Loading ToolBench
MCP (Model Context Protocol) server for self-hosted Supabase instances. Allows AI assistants to interact with your self-hosted Supabase database.
This server has 27 tools with significant quality gaps. Most tools lack parameter descriptions entirely, only apply_migration shows a complete input schema with descriptions. Descriptions are present but often generic (e.g., 'Executes arbitrary SQL queries' for execute_sql). No output schemas are documented. Critical security issue: tools expose secrets (get_anon_key, get_service_key) as read-only outputs, violating secret-injection pattern. Tool names are verb-noun compliant but lack clarity on destructive operations. Error handling is minimal, no recovery guidance or actionable error messages visible in source. Composition is poor: execute_sql is dangerously broad; no idempotency guarantees; no pagination for list_* tools.
Applies a SQL migration script and records it in the supabase_migrations.schema_migrations table within a transaction. Requires direct database connection (DATABASE_URL).
Connects to a specific Supabase instance in Alibaba Cloud
Creates a new authentication user
Deletes an authentication user
Disconnects from the currently connected Supabase instance
Executes arbitrary SQL queries against the Supabase database
Generates TypeScript type definitions from the Supabase schema
execute_sql tool has no visible input schema and accepts arbitrary SQL, creating SQL injection risk and making it impossible for LLMs to understand valid inputs. This violates the constrained-input and tool-gateway patterns.
Tools expose secrets (get_anon_key, get_service_key) as readable outputs. Secrets in tool responses enter LLM context and risk being logged or echoed to users, violating secret-injection pattern.
25 of 27 tools lack documented input/output schemas. Only apply_migration has a complete schema. Without schemas, LLMs cannot validate inputs or plan downstream calls. This violates the tool and response-shaper patterns.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 34 | 2025-06-18+ | v2 |
Returns the Supabase anonymous key
Retrieves details for a specific authentication user
Returns information about the currently connected Supabase instance
Retrieves current database connection statistics
Retrieves database statistics and metrics
Returns the Supabase project URL
Returns the Supabase service role key
Installs the execute_sql RPC function for SQL execution
Lists all Supabase instances available in Alibaba Cloud
Lists all authentication users in the Supabase Auth system
Lists all PostgreSQL extensions enabled in the database
Lists all migrations recorded in the supabase_migrations.schema_migrations table
Lists all Realtime publications configured in the database
Lists all storage buckets in Supabase Storage
Lists objects in a specific storage bucket
Lists all tables in the Supabase database
Rebuilds database hooks/triggers
Searches Supabase documentation
Updates an existing authentication user
Verifies the JWT secret configuration
No parameter descriptions visible for most tools. LLMs cannot infer what parameters mean, e.g., does 'version' in apply_migration accept '20240101' or 'v1.0'? This violates tool-description pattern.
No pagination parameters (limit, offset, page) visible on list_* tools. Returning unbounded results risks context window exhaustion and violates paginated-result pattern.