Supabase Adds MCP Server Block to Customer Apps.

The MCP Server block lets developers give a Supabase app its own Model Context Protocol server. Customers can then use the app from ChatGPT, Claude or another MCP client, signing in with the account they already use.

Each tool call runs as the signed-in customer. Existing Row-Level Security policies decide which records and actions that customer’s agent can reach, rather than giving the agent a service role key with broader access.

Supabase introduced the block in its launch blog post, alongside a demo app called Sizzle. The demo used Supabase Auth, Database and Storage, with MCP tools that could list a customer’s products and generate video adverts through an external service.

Developers install the block with a single npx command. It copies an Edge Function into supabase/functions/mcp, including the MCP handler, authentication middleware and a whoami tool for checking the caller’s identity.

The generated server uses the official MCP TypeScript SDK. Supabase Auth handles the OAuth flow, while helpers from @supabase/server provide each tool with a Supabase client configured for the signed-in user.

The code is copied into the project, so developers own it and can change the server rather than configuring a hosted black box. Each tool can use a plain database query under the caller’s identity. Existing RLS rules continue to control access at the database layer.

MCP tools expose specific app actions to an agent. In the Sizzle example, a customer planning a campaign could ask an agent to find one of their products, request a video advert and use the result in the same conversation as their other connected tools.

The same structure applies to actions backed by Supabase Database, Storage or external services. Developers choose which actions become tools and write the code for each one. Customers authenticate through Supabase Auth before those tools run.

What is Supabase MCP Server block?

It is installable server code that exposes an app’s actions as Model Context Protocol tools. Customers can use those tools through ChatGPT, Claude or another MCP client after signing in with their existing account.

How does the MCP Server block protect customer data?

Every tool call runs as the signed-in user. Supabase Auth handles authentication, and existing Row-Level Security policies determine which data and actions the user’s agent can access.

Which Supabase plan includes the MCP Server block?

The announcement does not state which plans include the block or whether separate pricing applies. It provides an installation command through the Supabase Library.