// SCAN REPORT

Supabase

29 tools. 12 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 12 Aug 2026

12 can modify or destroy data

17 read-only

29 tools total

Verified publisher · catalogue entry checked 10/06/2026 · full schemas captured for 27 of 29 tools

How to control Supabase ↓

TOOL MAP

What Supabase exposes to your agents

Read (17) Write / Execute (8) Destructive / Financial (4)

Running more than one server? Check your whole stack →

CONTEXT-WINDOW COST

What Supabase costs in tokens

2,561 tokens of tool definitions, loaded on every request

1.3% of a 200k context window

425 heaviest tool: search_docs

Full per-tool breakdown → Model it in the token calculator →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Supabase tools

Financial · Medium confirm_cost This tool is a precursor step to financial commitment — it confirms user acknowledgment of costs associated with paid Supabase resources (projects/branches). Destructive · High delete_branch Deletion operations are inherently destructive and cannot be undone. Destructive · High reset_branch This tool irreversibly deletes or overwrites data (untracked data and schema changes). Destructive · High pause_project Pausing a project takes it offline, making it unavailable to users and applications.

12 of Supabase's 29 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Supabase

PolicyLayer is an MCP gateway — it sits between your AI agents and Supabase, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "confirm_cost": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "delete_branch": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "create_branch": {
    "limits": [
      {
        "counter": "create_branch_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "generate_typescript_types": {
    "limits": [
      {
        "counter": "generate_typescript_types_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Supabase — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON SUPABASE →

Instant setup, no code required.

FULL CATALOGUE

All 29 Supabase tools

FINANCIAL 1 tools

Financial confirm_cost Ask the user to confirm their understanding of the cost of creating a new project or branch. Call get_cost fir

DESTRUCTIVE 3 tools

Destructive delete_branch Deletes a development branch. Destructive pause_project Pauses a Supabase project. Destructive reset_branch Resets migrations of a development branch. Any untracked data or schema changes will be lost.

EXECUTE 5 tools

Execute apply_migration Applies a migration to the database. Use this when executing DDL operations. Do not hardcode references to gen Execute deploy_edge_function Deploys an Edge Function to a Supabase project. If the function already exists, this will create a new version Execute execute_sql Executes raw SQL in the Postgres database. Use apply_migration instead for DDL operations. This may return unt Execute merge_branch Merges migrations and edge functions from a development branch to production. Execute rebase_branch Rebases a development branch on production. This will effectively run any newer migrations from production ont

WRITE 3 tools

Write create_branch Creates a development branch on a Supabase project. This will apply all migrations from the main project to a Write create_project Creates a new Supabase project. Always ask the user which organization to create the project in. The project c Write restore_project Restores a Supabase project.

READ 17 tools

Read generate_typescript_types Generates TypeScript types for a project. Read get_advisors Gets a list of advisory notices for the Supabase project. Use this to check for security vulnerabilities or pe Read get_cost Gets the cost of creating a new project or branch. Never assume organization as costs can be different for eac Read get_edge_function Retrieves file contents for an Edge Function in a Supabase project. Read get_logs Gets logs for a Supabase project by service type. Use this to help debug problems with your app. This will ret Read get_organization Gets details for an organization. Includes subscription plan. Read get_project Gets details for a Supabase project. Read get_project_url Gets the API URL for a project. Read get_publishable_keys Gets all publishable API keys for a project, including legacy anon keys (JWT-based) and modern publishable key Read list_branches Lists all development branches of a Supabase project. This will return branch details including status which y Read list_edge_functions Lists all Edge Functions in a Supabase project. Read list_extensions Lists all extensions in the database. Read list_migrations Lists all migrations in the database. Read list_organizations Lists all organizations that the user is a member of. Read list_projects Lists all Supabase projects for the user. Use this to help discover the project ID of the project that the use Read list_tables Lists all tables in one or more schemas. Read search_docs Search the Supabase documentation using GraphQL. Must be a valid GraphQL query. You should default to calling

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Supabase

Can an AI agent move money through the Supabase MCP server? +

Yes. The Supabase server exposes 1 financial tools including confirm_cost. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Supabase MCP server? +

Yes. The Supabase server exposes 3 destructive tools including delete_branch, pause_project, reset_branch. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Supabase? +

The Supabase server has 3 write tools including create_branch, create_project, restore_project. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Supabase.

How many tools does the Supabase MCP server expose? +

29 tools across 4 categories: Destructive, Execute, Read, Write. 17 are read-only. 12 can modify, create, or delete data.

How do I enforce a policy on Supabase? +

Register the Supabase MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Supabase tool call.

Deterministic rules across all 29 Supabase tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON SUPABASE →

Instant setup, no code required.

29 Supabase tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Supabase's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →