MCP tools reference
Every tool on the SupaHost MCP server, grouped by feature group, with arguments, what each returns, which are write tools, and how read-only mode changes the list.
This is the full list of tools the SupaHost MCP server offers. Which ones an agent sees depends on the token's scope, read-only mode and the features URL option (see The SupaHost MCP server). Tools that aren't listed here don't exist on SupaHost.
The project argument. With a project-scoped token, project tools have no project argument: they always act on the token's project. With a whole-instance token, every project tool takes an optional project (the project name). If you leave it out, the tool uses the project= value from the URL, if any.
Write tools are marked ✎. They aren't registered at all in read-only mode.
docs
| Tool | Arguments | Returns |
|---|---|---|
search_docs |
query, limit (1–10, default 5) |
Matching pages from Supabase's documentation: title, URL and content. SupaHost runs the open-source Supabase stack, so these mostly apply; check the SupaHost docs for differences. |
account (whole-instance tokens only)
| Tool | Arguments | Returns |
|---|---|---|
list_projects |
none | Each project's name, status, API URL and creation date. |
get_project |
project |
Status, API URL, created and ready times. |
create_project ✎ |
name, confirm_extra_cost |
Creates a project (2–30 characters: lowercase letters, numbers, -). It's ready in about a minute; poll get_project until the status is healthy. If the instance already has its plan's included projects, the call fails until it's repeated with confirm_extra_cost: true (each extra project costs $3/month), so the agent should ask you first. |
database
| Tool | Arguments | Returns |
|---|---|---|
list_tables |
schemas (default ["public"]) |
Tables with columns (type, nullable, default), primary keys, RLS enabled or not, estimated rows and foreign keys. |
list_extensions |
none | Available extensions, installed version and schema. pg_cron is reported as built in, with a note not to run create extension pg_cron. |
list_migrations |
none | Applied migrations (version, name) from supabase_migrations.schema_migrations, including any applied with the Supabase CLI. |
execute_sql ✎* |
query |
The result rows, wrapped in untrusted-data markers. Use it for queries and data changes. |
apply_migration ✎ |
name (snake_case, 1–80 characters), query |
Runs the DDL and records it as a migration in one transaction: if any statement fails, nothing is applied. Returns version (UTC timestamp YYYYMMDDHHMMSS) and name. |
* execute_sql stays available in read-only mode, but then runs as a read-only role, so Postgres rejects writes.
Both SQL tools handle one SupaHost quirk for you: if the SQL contains create extension pg_cron, that statement is skipped (it isn't needed and would fail) and the rest runs, with a note explaining how to use cron.schedule.
Example apply_migration call:
{
"name": "create_invoices",
"query": "create table public.invoices (\n id bigint generated always as identity primary key,\n owner_id uuid not null default auth.uid() references auth.users (id),\n number text not null,\n total numeric(12,2) not null,\n status text not null default 'draft'\n);\nalter table public.invoices enable row level security;\ncreate policy \"Owners manage their invoices\" on public.invoices\n for all to authenticated\n using ((select auth.uid()) = owner_id)\n with check ((select auth.uid()) = owner_id);"
}
debugging
| Tool | Arguments | Returns |
|---|---|---|
get_advisors |
none | Security findings in the public schema, or "No issues found." |
get_advisors runs three checks:
| Issue | Meaning |
|---|---|
rls_disabled |
A table is reachable through the Data API without Row Level Security. The detail includes the alter table ... enable row level security to run. |
rls_no_policies |
RLS is on but there are no policies, so the API can't read the table at all. |
function_search_path_mutable |
A security definer function has no fixed search_path. Add set search_path = ''. |
It doesn't cover performance advice or other Supabase advisor checks.
development
| Tool | Arguments | Returns |
|---|---|---|
get_project_url |
none | The project's API URL, to use as SUPABASE_URL. |
get_publishable_keys |
none | The anon key (type legacy). The service_role key is never returned. |
generate_typescript_types |
schemas (default ["public"]) |
TypeScript types for supabase-js (createClient<Database>()). |
functions
| Tool | Arguments | Returns |
|---|---|---|
list_edge_functions |
none | Each function's slug, URL, verify_jwt, version (latest), deployed_version (live), status (deploying, active, error), error and timestamps. |
get_edge_function |
function_slug |
The same plus the source files. |
get_edge_function_logs |
function_slug (optional), limit (1–500, default 100) |
Recent log entries, newest first: console output, boot errors, exceptions and request lines. |
deploy_edge_function ✎ |
name, files ([{ name, content }], must include index.ts), verify_jwt (optional), entrypoint_path (optional, must be index.ts) |
Returns straight away with status: "deploying", the new version and the URL. |
delete_edge_function ✎ |
function_slug |
Deletes the function; it stops serving within about a minute. |
After deploy_edge_function, poll list_edge_functions (it takes about a minute) until the function's status is active with deployed_version equal to the new version, or error with the build message. On an error, the previous version keeps serving. Limits: 50 files, 1 MB of source, 100 functions per project. See Deploying functions.
storage (off by default)
Add storage to the features URL option to get these.
| Tool | Arguments | Returns |
|---|---|---|
list_storage_buckets |
none | Buckets with id, name, public flag, file size limit and creation date. |
get_storage_config |
none | The Storage API URL, the 50 MB per-file limit, and that image transformations and the S3 protocol are off. |
Where writes show up
Every write made through the server (apply_migration, create_project, deploys and deletes) is recorded in Dashboard → Activity with the actor MCP (<token name>).