Connectors · Developer & infrastructure
Supabase MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Supabase and the rest of your systems. It gives your agent 159 Supabase actions (74 reads, 61 writes and 24 that wait for a confirmation) and holds the Supabase credential itself, so the agent never does. It paces Supabase's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "supabase.projects.list", intent: "check which Supabase account is connected"}# List all projects · read · 1 upstream call- 159actionsin one signed file
- 74readlook, never change
- 61writecreate and update
- 24wait for a yesdestructive, confirmed first
Set up
Connect Supabase in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Supabase.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
access_tokenSupabase personal access token (starts sbp_)
account { op: "connections.requirements", service: "supabase" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "supabase.projects.list" }# list all projects · read · 1 upstream callcheck { action: "supabase.projects.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Supabase at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
access_token- Limits we pace to
- 120 calls a minute, per connection
- API covered
- Supabase Management API v1 (OpenAPI 3.0.0)
api.supabase.com - Built from
- Supabase's documentation, read 22 October 2026api.supabase.comsupabase.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 60 of 74 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line Supabase up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Supabase.
159 actions in 67 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 74readlook, never change
- 61writecreate and update
- 24destructivewait for a confirmation
Branches
103 read · 5 write · 2 destructive
Create a database branch · List all database branches · Get database branch config · Get a database branch
Projects
92 read · 5 write · 2 destructive
List all projects · Create a project · Gets a specific project that belongs to the authenticated user · Updates the given project
Functions
62 read · 3 write · 1 destructive
Create a function · List all functions · Bulk update functions · Retrieve a function
Migrations
62 read · 3 write · 1 destructive
Apply a database migration · List applied migration versions · Fetch an existing entry from migration history · Rollback database migrations and remove them from history table
API keys
52 read · 2 write · 1 destructive
Creates a new API key for the project · Get project api keys · Get API key · Updates an API key for the project
Custom hostname
51 read · 3 write · 1 destructive
Activates a custom hostname for a project. · Gets project's custom hostname config · Updates project's custom hostname configuration · Attempts to verify the DNS configuration for project's custom hostname configuration
Jit access
52 read · 2 write · 1 destructive
Authorize user-id to role mappings for JIT access · Get user-id to role mappings for JIT access · List all user-id to role mappings for JIT access · Updates a user mapping for JIT access
Signing keys
52 read · 2 write · 1 destructive
Create a new signing key for the project in standby status · Get information about a signing key · List all signing keys for the project · Update a signing key, mainly its status
59 more areas · 108 actions
- SSO providers 5
- Backups 4
- Third party auth 4
- Vanity subdomain 4
- Action runs 3
- Addons 3
- Jit access invites 3
- Network bans 3
- Network restrictions 3
- Organizations 3
- Project claim tokens 3
- Secrets 3
- Auth config 2
- Backup schedule 2
- Cli login roles 2
- Database 2
- Disk 2
- Jit access config 2
- Legacy API keys 2
- Legacy signing key 2
- Organization project claims 2
- Pgsodium config 2
- Pooler config 2
- Postgres config 2
- Postgrest config 2
- Read replicas 2
- Readonly mode 2
- Realtime config 2
- Restore points 2
- Snippets 2
- SSL enforcement 2
- Storage config 2
- Analytics API counts 1
- Analytics API request count 1
- Analytics function stats 1
- Analytics logs 1
- Available regions 1
- Branching 1
- Database context 1
- Database openapi 1
- Database password 1
- Database webhooks 1
- Disk autoscale config 1
- Disk utilization 1
- Organization entitlements 1
- Organization members 1
- Organization projects 1
- Performance advisors 1
- Pgbouncer config 1
- Postgres upgrade eligibility 1
- Postgres upgrade status 1
- Postgres upgrades 1
- Profile 1
- Project health 1
- Project restore versions 1
- Realtime 1
- Security advisors 1
- Storage buckets 1
- Typescript types 1
Top actions
The Supabase API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 10 of Supabase's 10 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
supabase.projects.listList all projects | List all projects. | read | work.project.list109 connectors |
supabase.organizations.listList all organizations | List all organizations. | read | work.workspace.list50 connectors |
supabase.profile.getGets the user's profile | Gets the user's profile. | read | identity.current_user.get307 connectors |
supabase.organization_members.listList members of an organization | List members of an organization. | read | work.workspace_member.list26 connectors |
supabase.projects.createCreate a project | Create a project. | write | work.project.create102 connectors |
supabase.organizations.createCreate an organization | Create an organization. | write | work.workspace.create36 connectors |
supabase.projects.deleteDeletes the given project | Deletes the given project. | destructive | work.project.delete85 connectors |
supabase.secrets.listList all secrets | List all secrets. | read | this connector |
supabase.api_keys.listGet project api keys | Get project api keys. | read | this connector |
supabase.branches.listList all database branches | List all database branches. | read | this connector |
supabase.snippets.listLists SQL snippets for the logged in user | Lists SQL snippets for the logged in user. | read | this connector |
supabase.api_keys.createCreates a new API key for the project | Creates a new API key for the project. | write | this connector |
Try it
Prompts to paste into Claude.
Each one names the Supabase actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Give me a one-line status for every active Supabase project.
calls
supabase.projects.list - Writewrite
Create a project in Supabase. Show me exactly what you will send before you save it.
calls
supabase.projects.create
Governance for Supabase
Destructive actions wait for a yes.
24 Supabase actions are destructive. These are all of them:
- Deletes the given project
supabase.projects.delete - Initiates an undo to a given restore point
supabase.backups.undo - Remove billing addons or revert compute instance sizing
supabase.addons.remove - Resets a database branch
supabase.branches.reset - Deletes an API key for the project
supabase.api_keys.delete - Delete a database branch
supabase.branches.delete - Delete a function
supabase.functions.delete - Disables preview branching
supabase.branching.disable - Delete JIT access by user-id
supabase.jit_access.delete - Rollback database migrations and remove them from history table
supabase.migrations.rollback - Remove network bans.
supabase.network_bans.delete - Bulk delete secrets
supabase.secrets.bulk_delete - Remove a signing key from a project. Only possible if the key has been in revoked status for a while.
supabase.signing_keys.delete - Restores a PITR backup for a database
supabase.backups.restore_pitr - Remove a read replica
supabase.read_replicas.remove - Removes an SSO provider by its UUID
supabase.sso_providers.delete - Delete existing login roles used by CLI
supabase.cli_login_roles.delete - Deletes a project's custom hostname configuration
supabase.custom_hostname.delete - Removes a third-party auth integration
supabase.third_party_auth.delete - Restores a physical backup for a database
supabase.backups.restore_physical - Deletes the invite for an external user to a database for JIT access
supabase.jit_access_invites.delete - Revokes project claim token
supabase.project_claim_tokens.delete - Deletes a project's vanity subdomain configuration
supabase.vanity_subdomain.deactivate - Cancels the given project restoration
supabase.projects.cancel_restoration
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Deletes the given project?
intent: the user asked me to deletes the given project
account { op: "keys.create", name: "supabase-agent", allowed_actions: ["supabase.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "supabase.projects.delete", approver: "[email protected]" }, { match: "supabase.backups.undo", approver: "[email protected]" }, { match: "supabase.addons.remove", approver: "[email protected]" } ]}Cost
What Supabase costs on actionlake.
Every Supabase action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Supabase refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 159 Supabase actions
- 159actions pageeach page of a long list is one call
- 60reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Supabase action.
159 actions by area: the id your agent calls, what it does, and its effect.
Branches10
supabase.branches.createCreate a database branchwritesupabase.branches.deleteDelete a database branchdestructivesupabase.branches.getGet database branch configreadsupabase.branches.get_by_nameGet a database branchreadsupabase.branches.listList all database branchesreadsupabase.branches.mergeMerges a database branchwritesupabase.branches.pushPushes a database branchwritesupabase.branches.resetResets a database branchdestructivesupabase.branches.restoreRestore a scheduled branch deletionwritesupabase.branches.updateUpdate database branch configwrite
Projects9
supabase.projects.cancel_restorationCancels the given project restorationdestructivesupabase.projects.createCreate a projectwritesupabase.projects.deleteDeletes the given projectdestructivesupabase.projects.getGets a specific project that belongs to the authenticated userreadsupabase.projects.listList all projectsreadsupabase.projects.pausePauses the given projectwritesupabase.projects.restartRestarts the given projectwritesupabase.projects.restoreRestores the given projectwritesupabase.projects.updateUpdates the given projectwrite
Functions6
supabase.functions.bulk_updateBulk update functionswritesupabase.functions.createCreate a functionwritesupabase.functions.deleteDelete a functiondestructivesupabase.functions.getRetrieve a functionreadsupabase.functions.listList all functionsreadsupabase.functions.updateUpdate a functionwrite
Migrations6
supabase.migrations.applyApply a database migrationwritesupabase.migrations.getFetch an existing entry from migration historyreadsupabase.migrations.listList applied migration versionsreadsupabase.migrations.patchPatch an existing entry in migration historywritesupabase.migrations.rollbackRollback database migrations and remove them from history tabledestructivesupabase.migrations.upsertUpsert a database migration without applyingwrite
API keys5
supabase.api_keys.createCreates a new API key for the projectwritesupabase.api_keys.deleteDeletes an API key for the projectdestructivesupabase.api_keys.getGet API keyreadsupabase.api_keys.listGet project api keysreadsupabase.api_keys.updateUpdates an API key for the projectwrite
Custom hostname5
supabase.custom_hostname.activateActivates a custom hostname for a project.writesupabase.custom_hostname.deleteDeletes a project's custom hostname configurationdestructivesupabase.custom_hostname.getGets project's custom hostname configreadsupabase.custom_hostname.initializeUpdates project's custom hostname configurationwritesupabase.custom_hostname.reverifyAttempts to verify the DNS configuration for project's custom hostname configurationwrite
Jit access5
supabase.jit_access.authorizeAuthorize user-id to role mappings for JIT accesswritesupabase.jit_access.deleteDelete JIT access by user-iddestructivesupabase.jit_access.getGet user-id to role mappings for JIT accessreadsupabase.jit_access.listList all user-id to role mappings for JIT accessreadsupabase.jit_access.updateUpdates a user mapping for JIT accesswrite
Signing keys5
supabase.signing_keys.createCreate a new signing key for the project in standby statuswritesupabase.signing_keys.deleteRemove a signing key from a project. Only possible if the key has been in revoked status for a while.destructivesupabase.signing_keys.getGet information about a signing keyreadsupabase.signing_keys.listList all signing keys for the projectreadsupabase.signing_keys.updateUpdate a signing key, mainly its statuswrite
SSO providers5
supabase.sso_providers.createCreates a new SSO providerwritesupabase.sso_providers.deleteRemoves an SSO provider by its UUIDdestructivesupabase.sso_providers.getGets an SSO provider by its UUIDreadsupabase.sso_providers.listLists all SSO providersreadsupabase.sso_providers.updateUpdates an SSO provider by its UUIDwrite
Backups4
supabase.backups.listLists all backupsreadsupabase.backups.restore_physicalRestores a physical backup for a databasedestructivesupabase.backups.restore_pitrRestores a PITR backup for a databasedestructivesupabase.backups.undoInitiates an undo to a given restore pointdestructive
Third party auth4
supabase.third_party_auth.createCreates a new third-party auth integrationwritesupabase.third_party_auth.deleteRemoves a third-party auth integrationdestructivesupabase.third_party_auth.getGet a third-party integrationreadsupabase.third_party_auth.listLists all third-party auth integrationsread
Vanity subdomain4
supabase.vanity_subdomain.activateActivates a vanity subdomain for a project.writesupabase.vanity_subdomain.check_availabilityChecks vanity subdomain availabilityreadsupabase.vanity_subdomain.deactivateDeletes a project's vanity subdomain configurationdestructivesupabase.vanity_subdomain.getGets current vanity subdomain configread
Action runs3
supabase.action_runs.getGet the status of an action runreadsupabase.action_runs.listList all action runsreadsupabase.action_runs.update_statusUpdate the status of an action runwrite
Addons3
supabase.addons.applyApply or update billing addons, including compute instance sizewritesupabase.addons.listList billing addons and compute instance selectionsreadsupabase.addons.removeRemove billing addons or revert compute instance sizingdestructive
Jit access invites3
supabase.jit_access_invites.acceptAccepts invitation for JIT database accesswritesupabase.jit_access_invites.createInvites an external user to a database for JIT accesswritesupabase.jit_access_invites.deleteDeletes the invite for an external user to a database for JIT accessdestructive
Network bans3
supabase.network_bans.deleteRemove network bans.destructivesupabase.network_bans.listGets project's network bansreadsupabase.network_bans.list_enrichedGets project's network bans with additional information about which databases they affectread
Network restrictions3
supabase.network_restrictions.applyUpdates project's network restrictionswritesupabase.network_restrictions.getGets project's network restrictionsreadsupabase.network_restrictions.patchUpdates project's network restrictions by adding or removing CIDRswrite
Organizations3
supabase.organizations.createCreate an organizationwritesupabase.organizations.getGets information about the organizationreadsupabase.organizations.listList all organizationsread
Project claim tokens3
supabase.project_claim_tokens.createCreates project claim tokenwritesupabase.project_claim_tokens.deleteRevokes project claim tokendestructivesupabase.project_claim_tokens.getGets project claim tokenread
Secrets3
supabase.secrets.bulk_createBulk create secretswritesupabase.secrets.bulk_deleteBulk delete secretsdestructivesupabase.secrets.listList all secretsread
Auth config2
supabase.auth_config.getGets project's auth configreadsupabase.auth_config.updateUpdates a project's auth configwrite
Backup schedule2
supabase.backup_schedule.getGets the backup schedule for a projectreadsupabase.backup_schedule.updateUpdates the backup schedule time for a projectwrite
Cli login roles2
supabase.cli_login_roles.createCreate a login role for CLI with temporary passwordwritesupabase.cli_login_roles.deleteDelete existing login roles used by CLIdestructive
Database2
supabase.database.read_only_queryRun a sql query as supabase_read_only_userreadsupabase.database.run_queryRun sql querywrite
Disk2
supabase.disk.getGet database disk attributesreadsupabase.disk.updateModify database diskwrite
Jit access config2
supabase.jit_access_config.getGet project's temporary access configuration.readsupabase.jit_access_config.updateUpdate project's temporary access configuration.write
Legacy API keys2
supabase.legacy_api_keys.getCheck whether JWT based legacy (anon, service_role) API keys are enabled. This API endpoint will be removed in the future, check for HTTP 404 Not Found.readsupabase.legacy_api_keys.updateDisable or re-enable JWT based legacy (anon, service_role) API keys. This API endpoint will be removed in the future, check for HTTP 404 Not Found.write
Legacy signing key2
supabase.legacy_signing_key.createSet up the project's existing JWT secret as an in_use JWT signing key. This endpoint will be removed in the future always check for HTTP 404 Not Found.writesupabase.legacy_signing_key.getGet the signing key information for the JWT secret imported as signing key for this project. This endpoint will be removed in the future, check for HTTP 404 Not Found.read
Organization project claims2
supabase.organization_project_claims.claimClaims project for the specified organizationwritesupabase.organization_project_claims.getGets project details for the specified organization and claim tokenread
Pgsodium config2
supabase.pgsodium_config.getGets project's pgsodium configreadsupabase.pgsodium_config.updateUpdates project's pgsodium config. Updating the root_key can cause all data encrypted with the older key to become inaccessible.write
Pooler config2
supabase.pooler_config.getGets project's supavisor configreadsupabase.pooler_config.updateUpdates project's supavisor configwrite
Postgres config2
supabase.postgres_config.getGets project's Postgres configreadsupabase.postgres_config.updateUpdates project's Postgres configwrite
Postgrest config2
supabase.postgrest_config.getGets project's postgrest configreadsupabase.postgrest_config.updateUpdates project's postgrest configwrite
Read replicas2
supabase.read_replicas.removeRemove a read replicadestructivesupabase.read_replicas.setupSet up a read replicawrite
Readonly mode2
supabase.readonly_mode.disable_temporarilyDisables project's readonly mode for the next 15 minuteswritesupabase.readonly_mode.getReturns project's readonly mode statusread
Realtime config2
supabase.realtime_config.getGets realtime configurationreadsupabase.realtime_config.updateUpdates realtime configurationwrite
Restore points2
supabase.restore_points.createInitiates a creation of a restore point for a databasewritesupabase.restore_points.getGet restore points for projectread
Snippets2
supabase.snippets.getGets a specific SQL snippetreadsupabase.snippets.listLists SQL snippets for the logged in userread
SSL enforcement2
supabase.ssl_enforcement.getGet project's SSL enforcement configuration.readsupabase.ssl_enforcement.updateUpdate project's SSL enforcement configuration.write
Storage config2
supabase.storage_config.getGets project's storage configreadsupabase.storage_config.updateUpdates project's storage configwrite
Analytics API counts1
supabase.analytics_api_counts.getGets project's usage api countsread
Analytics API request count1
supabase.analytics_api_request_count.getGets project's usage api requests countread
Analytics function stats1
supabase.analytics_function_stats.getGets a project's function combined statisticsread
Analytics logs1
supabase.analytics_logs.getGets all project's logs in a single log streamread
Available regions1
supabase.available_regions.listGets the list of available regions that can be used for a new projectread
Branching1
supabase.branching.disableDisables preview branchingdestructive
Database context1
supabase.database_context.getGets database metadata for the given project.read
Database openapi1
supabase.database_openapi.getGet PostgREST OpenAPI specread
Database password1
supabase.database_password.updateUpdates the database passwordwrite
Database webhooks1
supabase.database_webhooks.enableEnables Database Webhooks on the projectwrite
Disk autoscale config1
supabase.disk_autoscale_config.getGets project disk autoscale configread
Disk utilization1
supabase.disk_utilization.getGet disk utilizationread
Organization entitlements1
supabase.organization_entitlements.getGet entitlements for an organizationread
Organization members1
supabase.organization_members.listList members of an organizationread
Organization projects1
supabase.organization_projects.listGets all projects for the given organizationread
Performance advisors1
supabase.performance_advisors.listGets project performance advisors.read
Pgbouncer config1
supabase.pgbouncer_config.getGet project's pgbouncer configread
Postgres upgrade eligibility1
supabase.postgres_upgrade_eligibility.getReturns the project's eligibility for upgradesread
Postgres upgrade status1
supabase.postgres_upgrade_status.getGets the latest status of the project's upgraderead
Postgres upgrades1
supabase.postgres_upgrades.createUpgrades the project's Postgres versionwrite
Profile1
supabase.profile.getGets the user's profileread
Project health1
supabase.project_health.getGets project's service health statusread
Project restore versions1
supabase.project_restore_versions.listLists available restore versions for the given projectread
Realtime1
supabase.realtime.shutdownShutdowns realtime connections for a projectwrite
Security advisors1
supabase.security_advisors.listGets project security advisors.read
Storage buckets1
supabase.storage_buckets.listLists all bucketsread
Typescript types1
supabase.typescript_types.generateGenerate TypeScript typesread
Questions
The Supabase MCP server, answered.
Is there a Supabase MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 159 Supabase actions across branches, projects, functions and migrations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Supabase.
What do I need to connect Supabase?
Supabase personal access token (starts sbp_). The free call account { op: "connections.requirements", service: "supabase" } lists exactly what to paste.
Can an AI agent delete or change things in Supabase?
Only if its key allows it, and only with an explicit confirmation. 24 Supabase actions are destructive, including deletes the given project, initiates an undo to a given restore point and remove billing addons or revert compute instance sizing. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Supabase API limit?
actionlake paces every call to the limits in the Supabase service file: 120 calls a minute per connection. Repeated reads are answered from cache (60 Supabase actions can be), which never reaches Supabase.
What does a Supabase action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (159 Supabase actions page). Cache hits, searches, dry runs and calls Supabase refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Supabase API does it cover?
The Supabase Management API v1 (OpenAPI 3.0.0) at api.supabase.com. It is built from Supabase's documentation as read on 22 October 2026. 159 actions in 67 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Supabase data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Supabase credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Supabase today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
