only=true and a limited feature set.
• project_ref limits the server to one project and turns off account-level tools; features= limits which tool groups load.
• Enter Edge Function secrets in the Supabase Dashboard, never in chat.

In an untrusted folder, MCP servers don’t start at all. Read workspace trust and permission modes for the full model.

Limits to know

• Branching tools are experimental and need a paid plan.
• Storage tools are off by default.

Questions

Is it safe to connect Supabase to an AI agent?

Supabase recommends development projects, project scoping, read-only mode and manual approval of tool calls. Andromity’s SAFE mode asks before each call.

How do I make the Supabase connection read-only?

Add the server in mcp.json with read_only=true in the URL, for example https://mcp.supabase.com/mcp?project_ref=YOUR_REF&read_only=true. Queries then run as a read-only Postgres user.

Sources

This guide is based on Supabase’s own documentation. The app controls its server, so tools can change; check the source for the current list.

• Supabase: Model Context Protocol (MCP)
• supabase-community/supabase-mcp on GitHub

Supabase is a trademark of its owner. Andromity is not affiliated with or endorsed by Supabase.