Lists Supabase projects, runs SQL, applies migrations, and searches the docs.

How it works

Foe: Vault Serpent, data, accounts and payments.

Foes

  • Vault Serpent

Party · Context

  • PaladinYour agent100/100
  1. Vault Serpent

    The Vault Serpent blocks the way.

    What really happensIt stands for data, accounts and payments.

    Paladin: Context 100/100.

  2. Venom

    The serpent's bite seeps venom.

    What really happensA careless change to data or payments keeps doing harm until it is caught.

    Paladin takes 8. Paladin: Context 92/100. Paladin: Poison.

  3. Supabase MCP Server

    The Supabase orb opens a portal and waits for you to sign in.

    What really happensThe hosted server is https://mcp.supabase.com/mcp. Auth is Supabase OAuth, not a personal access token.

    Vault Serpent takes 29.

  4. Supabase MCP Server

    The orb lists tables, migrations, and the docs that match the question.

    What really happensTools include list_tables, list_migrations, get_advisors, and search_docs. Add project_ref to stay on one project.

    Vault Serpent takes 13.

  5. Venom

    The Vault Serpent uses Venom.

    Paladin takes 8. Paladin: Context 84/100.

  6. Supabase MCP Server

    SQL or a migration strikes the vault and the schema shifts.

    What really happensexecute_sql runs queries. apply_migration applies a migration. read_only=true blocks writes if you set it on the URL.

    Vault Serpent takes 32.

  7. Supabase MCP Server

    The Vault Serpent drops a schema map, or a change you approved.

    What really happensYou get project data, generated TypeScript types, or a migration. Storage tools stay off unless you enable them.

    Vault Serpent takes 26. Vault Serpent falls.

  8. Victory

    The Vault Serpent falls.

Learn this spell

Claude Code

claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp"

Codex

codex mcp add supabase --url "https://mcp.supabase.com/mcp"
codex mcp login supabase

Notes

Hosted at https://mcp.supabase.com/mcp. Sign in with Supabase OAuth. A personal access token is not required. Add ?project_ref= to stay on one project, ?read_only=true to block writes, or ?features= to limit tool groups. execute_sql and apply_migration can change data. Storage tools are off by default. Local Supabase CLI uses http://localhost:54321/mcp. Connecting an agent exposes that project's data.

Records

Recorded use2root sessions
Test recoveries1 of 1sessions with a failing test

Curator's machine: macOS 27.0.1 · Apple Silicon (arm64), read when these stats were published. Session logs do not record the OS.

Sessions per month

202026-09: 2 sessions2026-09
View data
Sessions per month
MonthSessions
2026-092

Harness

Codex: 1 sessionOMP: 1 session
  • Codex1 (50%)Version 0.153.0-alpha.5
  • OMP1 (50%)Version not in its logs; 18.8.3 installed when published
View data
Sessions by harness
HarnessSessionsVersion
Codex1Version 0.153.0-alpha.5
OMP1Version not in its logs; 18.8.3 installed when published

Often used with

View data
Spells often used with Supabase MCP Server
ItemSessions
Matt Pocock TDD2
Supabase Postgres Best Practices2

What a recovery means

A failed test was followed by a passing test of the same runner family in one session. It does not prove this spell caused the fix.

First recorded: . Most recent: .