Use Supabase with AI via MCP
Supabase bundles database, authentication and storage into a backend platform built on PostgreSQL. The official MCP server opens that environment up to CompanyGPT – including the option to restrict access to reading only.
What is Supabase?
Supabase is a development platform that extends a managed PostgreSQL database with the building blocks applications typically need: authentication, file storage, automatically generated APIs, realtime subscriptions and edge functions. The platform is open source; besides the hosted offering it can also be run on your own infrastructure.
Because Supabase holds both the structure of an application and its data, the platform is interesting for AI agents in two roles: as a reference on tables, relationships and migrations for the engineering team – and, with the right permissions, as a data source for business analysis. Both call for careful scoping, which Supabase supports through its MCP access.
Connection at a Glance
- MCP server
- Official (Supabase), remote – labelled beta by Supabase
- Transport
- Streamable HTTP
- Authentication
- OAuth with dynamic client registration or personal access token
- Access control
- Read-only mode via query parameter ?read_only=true (read-only Postgres role)
- Operating model
- SaaS (Supabase Cloud); platform can also be self-hosted
How to Connect Supabase to CompanyGPT
Supabase operates an official MCP server at mcp.supabase.com/mcp, which Supabase itself labels as beta. Transport is streamable HTTP, and CompanyGPT connects to the endpoint directly.
Sign-in runs via OAuth with dynamic client registration (DCR) using the Supabase account; alternatively, a personal access token can be stored. What matters most for enterprise use is read-only mode: it is not an OAuth scope but is activated through the query parameter ?read_only=true on the endpoint URL. Supabase then connects using a read-only Postgres role – the agent can query schemas, project information and data, but change nothing. For most analysis and lookup scenarios we recommend exactly that setup – write access stays deliberately with the engineering team.
Access can additionally be limited to individual Supabase projects, keeping production and development environments cleanly separated. In CompanyGPT, your administrators control via roles and groups who may use the integration; typically engineering gets the full connection while business departments work with a read-only agent.
Typical Use Cases
How AI agents in CompanyGPT work with Supabase
Have the data model explained
New developers ask how a project's tables and relationships are structured and get a clear overview instead of digging through scattered migration files.
Analysis without SQL skills
With a read-only connection, the agent answers business questions about inventory or usage figures straight from the database – no query writing required.
Project overview for the team
Ahead of a release, the agent compiles which projects exist, what state they are in and which schema changes happened most recently.
Frequently Asked Questions
Supabase and AI – the most important answers
Does Supabase have an official MCP server?
Yes. Supabase provides an official MCP server at mcp.supabase.com/mcp, addressed via streamable HTTP. Supabase itself labels it as beta.
Can access be limited to reading only?
Yes. Read-only mode is activated through the query parameter ?read_only=true on the endpoint URL – so it is not an OAuth scope. Supabase then uses a read-only Postgres role: the agent can query structures and data but make no changes. For analysis scenarios this is our recommendation.
How do we connect Supabase to CompanyGPT?
The connection is registered as an MCP integration in your CompanyGPT instance; sign-in happens via OAuth with dynamic client registration using the Supabase account, or alternatively with a personal access token. Your administrators then release the integration to the intended roles.
Can we separate production and development data?
Yes. Access can be limited to specific Supabase projects. An agent can therefore work with a development environment only, leaving production data untouched.
How should we assess data protection?
CompanyGPT runs in your own cloud tenant and talks directly to the Supabase endpoint. What an agent may retrieve at all is governed by read-only mode, the project selection and the role assignment in CompanyGPT.
Supabase and Your AI – GDPR-Compliant with CompanyGPT
CompanyGPT is the enterprise AI assistant in your own cloud tenant: all relevant AI models, your company data and integrations like Supabase – centrally managed, with roles and permissions. We set up the connection together with you.
Supabase is a trademark of its respective owner (Supabase Inc.). Its mention describes compatibility and does not imply any partnership or endorsement. Availability and scope of the connection depend on the respective vendor.