This server has three tools but suffers from critical quality gaps. Tool naming partially follows verb_noun convention, but descriptions are generic and lack sufficient detail for LLM selection. Critically, tool input schemas appear incomplete or inferred from parameter lists rather than formally defined JSON Schema. The configure_supabase_instance tool accepts sensitive credentials as parameters (violating secret-injection pattern), and there is no evidence of structured output schemas, error categorization, or recovery guidance. The add() utility tool is trivial and does not justify inclusion. The codebase shows OAuth infrastructure and Supabase integration setup, but the actual tool implementation details in MySupabaseMcpAgent.ts are truncated in the source provided, making full schema validation impossible.

• Move Supabase credentials (URLs, keys) out of tool parameters. Accept only a session_name or config_id. Inject credentials server-side via environment variables or a secure config store. Example: configure_supabase_instance(session_name='prod', instance_url='...') → error 'Use environment variables'. Better: remove configure_supabase_instance entirely and read from CF_SUPABASE_* env vars on server startup.
• Document output schema for all tools. Add a 'Returns' section to each description. Example for list_tables: 'Returns: [{name: string, schema: string, row_count: number}], empty array if no tables. Sorted by name.'
• Expand descriptions to 80 - 150 chars. Example: 'configure_supabase_instance → Establishes a Supabase database connection using provided credentials. Call this once before any query operations. Returns success status and available tables count.' Example: 'list_tables → Enumerates all public and accessible tables in the current Supabase database. Call this first to discover schema before querying data. Returns list of table names with row counts.'
• Add error handling guidance to each tool description. Example: 'configure_supabase_instance: If URL is invalid (not https://[project].supabase.co), you will receive an error, fix the URL and retry. If the key is wrong, you will need a new key from your Supabase dashboard.'
• Remove the trivial 'add' tool. It serves no domain purpose in a Supabase server.
• For configure_supabase_instance parameter descriptions, clarify: 'supabaseAnonKey: Public key for client-side queries (read/auth operations). supabaseServiceKey: Private key for admin operations (optional, required for write/delete). Only provide serviceKey if the agent needs to modify data.'