MCP server · Supabase
Supabase MCP Server
Supabase's MCP server for managing projects and querying Postgres from an agent, with documented read-only and project-scoping options.
What it is, and what it costs you
This server connects an agent to a Supabase project: inspecting schema, running queries, managing branches and configuration, and searching documentation. It is a good example of a vendor responding to agent-specific risk in the product rather than in a blog post — the server documents a read-only mode and project scoping precisely because the default posture was too broad for comfort.
The risk that drove that is worth stating plainly, because it generalises to every database-backed MCP server. If an agent can execute SQL, and the rows it reads contain attacker-supplied text, then an attacker who can insert a row can attempt to instruct the agent. Public research in 2025 demonstrated this shape against agent-plus-Supabase configurations: text placed in an ordinary application table, read later by an agent operating with elevated database privileges, attempting to induce further queries. The database was working correctly; the agent was the vulnerability.
Row-level security, the usual protection for multi-tenant Postgres, does not help by default here — because service-role connections bypass it. That is the point of the read-only and scoping options: an agent that cannot write cannot escalate, and an agent scoped to one project cannot enumerate others.
Schema and configuration access is a separate, quieter exposure. Table and column names, function definitions, and project settings describe your data model and your security posture to anything that reads them.
Capability profile
What this server can reach, and why a security team cares. These are capabilities the server has by design — derived from the publisher's documentation, not from a scan.
- SQL execution
Reads application data, and on a privileged connection bypasses row-level security. Write access permits schema and data modification.
- stored user content ingestion
Application rows are attacker-supplied text. Reading them is the documented indirect injection path for database servers.
- project and config management
Schema, settings and branch operations reveal and can alter the project's security posture.
- documentation search
Minimal — safe to grant on its own.
Restrict this before you roll it out
- Enable read-only mode
The server supports it, and it removes the escalation half of the risk entirely. Development workflows rarely need the agent to write.
- Scope to a single project
Project scoping prevents an injected session from enumerating or touching unrelated environments.
- Point the agent at development data
A branch or a seeded development database gives the same schema with none of the real user data.
- Do not rely on row-level security
Privileged connections bypass RLS. Least-privilege must come from the connection role, not from policies the role ignores.
Vincosha Assay assessment
not yet assessedWe have not published a scan verdict for Supabase MCP Server.
Everything above is a capability profile compiled by hand from the publisher's own public documentation on 2026-07-25. It describes what this artifact can reach and what to restrict before rolling it out. It is not a security verdict, and it should not be read as one.
When Vincosha Assaypublishes an assessment for this artifact it will appear here with a verdict, the findings behind it, and the date it ran. We would rather leave this space empty than fill it with a guess — inventing a security verdict about somebody else's software would be both wrong and dangerous.
What an assessment covers
- prompt-injection patterns in descriptions and instructions
- credential reads and outbound egress in bundled code
- over-scoped permissions and manifest claims
- typosquatted and impersonating names
- tool-manifest drift since the last approval
- content hash against the version you approved
Sources
This profile was compiled from the publisher's own documentation. Products change — verify against the source before making a decision that depends on a specific detail.