Supabase integration
Supabase integration for AI agents.
Supabase integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Supabase tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.
What your agents can do
Real Supabase actions, managed and audited.
Your user connects Supabase once; your agent can then inspect Supabase organizations, projects, database configuration, service health, usage, and other Management API resources — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.
- 1
Your user grants Supabase access once (OAuth) — the token lands in the vault.
- 2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
- 3
Every routed call appends a hash-chained audit record — nothing leaves your infra.
Tools & triggers
Supported Supabase tools.
65 tools are generated from the published Supabase catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.
Showing 65 tools. All published catalog entries are included in this page's server-rendered HTML.
- Generate TypeScript types
- Returns the TypeScript types of your schema for use with supabase-js.
- Database
- Get a database branch
- Fetches the specified database branch by its name.
- Environments
- Get database branch config
- Fetches configurations of the specified database branch
- Environments
- Retrieve a function
- Retrieves a function with the specified slug and project.
- Edge Functions
- Retrieve a function body
- Retrieves a function body for the specified slug and project.
- Edge Functions
- Fetch an existing entry from migration history
- Fetch an existing entry from migration history
- Database
- Gets a specific SQL snippet
- Gets a specific SQL snippet
- Database
- Gets a SSO provider by its UUID
- Gets a SSO provider by its UUID
- Auth
- Get the status of an action run
- Returns the current status of the specified action run.
- Environments
- Get the logs of an action run
- Returns the logs from the specified action run.
- Environments
- Gets all projects for the given organization
- Returns a paginated list of projects for the specified organization. This endpoint uses offset-based pagination. Use the `offset` parameter to skip a number of projects and the `limit` parameter to control the number of projects returned per page.
- Projects
- Gets information about the organization
- Gets information about the organization
- Organizations
- Gets project's auth config
- Gets project's auth config
- Auth
- [Beta] Gets the list of available regions that can be used for a new project
- [Beta] Gets the list of available regions that can be used for a new project
- Projects
- Gets the backup schedule for a project
- Gets the backup schedule for a project
- Database
- Get database disk attributes
- Get database disk attributes
- Projects
- Gets database metadata for the given project.
- This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.
- Database
- Get PostgREST OpenAPI spec
- Returns the PostgREST OpenAPI specification for the project. This is the replacement for querying `/rest/v1/` directly with the anon key.
- Database
- Get disk utilization
- Get disk utilization
- Projects
- [Beta] Gets project's custom hostname config
- [Beta] Gets project's custom hostname config
- Domains
- Get user-id to role mappings for JIT access
- Mappings of roles a user can assume in the project database
- Database
- [Beta] Get project's temporary access configuration.
- [Beta] Get project's temporary access configuration.
- Database
- [Beta] Gets project's network restrictions
- [Beta] Gets project's network restrictions
- Projects
- Get entitlements for an organization
- Returns the entitlements available to the organization based on their plan and any overrides.
- Organizations
- Gets project details for the specified organization and claim token
- Gets project details for the specified organization and claim token
- Organizations
- Gets project performance advisors.
- This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.
- Advisors
- Gets project's supavisor config
- Gets project's supavisor config
- Database
- Gets project's Postgres config
- Gets project's Postgres config
- Database
- [Beta] Returns the project's eligibility for upgrades
- [Beta] Returns the project's eligibility for upgrades
- Projects
- [Beta] Gets the latest status of the project's upgrade
- [Beta] Gets the latest status of the project's upgrade
- Projects
- Gets project's postgrest config
- Gets project's postgrest config
- Rest
- Gets the user's profile
- Gets the user's profile
- Profile
- Gets a specific project that belongs to the authenticated user
- Gets a specific project that belongs to the authenticated user
- Projects
- Gets project disk autoscale config
- Gets project disk autoscale config
- Projects
- Gets a project's function combined statistics
- Gets a project's function combined statistics
- Analytics
- Gets all project's logs in a single log stream
- Executes an SQL or LQL query on the project's unified logs stream. Either the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided. If both are not provided, only the last 1 minute of logs will be queried. The timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown. Filter by the `source` column to specify specific log sources, such as edge_logs, postgres_logs, etc. Note: SQL must be written in **ClickHouse SQL dialect**.
- Analytics
- Gets project's logs
- Executes a SQL query on the project's logs. Either the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided. If both are not provided, only the last 1 minute of logs will be queried. The timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown. Note: Unless the `sql` parameter is provided, only edge_logs will be queried. See the [log query docs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer:~:text=logs%20from%20the-,Sources,-drop%2Ddown%3A) for all available sources.
- Analytics
- Get project's pgbouncer config
- Get project's pgbouncer config
- Database
- Get a third-party integration
- Get a third-party integration
- Auth
- Gets project's usage api counts
- Gets project's usage api counts
- Analytics
- Gets project's usage api requests count
- Gets project's usage api requests count
- Analytics
- Returns project's readonly mode status
- Returns project's readonly mode status
- Database
- Gets realtime configuration
- Gets realtime configuration
- Realtime
- Get restore points for project
- Get restore points for project
- Database
- Gets project security advisors.
- This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.
- Advisors
- Gets project's service health status
- Gets project's service health status
- Projects
- [Beta] Get project's SSL enforcement configuration.
- [Beta] Get project's SSL enforcement configuration.
- Database
- Gets project's storage config
- Gets project's storage config
- Storage
- [Beta] Gets current vanity subdomain config
- [Beta] Gets current vanity subdomain config
- Domains
- List all action runs
- Returns a paginated list of action runs of the specified project.
- Environments
- Lists all backups
- Lists all backups
- Database
- List all database branches
- Returns all database branches of the specified project.
- Environments
- Lists all buckets
- Lists all buckets
- Storage
- List all functions
- Returns all functions you've previously added to the specified project.
- Edge Functions
- List all organizations
- Returns a list of organizations that you currently belong to.
- Organizations
- List all projects
- Returns a list of all projects you've previously created.
- Projects
- Lists SQL snippets for the logged in user
- Lists SQL snippets for the logged in user
- Database
- Lists all SSO providers
- Lists all SSO providers
- Auth
- Lists available restore versions for the given project
- Lists available restore versions for the given project
- Projects
- List all user-id to role mappings for JIT access
- Mappings of roles a user can assume in the project database
- Database
- List applied migration versions
- List applied migration versions
- Database
- List members of an organization
- List members of an organization
- Organizations
- List billing addons and compute instance selections
- Returns the billing addons that are currently applied, including the active compute instance size, and lists every addon option that can be provisioned with pricing metadata.
- Billing
- Lists all third-party auth integrations
- Lists all third-party auth integrations
- Auth
- Scrape a project's metrics
- Prometheus scrape endpoint. Returns metrics of a customer project in the Prometheus open exposition format.
- Analytics
FAQ
Supabase integration, answered
- How do AI agents use Supabase through Open Connector?
- Your user connects Supabase once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Supabase tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
- Is this a Supabase MCP server?
- Yes. Open Connector can serve Supabase as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Supabase actions with credentials injected server-side.
- Where do Supabase credentials live?
- In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.
Give your agents Supabase — keep the keys.
Open source, self-hostable, with Supabase credentials that never leave your infrastructure. Run it from source today.