Loading ToolBench
MCP Server for self-hosted Supabase instances
Server has 21 tools with basic schemas and descriptions, but significant quality gaps limit production readiness. Most tools have descriptions (good), but many lack parameter descriptions or have vague wording. Schemas are present but minimal, most tools accept empty objects or single parameters with sparse documentation. Critical security issue: tools expose API keys (get_anon_key, get_service_key) as tool outputs, violating secret-injection pattern. Destructive tools (delete_auth_user, create_auth_user) lack confirmation/dry-run patterns. Error handling is minimal, no recovery guidance or actionable error messages visible in tool definitions.
Applies a SQL migration script and records it in the supabase_migrations.schema_migrations table within a transaction.
Creates a new user directly in auth.users. WARNING: Requires plain password, insecure. Use with extreme caution.
Deletes a user from auth.users by their ID. Requires service_role key and direct DB connection.
Executes an arbitrary SQL query against the database, using direct database connection when available or RPC function as fallback.
Generates TypeScript types from the database schema using the Supabase CLI (`supabase gen types`) and downloads the file to the specified absolute path. The tool returns the current platform (win32, darwin, linux) to help with path formatting. Requires DATABASE_URL configuration and Supabase CLI installed.
CRITICAL: get_anon_key and get_service_key expose API credentials as tool outputs. Credentials must never appear in responses, they enter LLM context and risk logging/echoing to users. Use server-side secret injection only.
Destructive tools (delete_auth_user, create_auth_user) lack confirmation/dry-run patterns. Agents can irreversibly delete users or create accounts without safeguards. Implement confirmation_required or dry_run parameter.
create_auth_user description warns 'Requires plain password, insecure' but provides no guidance on what to do instead. Error handling and recovery paths are absent. Add actionable guidance: 'Use Supabase Auth API for secure signup instead.'
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2025-06-18+ | v2 |
Returns the configured Supabase anon key for this server.
Retrieves details for a specific user from auth.users by their ID.
Retrieves information about active database connections from pg_stat_activity.
Retrieves database statistics and metrics.
Returns the configured Supabase project URL for this server.
Returns the configured Supabase service role key for this server.
Lists all users from the auth.users table with their metadata.
Lists all installed PostgreSQL extensions in the database.
Lists all migrations recorded in the supabase_migrations.schema_migrations table.
Lists all realtime publications configured in the database.
Lists all storage buckets in the Supabase project.
Lists all objects in a specific storage bucket.
Lists all tables in the database with their schema information.
Rebuilds database hooks/triggers.
Updates an existing user in auth.users.
Verifies the JWT secret configuration.
execute_sql accepts arbitrary SQL with minimal validation. No input sanitization visible against SQL injection. LLMs can be tricked into passing malicious payloads. Add parameterized query support and validate against dangerous patterns (DROP, TRUNCATE, etc.).
Most tools return empty input schemas (no parameters) or single parameters with minimal descriptions. Parameter descriptions should explain format, constraints, and valid values. E.g., bucket_id in list_storage_objects lacks format/length guidance.