Data · MCP Server
Supabase MCP: setup, permissions and security risks
The Supabase MCP server gives an agent database, auth, and storage for a live project. That is useful, and it is also a set of real capabilities pointed at a real system. Here is what it exposes, why it is worth governing, and the policy to put in front of it.
What the server hands your agent
SQL execution against the project database, plus in many setups auth administration, storage, and edge function management.
Why it is worth governing
- Servers configured with a service-role key bypass row-level security entirely, which means the agent sees every tenant.
- Auth administration means an agent can, in principle, change who has access to your application.
- Project settings and function environments are where the keys themselves live.
Tag what the tools actually do
Prismor tags every tool by behavior rather than by name, so rules survive a server adding tools you have never seen. A sensible starting map for Supabase:
| Tool pattern | Tags | Why |
|---|---|---|
| mcp__supabase__*sql* | private_datacritical_action | service-role SQL reads and writes everything |
| mcp__supabase__*auth* | critical_action | auth changes alter who can log in |
| mcp__supabase__*secret* | secrets_access | project secrets |
Patterns are illustrative globs. Run prismor tags list to see how your installed tools actually resolve.
The policy
Rules read as a sentence: a tag, then or with another tag, and what to do about it. Note the mode - start by watching, not blocking.
settings:
tool_tags:
enabled: true
mode: observe # switch to enforce once the log looks right
tags:
"mcp__supabase__*sql*": [private_data, critical_action]
"mcp__supabase__*auth*": [critical_action]
"mcp__supabase__*secret*": [secrets_access]
rules:
- "private_data then external_comms -> block"
- "untrusted_content then critical_action -> block"Putting Supabase behind the gateway
You do not change the Supabase server or how it is configured. Move your existing mcpServers block behind the Prismor gateway and point your agent at Prismor instead:
prismor mcp-gateway install # moves your .mcp.json servers behind the gateway
prismor mcp-gateway uninstall # restores the original, backup keptYour agent sees the same Supabase tools, namespaced as mcp__supabase__<tool>. Every call is evaluated against policy before it is forwarded, and every result is scanned as untrusted content before the model sees it.
Frequently asked questions
Is the Supabase MCP server safe to give an AI agent?
It is as safe as the credential behind it and the policy in front of it. The server itself is not the problem: the risk is that an agent can combine Supabase access with everything else in the session, with no record of what it did. Front it with a gateway that evaluates each call and logs the verdict.
Does Prismor replace the Supabase MCP server?
No. You keep running the same server, unchanged. Prismor aggregates it behind a single connector so your agent sees the same tools, namespaced as mcp__<server>__<tool>, with every call and every result passing through policy first.
Will this block work my team actually needs to do?
Not if you start in observe mode. Every call is recorded with the decision that would have applied, and nothing is blocked. You promote rules to enforce once the log shows the policy matches how your agents really work.
What about tool results, not just tool calls?
Results are scanned as untrusted content before the model sees them. A response carrying injected instructions or poisoned output is withheld and replaced with the reason, which matters most for servers that return text other people wrote.
One gateway for every MCP server
Supabase is one connector. The same policy covers the rest of them, plus the shell commands and file access your agents already have.
Other data servers
PostgreSQL
MongoDBSupabase is a trademark of its respective owner. Prismor is not affiliated with or endorsed by it. The Supabase MCP server is third-party software; Prismor governs it the same way it governs any MCP server, without modifying it.