Supabase MCP integration for AI agents.
Connect AI agents to Supabase through 22 structured actions, including download storage object, create project api key, delete project api key, and generate…
- ACTION CONTRACTS
- 22
- AUTHENTICATION
- OAuth 2.0 + API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Supabase integration exposes
The Supabase Agent App exposes 22 provider-backed actions for developer tools, data, and storage work. Its current contract lets an authorized agent download an object from supabase storage into local transit file storage, create a publishable or secret api key for a supabase project, and delete a supabase project api key. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses OAuth 2.0 and API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Supabase account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Supabase capabilities.
Showing 12 of 22 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
download_storage_objectREADDownload an object from Supabase Storage into local transit file storage.
INPUTS: projectRef / bucketId / objectPath / apiKeyId / fileName
create_project_api_keyWRITECreate a publishable or secret API key for a Supabase project.
INPUTS: projectRef / name / type / description / reveal
delete_project_api_keyHIGH IMPACTDelete a Supabase project API key.
INPUTS: projectRef / apiKeyId / reveal / wasCompromised / reason
generate_typescript_typesREVIEWGenerate TypeScript database types for a Supabase project.
INPUTS: projectRef / includedSchemas
delete_project_secretsHIGH IMPACTBulk delete secrets from a Supabase project.
INPUTS: projectRef / names
get_edge_functionREADGet metadata for one Supabase Edge Function by slug.
INPUTS: projectRef / functionSlug
get_organizationREADGet details for a Supabase organization by slug.
INPUTS: organizationSlug
get_projectREADGet detailed metadata for a Supabase project by project ref.
INPUTS: projectRef
get_project_api_keyREADGet one API key record from a Supabase project.
INPUTS: projectRef / apiKeyId / reveal
get_project_healthREADCheck health for selected services in a Supabase project.
INPUTS: projectRef / services / timeoutMs
list_available_regionsREADList Supabase regions available for creating projects in an organization.
INPUTS: organizationSlug / continent / desiredInstanceSize
list_edge_functionsREADList Edge Functions in a Supabase project.
INPUTS: projectRef
INPUT CONTRACTS
Know what the action needs before it runs.
download_storage_object
projectRefREQUIRED- The lowercase Supabase project reference used by the project API hostname.
bucketIdREQUIRED- The Storage bucket identifier.
objectPathREQUIRED- The complete object path inside the bucket, without a leading slash.
apiKeyIdOPTIONAL- An optional secret or legacy service_role API key ID. When omitted, the first revealed elevated key is used.
fileNameOPTIONAL- An optional filename override for the local transit file.
create_project_api_key
projectRefREQUIRED- The Supabase project reference, for example 'abcdefghijklmnopqrst'.
nameREQUIRED- The API key name. Use lowercase letters, numbers, and underscores; it must start with a lowercase letter or underscore.
typeREQUIRED- The type of API key to create.
descriptionOPTIONAL- The optional description for the API key.
revealOPTIONAL- Whether to reveal the full API key value in the response.
delete_project_api_key
projectRefREQUIRED- The Supabase project reference, for example 'abcdefghijklmnopqrst'.
apiKeyIdREQUIRED- The unique identifier of the project API key.
revealOPTIONAL- Whether Supabase should reveal key data in the delete response.
wasCompromisedOPTIONAL- Whether the key is being deleted because it was compromised.
reasonOPTIONAL- Optional deletion reason sent to Supabase.
generate_typescript_types
projectRefREQUIRED- The Supabase project reference, for example 'abcdefghijklmnopqrst'.
includedSchemasOPTIONAL- Database schemas to include, such as public or auth.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Download Storage Object
Download an object from Supabase Storage into local transit file storage. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
download_storage_objectControl Create Project Api Key
Create a publishable or secret API key for a Supabase project. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_project_api_keyVerify with Get Edge Function
Get metadata for one Supabase Edge Function by slug. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_edge_functionSAFETY BOUNDARY
Operate Supabase with explicit limits
- Authorize Supabase with OAuth 2.0 and API key and grant only the provider access required by the selected actions.
- 5 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_project_api_key` and `delete_project_secrets` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `secrets:write`, `storage:read`, `secrets:read`, and `database:read`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the Supabase task completed successfully.
CONNECTION MODEL
OAuth 2.0 + API key
Supabase personal access token used with the Authorization Bearer header. Create it in the Supabase dashboard: https://supabase.com/dashboard/account/tokens.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 16
- WRITE SIGNALS
- 3
- HIGH IMPACT
- 2
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Supabase.