Is the Supabase MCP server safe to give an AI agent?

It depends on how you run it. In its full-access configuration a single execute_sql can DROP, DELETE or TRUNCATE, and it can apply migrations, deploy edge functions and delete branches. Supabase recommends running it read-only and scoped to a single non-production project, which materially lowers the risk. Run against production with writes enabled, it is a high-blast-radius surface that warrants a human checkpoint.

Does the Supabase MCP server have a read-only mode?

Yes. A --read-only flag runs all queries as a read-only Postgres user and excludes mutating tools; a --project-ref flag scopes the server to one project; and --features limits which tool groups are enabled. Supabase documents these as recommended defaults and names prompt injection as the primary LLM-specific attack vector.

MCP field guide / Supabase

// mcp field guide · data / backend

Supabase MCP server

A Postgres-backed platform in one MCP: an agent can query, migrate, deploy edge functions, and manage projects. In its full-access mode a single execute_sql can DROP a table — but Supabase now ships read-only mode and project scoping as recommended defaults, which genuinely lower the risk. The honest read on both.

Maintainer: Supabase (official) Package: @supabase/mcp-server-supabase · mcp.supabase.com License: Apache-2.0

GUARD FIT · READ-ONLY + SCOPED

LOW

Run with --read-only + --project-ref on a non-prod project and the mutation path is already gone. A guard adds little on top.

GUARD FIT · FULL-ACCESS / WRITE MODE

STRONG

Arbitrary SQL (DROP/DELETE/TRUNCATE), migrations, branch deletes — high blast radius, often irreversible. A pre-commit human gate is the control.

Overall fit: STRONG in the default write-capable config; low when the built-in read-only controls are actually enabled.

What it is

The Supabase MCP server (@supabase/mcp-server-supabase, Apache-2.0, v0.10.0 as of Aug 2026) connects an agent/IDE to a developer's Supabase account. It runs locally (npx + a personal access token) or as a hosted remote at mcp.supabase.com/mcp (OAuth 2.1), and lets the model inspect tables, run SQL, apply migrations, generate types, read logs/advisors, deploy edge functions, and manage branches — under the developer's own permissions. Supabase is explicit that it's a developer-side tool, not to be handed to end users or pointed at production data.¹²

Tools by risk surface

Tier	Tools
read-only	`list_tables`, `list_migrations`, `execute_sql` (read-only when the flag is set), `query_logs`, `get_advisors`, `list_projects`, `generate_typescript_types`, `search_docs`, `list_branches`
mutating	`apply_migration`, `create_project`, `deploy_edge_function`, `update_storage_config`, `create_branch`, `merge_branch`, `rebase_branch`
destructive	`execute_sql` carrying `DROP`/`DELETE`/`TRUNCATE`/`ALTER … DROP`; `delete_branch`; `reset_branch`; `pause_project` (disruptive; reversible via `restore_project`)

Two honesty notes. (1) The single riskiest tool is execute_sql — the same tool is a harmless SELECT or a catastrophic DROP TABLE depending on the SQL, so risk must be read from the statement, not the tool name. (2) We did not find a delete_project tool in v0.10.0 (account tools are create / pause / restore); the realistic irreversible paths are destructive execute_sql, apply_migration, and delete_branch.

Built-in controls (they genuinely help)

Supabase added, and recommends, several guardrails — and using them meaningfully lowers the risk tier:

--read-only — runs all queries as a read-only Postgres user and excludes mutating tools.
--project-ref — scopes the server to one project, dropping account-level and cross-project reach.
--features — enables only named tool groups. All groups are enabled by default except storage (branching is on by default, but is experimental and requires a paid plan).
Documented prompt-injection guidance: Supabase names prompt injection "the primary attack vector unique to LLMs" (e.g., a support-ticket row carrying injected instructions), and wraps SQL results with a note telling the model not to follow embedded commands — while acknowledging that mitigation is imperfect.¹

Real use cases

Schema / migration work. An IDE agent inspects tables and applies migrations against a dev project.

Data exploration & debugging. Read SQL, query_logs, and get_advisors lints to diagnose an issue.

Full-stack scaffolding. Generate types, fetch project URL/keys, deploy an edge function from the assistant.

Where a human-approval guard fits

Read-only + scoped → low value. If you've enabled --read-only --project-ref against a non-production project, the mutation path is already removed; gating each read is friction. Credit where due — the built-in controls do real work here.

Full-access / write mode → strong. This is a write-capable database MCP, so the danger is ordinary SQL: one execute_sql can DROP/DELETE/TRUNCATE, and apply_migration/delete_branch compound it. A guard that classifies execute_sql by statement content (write / DDL / DROP / DELETE → destructive), shows the exact SQL in an impact diff, and holds destructive statements for a human is a finer control than the coarse all-or-nothing read-only switch.

The honest core: no external guard can "undo" a committed DROP TABLE — the guard's value is prevention at the gate, not rollback. It should surface which effects are irreversible before commit rather than imply they can be compensated. See compensation is not undo and the PostgreSQL profile for the same write-vs-read split.

Guard the destructive SQL, not the SELECTs

ChronoMCP reads risk from the statement — passing reads through and holding DROP/DELETE/migration/branch-delete for a human.

Read the quickstart → More MCP profiles

Sources

Supabase — official MCP docs (tools, --read-only/--project-ref/--features, prompt-injection guidance): supabase.com/docs/guides/getting-started/mcp
Official repo: github.com/supabase-community/supabase-mcp · npm: @supabase/mcp-server-supabase (v0.10.0)
Remote MCP (OAuth / hosted endpoint) announcement: supabase.com/blog/remote-mcp-server

Profiles describe third-party software from its public sources; ChronoMCP is not affiliated with Supabase. A few tool names shift across minor versions; risk groupings are our classification. Capabilities reflect sources current as of Aug 2026 — check the source links for the latest.