Pinion05 Supabase MCP Lite

What pinion05-supabase-mcp-lite MCP server does

pinion05-supabase-mcp-lite MCP server exposes a compact interface to Supabase projects. It provides four MCP tools:

• select reads rows from a table and accepts optional filters and a row limit.
• mutate inserts, updates, or deletes table data.
• storage performs file operations such as listing or uploading objects in a bucket.
• auth manages Supabase Auth users, including listing and creating users.

Every tool call requires projectUrl. The server can work with multiple projects during one session, provided the caller supplies the relevant URL for each operation.

How it works

The server authenticates with a Supabase Personal Access Token beginning with sbp_. When a tool receives a project URL, it derives the project identifier and uses the Supabase Management API to obtain that project's service-role key. The key is cached in memory so later calls for the same project do not need to retrieve it again.

The service-role client provides administrative access, including access that bypasses Supabase Row Level Security. For that reason, pinion05-supabase-mcp-lite MCP server is intended for server-side or administrative workflows rather than use in a client-side application.

The implementation favors a small context footprint: it exposes four tools rather than a broad collection, uses short parameter schemas, and truncates query results at 100 rows.

Setup and configuration

Create a Supabase Personal Access Token in the Supabase account dashboard, generate it once, and store it securely because it cannot be viewed again. Add the server to an MCP client's configuration using the Smithery connection command:

{
  "supabase-lite": {
    "command": "npx",
    "args": ["@smithery/cli", "connect", "@pinion05/supabase-mcp-lite"],
    "config": {
      "accessToken": "sbp_xxxxxxxxxxxx"
    }
  }
}

The token belongs in the client configuration as accessToken. A project URL is not configured globally; it must be supplied with every tool invocation. The token grants access to all Supabase projects owned by its account, so it should remain private and should not be exposed in browser or other client-side code.

Tools and capabilities

Use select with a table name, optional where criteria, and an optional limit. Use mutate with an action such as insert, update, or delete, plus the table and any required data or filters. Use storage with actions such as list or upload, a bucket, and optional path or file data. Use auth with actions such as list or create, along with user details when needed.

Limitations and notes

The service-role key bypasses RLS, so operations can affect data beyond normal user-level policies. In-memory key caching reduces repeated management API requests but means the server retains retrieved keys for the session. Query results are capped at 100 rows. The Personal Access Token and generated service-role keys require careful handling, particularly in shared MCP environments.

The repository is licensed under MIT.