Skills/npm/mcp-server-supabase

mcp-server-supabase@0.17.0

VERIFIED

Publisher claims: "MCP server for interacting with Supabase" Observed in sandbox: calls supabase.com only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher supabase · publishing for 680 daysInstalls 673KLast detonated 27 h ago
$claude mcp add mcp-server-supabase -- npx -y @supabase/mcp-server-supabase
WatchReport an issue

Coverage

Started with a decoy SUPABASE_ACCESS_TOKEN; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in SUPABASE_ACCESS_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
SUPABASE_ACCESS_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
SUPABASE_ACCESS_TOKEN or --access-tokenConfiguration, not credentials: SUPABASE_CONTENT_API_URL
Where it talks to
supabase.com, supabase.green, supabase.co (its own)
What the honeypot saw
no credential files read · reached only supabase.com (its own)
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for SUPABASE_ACCESS_TOKEN and talks to supabase.com, supabase.green, supabase.co. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets SUPABASE_ACCESS_TOKEN=supabase.com -- npx -y @supabase/mcp-server-supabase

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls supabase.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 54 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
14sprocessdependency install exit 0
34sprocessrelaunched with a decoy SUPABASE_ACCESS_TOKEN (tagged; nothing real)
54snetworkCONNECT tcp://supabase.com:443
54sclaimed36 tools with a decoy SUPABASE_ACCESS_TOKEN: search_docs, list_organizations, get_organization, list_projects, get_project, get_cost, confirm_cost, create_project, pause_project, restore_project, list_tables, list_extensions, list_migrations, apply_migration, execute_sql, query_logs, get_advisors, get_project_url, get_publishable_keys, generate_typescript_types, list_edge_functions, get_edge_function, deploy_edge_function, create_branch, list_branches
54stoolsbca3f51331ad599a
54stoolsdb718b8c1d520a5c
54stools911495434b02284e
54stoolsf5637f1d3b4bc48d
54stoolsddfe97da838ca6cc
54stoolse7b9451f0e2e507d
54stools9c1a639b91c8d894
54stoolsc3a5e08009a43615
54stools162ef57ff99b60c7
54stoolsfeeaf83305168cda
54stoolsce86d255f91efb90
54stools6f6a1aa828edd1c2
54stoolsc143d6d13fdc45d5
54stoolsbadb1b56cf5f691b
54stools89adcc6a7946ddfd
54stools71c4e19552f0a7b7
54stools984550a85d16ef38
54stools2773cd2e5748c2ce
54stools8fe2d2378758f05b
54stoolsdd346414a2c14b94
54stoolsab0189074bd73eaf
54stoolsc2908a6bb1fa8a31
54stools4b04e822a9fc7055
54stools76d3f70064f31d35
54stools6d9b8a685d34f13f
54stoolse3c37c5810a8f870
54stools5d3f3a727866be91
54stools1d294b9d2e8a684f
54stools323fa6932385b760
54stools8e8781348f8547f3
54stoolse961684a39bdda8c
54stoolsc83de4ba18789393
54stools647daef55263174c
54stoolsd9336f8e9b2ead88
54stools92ab5db3c91186e2
54stools44275b3690bf1f64
54sprocessscript backend runs setup only
54sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/chunk-VNQ4ISM6.js:271 · File type combined with upload action — agent may exfiltrate local data files…ing()})).describe("The files to upload. This should include the entrypoint, deno.json, and any relative dependencies. Include the deno.json and deno.jsonc files to configure the Deno runtime (e.g., compiler options, imports) if they exist.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/chunk-VNQ4ISM6.js:1 · File type combined with upload action — agent may exfiltrate local data files…tch Supabase Content API GraphQL schema: HTTP status ${s.status}`);let r=await s.json(),{data:i,error:c}=tn.safeParse(r);if(c)throw new Error(`Failed to parse Supabase Content API response: ${c.message}`);if(i.errors?.length){let l=`Supaba…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/chunk-IMPRDEX4.cjs:275 · File type combined with upload action — agent may exfiltrate local data files…hat target the primary database can be run.`);c=await o.executeSql(n,{query:Eo(e.sql,e.row_limit),read_only:a,max_result_bytes:s})}else{if(!_optionalChain([t, 'optionalAccess', _94 => _94.queryLogs]))throw new Error("Log queries are not av…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/chunk-IMPRDEX4.cjs:1 · File type combined with upload action — agent may exfiltrate local data files…tch Supabase Content API GraphQL schema: HTTP status ${s.status}`);let r=await s.json(),{data:i,error:c}=tn.safeParse(r);if(c)throw new Error(`Failed to parse Supabase Content API response: ${c.message}`);if(_optionalChain([i, 'access', _6…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/chunk-IMPRDEX4.cjs:271 · File type combined with upload action — agent may exfiltrate local data files…ing()})).describe("The files to upload. This should include the entrypoint, deno.json, and any relative dependencies. Include the deno.json and deno.jsonc files to configure the Deno runtime (e.g., compiler options, imports) if they exist.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-SXD3C6JM.cjs:1 · MCP server using network transport (SSE/HTTP) — data sent over network…...args)); lastAccessLHS = undefined; } } return value; }var g={name:"@supabase/mcp-server-supabase",mcpName:"com.supabase/mcp",version:"0.17.0",description:"MCP server for interacting with Supabase",license:"Apache-2.0",repository:{type:"…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-IMPRDEX4.cjs:294 · MCP server using network transport (SSE/HTTP) — data sent over network…ttlSeconds:_}):void 0,j=_nullishCoalesce(w, () => (S)),X;return _mcputils.createMcpServer.call(void 0, {name:"supabase",title:"Supabase",version:_t,instructions:vs,async onInitialize(v){X=v.clientInfo;let{clientInfo:P}=v,$=`supabase-mcp/${…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/chunk-IMPRDEX4.cjs:287 · npx invocation of non-well-known package — may execute untrusted code- Install the Supabase agent skill for critical development and security guidance: \`npx skills add supabase/agent-skills\` (https://supabase.com/docs/guides/getting-started/ai-skills.md)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/chunk-HID6VPMI.js:1 · File type combined with upload action — agent may exfiltrate local data files…f}=q.parse(e),h;try{h=await M.getEdgeFunction(t,s)}catch{}let y=f.find(g=>["deno.json","import_map.json"].includes(g.name));n??=h?.import_map_path??y?.name;let O=await r.POST("/v1/projects/{ref}/functions/deploy",{params:{path:{ref:t},quer…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-VJTFZ74D.js:1 · MCP server using network transport (SSE/HTTP) — data sent over networkvar g={name:"@supabase/mcp-server-supabase",mcpName:"com.supabase/mcp",version:"0.17.0",description:"MCP server for interacting with Supabase",license:"Apache-2.0",repository:{type:"git",url:"https://github.com/supabase/mcp.git"},type:"modu…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/chunk-VNQ4ISM6.js:287 · npx invocation of non-well-known package — may execute untrusted code- Install the Supabase agent skill for critical development and security guidance: \`npx skills add supabase/agent-skills\` (https://supabase.com/docs/guides/getting-started/ai-skills.md)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.d.ts:184 · MCP server using network transport (SSE/HTTP) — data sent over networkdeclare function createSupabaseMcpHandler(options: SupabaseMcpServerOptions): _modelcontextprotocol_server.McpHttpHandler;Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/chunk-VVFN7QGX.cjs:1 · File type combined with upload action — agent may exfiltrate local data files…parse(e),h;try{h=await M.getEdgeFunction(t,s)}catch (e3){}let y=f.find(g=>["deno.json","import_map.json"].includes(g.name));n??=_nullishCoalesce(_optionalChain([h, 'optionalAccess', _8 => _8.import_map_path]), () => (_optionalChain([y, 'op…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/chunk-VNQ4ISM6.js:275 · File type combined with upload action — agent may exfiltrate local data files…hat target the primary database can be run.`);c=await o.executeSql(n,{query:Eo(e.sql,e.row_limit),read_only:a,max_result_bytes:s})}else{if(!t?.queryLogs)throw new Error("Log queries are not available on this server, so log cells cannot be …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-VNQ4ISM6.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network…ateCodec as $o,isSpecType as ws}from"@modelcontextprotocol/server";import{createMcpServer as Ts}from"@supabase/mcp-utils";import{z as js}from"zod/v4";import on from"gqlmin";import{z as Ht}from"zod/v4";import{buildSchema as Yo,GraphQLError …Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈52 tok
1 file · 25 in bundle
Tool list per prompt
≈7,398 tok
36 tools · 206 per tool
Handshake
1637 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 337

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @supabase/mcp-server-supabase@0.17.0 as of 26 h ago. This is the package itself, not its dependencies.