The Supabase MCP for teams that run their backend from automations
Connect Supabase once and your organizations, projects, database, preview branches, and Edge Functions become building blocks for visual automations and AI agent workflows. 69 typed nodes over the Supabase Management API, including SQL against a project database.
What the Supabase MCP connector does
The Supabase connector for Mattering Automations covers the Supabase Management API: list organizations, members, and projects, create, rename, pause, restart, and delete projects, run SQL and apply migrations against a project database, drive preview branches from create through push, diff, merge, and reset, manage Edge Functions, project secrets, and API keys, read and update auth, PostgREST, Storage, Postgres, and Realtime config, and pull security advisors, performance advisors, logs, and usage counts.
One scope note worth reading before you connect. This connector talks to the Management API at api.supabase.com, authenticated with a single personal access token. It does not wrap the per-project Data API (PostgREST) at your-project-ref.supabase.co, because that surface uses a different key for every project and our connectors hold one credential per workspace. Your data is still reachable: Run Read-Only SQL Query and Run SQL Query execute SQL directly against a project database, which covers more ground than PostgREST table CRUD, and Get Database Context and Get PostgREST OpenAPI Spec hand an agent the schema before it writes that SQL.
Each capability is a node on the Automations canvas, and every node speaks MCP, the open protocol for connecting AI assistants to tools. Claude, ChatGPT, and any MCP-capable assistant can use them, and they also power Matter, the platform's built-in AI assistant. Describe the backend workflow you want in plain language and it gets built on the canvas in front of you, where you can see and edit every step.
Seven nodes are marked destructive because they are: delete project, delete branch, reset branch, delete secrets, delete API key, delete Edge Function, and Run SQL Query, which runs whatever statement you hand it with full privileges. The node descriptions say so in the palette, so nobody wires one in by accident.
One connection, three surfaces
- Visual automations. Drag Supabase nodes onto the canvas and wire them to triggers, conditions, and other apps.
- AI agents, yours or ours. These nodes speak MCP, the open protocol, so Claude, ChatGPT, and any MCP-capable assistant can use them, and Matter, the agent built into the platform, uses them natively.
- The whole platform. Combine with native tasks, projects, and other connectors, no middleware in between.
Every Supabase node, ready to drop on the canvas
69 nodes, generated from the connector itself so this list always matches what ships. Expand a category to browse.
Read and query nodes 42
Supabase: Diff Branch
[Beta] Diff a preview branch against its parent. Returns SQL text, not JSON, so the body arrives under data.raw_body.
Supabase: Generate TypeScript Types
Generate TypeScript type definitions for the project's schema. Returns the .ts source as a string.
Supabase: Get API Usage Counts
Get request counts per service (auth, realtime, rest, storage) bucketed over an interval.
Supabase: Get Auth Config
Get the project's GoTrue auth settings: site URL, redirect allow list, token expiry, provider toggles.
Supabase: Get Branch Config
Get a branch's database connection config: Postgres version, host, port, and (when the token is allowed to see them) credentials.
Supabase: Get Branch by Name
Get one preview branch on a project by its branch name.
Supabase: Get Connection Pooler Config
Get the project's Supavisor pooler config, including the pooled connection strings.
Supabase: Get Database Context
Get database metadata for the project: databases, schemas, and tables. Useful as agent grounding before writing SQL.
Supabase: Get Edge Function
Get one Edge Function's metadata by slug.
Supabase: Get Edge Function Body
Retrieve an Edge Function's deployed source. Non-JSON bodies arrive under data.raw_body.
Supabase: Get Network Restrictions
[Beta] Get the project's allowed database CIDR ranges (IPv4 and IPv6) and whether they are applied.
Supabase: Get Organization
Get one organization: name, plan, opt-in tags, and allowed release channels.
Supabase: Get Performance Advisors
Run Supabase's performance lints: unindexed foreign keys, unused indexes, duplicate indexes, RLS init-plan issues.
Supabase: Get PostgREST Config
Get the project's PostgREST (Data API) config: exposed schemas, max rows, pool settings.
Supabase: Get PostgREST OpenAPI Spec
Get the PostgREST-generated OpenAPI document describing the project's Data API (tables, views, RPC functions).
Supabase: Get Postgres Config
Get the project's tunable Postgres parameters (work_mem, max_connections, statement_timeout, logging).
Supabase: Get Profile
Get the Supabase user profile that owns the personal access token.
Supabase: Get Project
Get one project: name, org, region, status, and database host/version.
Supabase: Get Project Health
Health check per service (auth, db, pooler, realtime, rest, storage). Returns healthy/status per requested service.
Supabase: Get Realtime Config
Get the project's Realtime limits: concurrent users, events/second, payload size, presence.
Supabase: Get SQL Snippet
Get one saved SQL Editor snippet, including its SQL content.
Supabase: Get SSL Enforcement
[Beta] Get whether the project requires SSL for database connections.
Supabase: Get Security Advisors
Run Supabase's security lints on the project: exposed auth tables, RLS disabled or missing policies, security-definer views.
Supabase: Get Storage Config
Get the project's Storage config: file size limit and feature toggles (image transformation, S3 protocol).
Supabase: Get Upgrade Eligibility
[Beta] Check whether the project can be upgraded, with target versions, duration estimate, and blocking validation errors.
Supabase: Get Upgrade Status
[Beta] Get the latest status of a project's Postgres upgrade.
Supabase: List API Keys
List the project's API keys (legacy anon/service_role plus the newer publishable/secret keys). Set reveal to true to return the key values. Treat the output as a secret.
Supabase: List Available Regions
[Beta] List the regions a new project can be created in for an organization, with Supabase's recommended smart group.
Supabase: List Backups
List available database backups plus the project's PITR/WAL-G settings.
Supabase: List Branches
List all preview branches on a project, with migration status and git branch links.
Supabase: List Edge Functions
List the project's Edge Functions with slug, status, and version.
Supabase: List Migrations
List the migration versions applied to the project database.
Supabase: List Organization Members
List the members of an organization with their role and MFA status.
Supabase: List Organization Projects
List an organization's projects with pagination, search, sorting, and status filtering. Includes preview-branch projects (is_branch = true).
Supabase: List Organizations
List every Supabase organization the personal access token can see. Takes no parameters, so this is the connector's auth probe. run it first to confirm the token works.
Supabase: List Projects
List every project the token can reach, across all organizations, with region, status, and Postgres version.
Supabase: List Restore Versions
List the Postgres versions a paused/restorable project can be restored onto.
Supabase: List SQL Snippets
List the saved SQL Editor snippets visible to the token's user, optionally scoped to one project.
Supabase: List Secrets
List the project's Edge Function secrets (environment variables) and their values.
Supabase: List Storage Buckets
List the project's Storage buckets and whether each is public. Object-level operations live on the per-project Storage API, which this connector does not cover.
Supabase: Query Logs
Query the project's logs (edge, Postgres, auth, functions) with a SQL statement over the log tables, optionally windowed by ISO timestamps.
Supabase: Run Read-Only SQL Query
[Beta] Run SQL as the supabase_read_only_user role. The safe way to read project data from an automation. Writes are rejected by the database, not by us.
Action nodes 27
Supabase: Apply Migration
Apply a database migration and record it in the migration history. Schema changes take effect immediately on the target project.
Supabase: Apply Network Restrictions
[Beta] Replace the project's database allow list. This REPLACES the existing CIDRs. Omitting your own range locks you out of the database.
Supabase: Create API Key
Create a new publishable or secret API key for a project.
Supabase: Create Branch
Create a preview branch on a project. A branch provisions its own Postgres instance, so it is billable on paid plans.
Supabase: Create Edge Function
Create an Edge Function from inline source (the JSON body variant of the create endpoint). The function goes live once deployed.
Supabase: Create Project
Create a new Supabase project in an organization. Billable on paid plans. A new project on a Pro org starts accruing compute charges.
Supabase: Create Secrets
Bulk-create or overwrite Edge Function secrets. An existing secret with the same name is replaced.
Supabase: Delete API Key
DESTRUCTIVE: permanently revokes an API key. Every client still presenting it starts getting 401s immediately.
Supabase: Delete Branch
DESTRUCTIVE: deletes a preview branch and the branch database behind it. Any data written only on the branch is lost.
Supabase: Delete Edge Function
DESTRUCTIVE: permanently removes an Edge Function and its deployed source. Callers of its URL start getting 404s.
Supabase: Delete Project
DESTRUCTIVE: permanently deletes the project and its database. The data is not recoverable through the API; take a backup first.
Supabase: Delete Secrets
DESTRUCTIVE: permanently removes the named Edge Function secrets. Functions reading them start failing on the next invocation.
Supabase: Enable Database Webhooks
[Beta] Enable Database Webhooks (the supabase_functions schema) on the project.
Supabase: Merge Branch
Merge a preview branch's migrations into its parent project. This applies schema changes to production. Review the diff first.
Supabase: Pause Project
Pause a project. The database goes offline and every API/Data endpoint for it stops answering until it is restored from the dashboard. Disruptive, but reversible.
Supabase: Push Branch
Push pending migrations to a preview branch. Returns the workflow run id to poll.
Supabase: Reset Branch
DESTRUCTIVE: wipes the preview branch database and re-runs its migrations from scratch. All data on the branch is discarded.
Supabase: Restart Project
Restart a project's services. Causes a short outage while it comes back up.
Supabase: Run SQL Query
[Beta] Run arbitrary SQL against the project database with full privileges. DESTRUCTIVE: the statement is whatever you send, so DROP/DELETE/TRUNCATE run for real and are not reversible. Prefer Supabase: Run Read-Only SQL Query for reads.
Supabase: Update Auth Config
Update the project's auth settings. The endpoint accepts ~200 documented fields, so this node takes the JSON body directly.
Supabase: Update Branch Config
Update a preview branch: rename it, relink its git branch, or change its persistence/review flags.
Supabase: Update Database Password
Rotate the project's Postgres password. Every client using the old connection string breaks until it is updated.
Supabase: Update PostgREST Config
Update the Data API config. Changing db_schema changes which schemas are publicly exposed through PostgREST. Review carefully.
Supabase: Update Postgres Config
Update tunable Postgres parameters. Some parameters require a database restart, which briefly interrupts connections.
Supabase: Update Project
Rename a project. The Management API exposes only `name` on this endpoint.
Supabase: Update SSL Enforcement
[Beta] Turn database SSL enforcement on or off. Turning it ON breaks any client connecting without SSL.
Supabase: Update Storage Config
Update the project's Storage config (file size limit, feature toggles).
Connecting Supabase takes one credential
Supabase authenticates the Management API with a personal access token, sent as a bearer credential. Create one in your Supabase account settings under Access Tokens. The token is prefixed sbp_ and is shown once at creation, so copy it before you close the dialog.
In the Supabase dashboard, open your account settings, go to Access Tokens, generate a new token, and copy it.
In Mattering Automations, open Connectors, click Add Connector, and choose Supabase.
Create a new credential, paste the token, and save. It is stored encrypted in Google Secret Manager.
Connect. All 69 Supabase nodes appear in the canvas palette.
Run Supabase: List Organizations as your first step. It takes no parameters, so a successful response confirms the token reaches your account.
Common uses for the Supabase MCP
Query a project database from a workflow
Run Read-Only SQL Query reads rows as the read-only Postgres role, so a report, a digest, or an agent answer can pull live data without any write risk. Get Database Context lists schemas and tables first, which is what stops an agent guessing at column names.
A standing security and performance review
Get Security Advisors surfaces tables with RLS disabled or missing policies and security-definer views. Get Performance Advisors finds unindexed foreign keys, unused indexes, and RLS init-plan problems. Run both on a schedule across every project and file the findings as a task.
Preview branch lifecycle without the dashboard
Create a branch when a feature starts, push migrations to it, read the diff against its parent, merge when the review passes, and delete the branch afterwards. The whole cycle is nodes, so it can hang off a code review or a project status change.
Project inventory and health watch
List Projects returns every project the token can reach with region, status, and Postgres version. Get Project Health checks auth, db, pooler, realtime, rest, and storage per project, so a scheduled sweep can flag anything unhealthy before a customer notices.
Edge Functions and their secrets
List, read, create, and delete Edge Functions, and manage the environment secrets they read. An agent can fetch a function's deployed source, reason about it, and create the replacement in the same run.
Schema changes with a record
Apply Migration runs a migration and records it in the project's migration history, and List Migrations reads back what has been applied. That keeps automated schema work visible instead of arriving as an untracked ad hoc statement.
Example: A weekly Supabase review that lands as a task
Built on the Automations canvas in a few minutes, or described in plain language to Matter and built for you.
Trigger: a schedule fires every Monday morning.
Supabase: List Projects returns every project the personal access token can reach.
A loop runs the next steps once per project.
Supabase: Get Security Advisors and Supabase: Get Performance Advisors return this week's lint findings.
Supabase: Get Project Health confirms each service is answering.
An AI step turns the raw findings into a short ranked summary.
Mattering Productivity: a task is created per project with the findings, so the fixes get owners and due dates instead of sitting in a dashboard nobody opens.
Supabase MCP questions, answered
Can this read and write my database tables?
Yes, through SQL rather than through the Data API. Run Read-Only SQL Query executes as the read-only Postgres role for safe reads, and Run SQL Query executes arbitrary SQL with full privileges for writes. Get Database Context and Get PostgREST OpenAPI Spec expose the schema first so a query is written against real table and column names. What this connector does not do is wrap the per-project Data API (PostgREST) at your-project-ref.supabase.co, because that endpoint uses a different key for every project. If you specifically need PostgREST request semantics, List API Keys returns the project key and the platform's HTTP Request node can call the endpoint directly.
Which Supabase API surface does the connector cover?
The Management API at api.supabase.com, which is the organization and project administration surface: projects, database SQL and migrations, preview branches, Edge Functions, secrets, API keys, project config, advisors, logs, and usage. The per-project surfaces, meaning the Data API, Auth (GoTrue), Storage objects, and Realtime, each live on your project's own host and use per-project keys, so they are out of scope here. List Storage Buckets is the one place the two meet: it names a project's buckets, while object-level operations belong to the per-project Storage API.
Does this work with Claude, ChatGPT, or other AI assistants?
Yes. Mattering exposes these nodes over MCP, an open protocol for connecting AI assistants to tools, so any MCP-capable assistant, including Claude and ChatGPT, can connect to your workspace and work with Supabase through them. Matter, the assistant built into the platform, uses the same nodes natively, but it is never the only agent that can.
What credential does the connector use?
A Supabase personal access token, created in your Supabase account settings and sent as a bearer credential. It is stored encrypted in Google Secret Manager. One token reaches every organization and project your Supabase user can see, and it carries exactly your permissions, so an automation can never do something in Supabase that you could not do yourself.
Can an agent delete a project or drop a table?
It can, which is why the risky nodes are labelled. Seven nodes are marked destructive in the palette: Delete Project, Delete Branch, Reset Branch, Delete Secrets, Delete API Key, Delete Edge Function, and Run SQL Query. Run SQL Query is on that list because it runs the statement it is given with full privileges, so a DROP or a TRUNCATE runs for real and is not reversible. For anything read-shaped, use Run Read-Only SQL Query, where writes are rejected by Postgres itself rather than by us.
Do any nodes return secret material?
Three do. List API Keys with reveal set to true returns the project's key values, List Secrets returns Edge Function environment variables and their values, and Update Database Password returns the result of rotating the Postgres password. Treat those node outputs as secrets: do not pipe them into a task comment, a message, or a stored artifact, and route them straight into the step that needs them.
Does it work on the Supabase free plan?
Reading does. A free plan account can issue a personal access token and call the Management API, so the entire read surface, including advisors, health, logs, and read-only SQL, works at no cost. Creating projects and preview branches depends on your Supabase plan and its limits, so those nodes can return a plan or quota error on a free account. That is Supabase answering, not the connector failing.
What is deliberately not included?
A few things, on purpose. The multipart Edge Function deploy endpoint needs binary form uploads, so inline function creation covers that ground instead. The OAuth authorize and token endpoints are browser redirect flows rather than automatable calls. Just-in-time database access issues short-lived human-in-the-loop credentials. Triggering backup restores, point-in-time recovery, Postgres upgrades, and read replica changes is left to the dashboard, though the read side is here: List Backups, List Restore Versions, Get Upgrade Eligibility, and Get Upgrade Status let a workflow watch all of it. Every node also accepts an extra query object, so a documented filter that is not individually typed stays reachable.
Put Supabase to work inside your workspace
Connect once, then use every node in visual automations and AI agent workflows across the Mattering platform.
All product names, logos, and brands are property of their respective owners and are used for identification purposes only. Use of these names, logos, and brands does not imply endorsement or affiliation. Supabase is a product of its respective owner; Mattering is an independent platform.