Supabase
Read your own Supabase projects, edge functions, secret names and database branches through the Management API, with SQL through a scoped role. Connect with OAuth or an access token.
- rest
https://api.superagnt.com/v1/connections/supabaseplus the vendor's own path, with your superagnt_ API key asAuthorization: Bearer.- mcp
- Tools named
connection_supabase_*onhttps://mcp.superagnt.com/mcp, served once the account is connected. - billing
- Supabase bills your own account. Calls cost no superagnt_ data credits.
- rate limit
- 5 requests a second, 60 a minute: the vendor's ceiling as the registry records it, for sizing bursts. Your plan's own limit is on Connections.
- vendor docs
- https://supabase.com/docs/reference/api
The Supabase connection reads the Supabase account you connect through the Supabase Management API: its projects, a project's edge functions, the names of its secrets and its database branches. It does not run SQL. Agents read and write a project's database with connection_supabase_query and connection_supabase_schema, which connect through a scoped Postgres role built from the per-table access you grant: see Bring your own database.
not the workspace database
This connection reaches a Supabase account of your own. The database superagnt_ provisions for each workspace is a separate surface: Workspace database.
01
Setup
Connect with Supabase
- Start the install. In the superagnt app open Integrations, pick Supabase and click Connect with Supabase.
- Approve access. Approve the install in the window Supabase opens.
Paste an access token
If Connect with Supabase is not offered, the connect dialog opens on the token form. To use a token instead of OAuth, click Use API key instead.
- Create a token. In Supabase open Account → Access Tokens, click Generate new token and copy it. It starts with
sbp_, and Supabase shows it only once. - Paste it. Paste it as the Access token on the Supabase connection.
the token is your whole account
Supabase tokens have no scopes: an access token carries every permission of your Supabase user, in every organization it belongs to. Treat it like a password, and delete it from the same Access Tokens page if it leaks.
Allowlist projects
SQL reaches only allowlisted projects. On the Supabase connection page in the superagnt app, click Add projects and pick the ones agents may run SQL on. Each project starts with no table access: give its tables read, or read and write, access there before agents run SQL on it.
02
Things to know
- A REST call to the Management API's SQL endpoint,
POST /v1/projects/{ref}/database/query, returns a 403 whatever the allowlist says: it runs as the privilegedpostgresrole. The connection has no MCP tool for it either. SQL goes throughconnection_supabase_query. - On the REST route, a call on a project outside the allowlist returns a 403 that names the allowlist, and
GET /v1/projectsreturns only allowlisted projects. - Supabase's own paths keep their
/v1prefix after the connection base, so the project list ishttps://api.superagnt.com/v1/connections/supabase/v1/projects.
03
Examples
List allowlisted projects
curl "https://api.superagnt.com/v1/connections/supabase/v1/projects" \
-H "Authorization: Bearer $AGNTDATA_API_KEY"Read one project
curl "https://api.superagnt.com/v1/connections/supabase/v1/projects/PROJECT_REF" \
-H "Authorization: Bearer $AGNTDATA_API_KEY"List a project's edge functions
curl "https://api.superagnt.com/v1/connections/supabase/v1/projects/PROJECT_REF/functions" \
-H "Authorization: Bearer $AGNTDATA_API_KEY"4 tools, one per resource and risk
MCP servers and agents on the grouped surface list Supabase as these tools. Each takes an action, and the ones that work across record types an object. Every operation also keeps its own per-operation name, in the next table, which works on every server. How grouping works: Grouped tools.
| Tool | Risk | Actions |
|---|---|---|
connection_supabase_projects_readRead Supabase projects List the connected account's projects or get one, through the Management API. Only projects the user allowlisted at https://app.superagnt.com/dashboard/connections/supabase are visible. Read or write a project's database with connection_supabase_query and connection_supabase_schema. | read | listget |
connection_supabase_functions_readRead Supabase edge functions List a project's edge functions or get one. Only projects the user allowlisted at https://app.superagnt.com/dashboard/connections/supabase are visible. | read | listget |
connection_supabase_secrets_readList Supabase secret names List the names of a project's secrets (never their values). Only projects the user allowlisted at https://app.superagnt.com/dashboard/connections/supabase are visible. | read | list |
connection_supabase_branches_readList Supabase branches List a project's database branches. Only projects the user allowlisted at https://app.superagnt.com/dashboard/connections/supabase are visible. | read | list |
All 6 operations
Each operation is a REST path under https://api.superagnt.com/v1/connections/supabase and an MCP tool. The per-operation tool name is the one permissions, approvals and usage records use.
| Operation | MCP tool |
|---|---|
GET /v1/projectsList projects | connection_supabase_listprojectsgrouped: connection_supabase_projects_read, action list |
GET /v1/projects/{ref}Retrieve a project | connection_supabase_getprojectgrouped: connection_supabase_projects_read, action get |
GET /v1/projects/{ref}/functionsList edge functions | connection_supabase_listedgefunctionsgrouped: connection_supabase_functions_read, action list |
GET /v1/projects/{ref}/functions/{slug}Retrieve an edge function | connection_supabase_getedgefunctiongrouped: connection_supabase_functions_read, action get |
GET /v1/projects/{ref}/secretsList project secrets | connection_supabase_listprojectsecretsgrouped: connection_supabase_secrets_read, action list |
GET /v1/projects/{ref}/branchesList database branches | connection_supabase_listprojectbranchesgrouped: connection_supabase_branches_read, action list |