Read-only Supabase queries in the IDE, under three safety tiers

Who it is for

This guide is for people still using this community Query MCP who want to run SQL safely in an IDE or call the Supabase Management API. The official main path is to install supabase-mcp-server with pipx and attach it over stdio to Cursor, Windsurf, or Cline. The author has stated it is no longer actively maintained and points to the official successor repository. If you want a long-term option, look at the successor first; do not treat this repository as the only entry.

Successor repository:

https://github.com/supabase-community/supabase-mcp

It fits people who first run SQL in read-only mode. The evidence states you can control read-only / read-write, do risk level assessment at runtime, and sort SQL into safe, write, and destructive. It is not suitable to start with destructive statements, and not suitable to treat unnamed tool function names as proven interfaces.

First try in 3 minutes

The official recommended install is below. Prerequisite: this machine can run pipx. Config location is an MCP client that supports stdio. Do not treat uv pip install as another preferred install at the same time.

pipx install supabase-mcp-server

This repository page:

https://github.com/alexander-zuev/supabase-mcp-server

First try: use the official read-only SQL capability. Put execution mode on read-only and run a query that does not change data. Success signal: query results come back, not a block by the safety policy. Read-only still connects to your Supabase/Postgres; do not read it as no network and no database access. The server itself uses asyncpg and no longer depends on local PostgreSQL development libraries; you still need PostgreSQL only if you run a local Supabase instance.

Use cases

Case 1: Read-only data query. That maps to Control read-only ... SQL query execution. The evidence does not write a tool function name or sample SQL; do not invent them. On success you can see results, possibly with a risk rating.

Case 2: Change schema or call Management API / Auth Admin SDK. That maps to manage schema changes, call the Supabase Management API, use Auth Admin SDK. This is a write: before the call, confirm you are in write mode and see whether the three-tier safety marks it safe, write, or destructive. Success signal: the change is accepted by the safety controls. If there is no official undo path, do not describe it as casually reversible.

Limits

The author no longer maintains it actively. Read-only/read-write modes and the three safety tiers are built-in controls, not zero risk. The evidence does not give a concrete tool roster, secret variable names, or uninstall steps. The uv install is only another package-manager command in the docs; do not put it beside the pipx main path.