How do project scope and read-only mode differ?
Use project_ref to point the server at one Supabase project. Use read_only=true when the agent only needs to inspect data. Set both for a read-only session in one project.
Use Supabase MCP to inspect the schema of the selected development project. If the uncertainty is which client method to call, use Context7 MCP to check the library documentation for your version before touching the database.
- Copy the project reference from the development project you intend to inspect. Connect the client with both options set.
- Inspect one known table and compare the result in Dashboard. Use the setup guide for client-specific configuration.
Identify the service you are connecting to
Supabase’s official hosted MCP endpoint is mcp.supabase.com/mcp. The official documentation describes its configuration and authentication. Other packages using the same product name can have different publishers, transports and capabilities, so source identity matters as much as a listing title.
Limit the connection to the task
The configuration panel supports a selected project, read-only mode and feature groups. Without a project selection, all accessible projects are in scope. A schema-inspection task and a migration task need different capabilities; choosing scope first makes that distinction explicit.
Authentication follows the client
Hosted interactive connections normally open a browser sign-in flow. Some clients prompt automatically; others require an explicit authentication step. The selected client’s instructions determine that process. A configuration file alone does not establish that the account is authenticated.
Confirm the project before relying on the tools
A connected status establishes that the client reached the server. A harmless description of the expected project or schema then helps confirm the intended access. Checking available tools also catches a missing feature group before a more involved task begins.
A few more details
Can the connection be read-only?
The official setup includes read-only mode, alongside project scope and feature-group selection.
Do all interactive clients need a personal access token?
The hosted service normally supports browser authentication. Special client and CI cases have separate manual authentication instructions.
Sources & maker notes
This guide is based on the cited documentation and maker sources. vibeforthat has not run an independent installation or end-to-end product test for this article.