Loading ToolBench
Community Supabase MCP server that enables Cursor and Windsurf to end-to-end manage your Supabase project, execute SQL queries, and more.
Server has 12 tools with basic schemas and descriptions, but significant gaps limit production readiness. All tools have descriptions (10-200 chars, mostly adequate), and input schemas are present with type definitions. However, output schemas are undocumented, LLMs cannot predict return structures. Parameter descriptions exist but lack detail on constraints, formats, and valid ranges. Error handling is minimal; no recovery guidance or actionable error messages. Security concerns: live_dangerously and confirm_destructive_operation expose dangerous operations without sufficient safeguards. Tool composition is reasonable (single responsibilities), but naming could be clearer (e.g., 'send_management_api_request' vs 'call_management_api').
Call an Auth Admin method from Supabase Python SDK.
Execute a destructive operation after confirmation. Use this only after reviewing the risks with the user.
Execute PostgreSQL statements against your Supabase database.
Get Python SDK methods specification for Auth Admin.
Get the Supabase Management API specification.
List all database schemas with their sizes and table counts.
Output schemas undocumented. No tool documents what fields it returns, forcing LLMs to guess structure and plan downstream calls blindly.
Parameter constraints missing. 'limit' and 'offset' in retrieve_migrations lack min/max bounds; 'query' in execute_postgresql has no length or format guidance; 'method' in send_management_api_request lacks enum of valid HTTP methods.
Dangerous operations (live_dangerously, confirm_destructive_operation) lack proper safeguards. No dry-run support, no clear permission gates, no audit trail logging visible in code.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | <=2025-11-25 | v2 |
Get detailed table structure including columns, keys, and relationships.
List all tables, foreign tables, and views in a schema with their sizes, row counts, and metadata.
Toggle between safe and unsafe operation modes for API or Database services. This function controls the safety level for operations, allowing you to enable write operations for the database (INSERT, UPDATE, DELETE, schema changes) and enable state-changing operations for the Management API.
Retrieve logs from Supabase.
Retrieve a list of all migrations a user has from Supabase.
Execute a Supabase Management API request.
Error handling absent. No recovery guidance, no actionable error messages, no categorization of retryable vs fatal errors. LLMs cannot self-correct on failures.
Naming ambiguity: 'send_management_api_request' vs 'call_auth_admin_method', both invoke external APIs but with different semantics. Consolidate or clarify distinction in descriptions.