# MCP tools reference

> Every tool on the SupaHost MCP server, grouped by feature group, with arguments, what each returns, which are write tools, and how read-only mode changes the list.

Source: https://supahost.app/docs/ai-tools/mcp-tools · Updated 2026-11-11

This is the full list of tools the SupaHost MCP server offers. Which ones an agent sees depends on the token's scope, read-only mode and the `features` URL option (see [The SupaHost MCP server](/docs/ai-tools/mcp)). Tools that aren't listed here don't exist on SupaHost.

**The `project` argument.** With a project-scoped token, project tools have no `project` argument: they always act on the token's project. With a whole-instance token, every project tool takes an optional `project` (the project name). If you leave it out, the tool uses the `project=` value from the URL, if any.

**Write tools** are marked ✎. They aren't registered at all in read-only mode.

## docs

| Tool | Arguments | Returns |
|---|---|---|
| `search_docs` | `query`, `limit` (1–10, default 5) | Matching pages from Supabase's documentation: title, URL and content. SupaHost runs the open-source Supabase stack, so these mostly apply; check the SupaHost docs for differences. |

## account (whole-instance tokens only)

| Tool | Arguments | Returns |
|---|---|---|
| `list_projects` | none | Each project's name, status, API URL and creation date. |
| `get_project` | `project` | Status, API URL, created and ready times. |
| `create_project` ✎ | `name`, `confirm_extra_cost` | Creates a project (2–30 characters: lowercase letters, numbers, `-`). It's ready in about a minute; poll `get_project` until the status is `healthy`. If the instance already has its plan's included projects, the call fails until it's repeated with `confirm_extra_cost: true` (each extra project costs $3/month), so the agent should ask you first. |

## database

| Tool | Arguments | Returns |
|---|---|---|
| `list_tables` | `schemas` (default `["public"]`) | Tables with columns (type, nullable, default), primary keys, RLS enabled or not, estimated rows and foreign keys. |
| `list_extensions` | none | Available extensions, installed version and schema. `pg_cron` is reported as built in, with a note not to run `create extension pg_cron`. |
| `list_migrations` | none | Applied migrations (`version`, `name`) from `supabase_migrations.schema_migrations`, including any applied with the Supabase CLI. |
| `execute_sql` ✎* | `query` | The result rows, wrapped in untrusted-data markers. Use it for queries and data changes. |
| `apply_migration` ✎ | `name` (snake_case, 1–80 characters), `query` | Runs the DDL and records it as a migration in one transaction: if any statement fails, nothing is applied. Returns `version` (UTC timestamp `YYYYMMDDHHMMSS`) and `name`. |

\* `execute_sql` stays available in read-only mode, but then runs as a read-only role, so Postgres rejects writes.

Both SQL tools handle one SupaHost quirk for you: if the SQL contains `create extension pg_cron`, that statement is skipped (it isn't needed and would fail) and the rest runs, with a note explaining how to use `cron.schedule`.

Example `apply_migration` call:

```json
{
  "name": "create_invoices",
  "query": "create table public.invoices (\n  id bigint generated always as identity primary key,\n  owner_id uuid not null default auth.uid() references auth.users (id),\n  number text not null,\n  total numeric(12,2) not null,\n  status text not null default 'draft'\n);\nalter table public.invoices enable row level security;\ncreate policy \"Owners manage their invoices\" on public.invoices\n  for all to authenticated\n  using ((select auth.uid()) = owner_id)\n  with check ((select auth.uid()) = owner_id);"
}
```

## debugging

| Tool | Arguments | Returns |
|---|---|---|
| `get_advisors` | none | Security findings in the `public` schema, or "No issues found." |

`get_advisors` runs three checks:

| Issue | Meaning |
|---|---|
| `rls_disabled` | A table is reachable through the Data API without Row Level Security. The detail includes the `alter table ... enable row level security` to run. |
| `rls_no_policies` | RLS is on but there are no policies, so the API can't read the table at all. |
| `function_search_path_mutable` | A `security definer` function has no fixed `search_path`. Add `set search_path = ''`. |

It doesn't cover performance advice or other Supabase advisor checks.

## development

| Tool | Arguments | Returns |
|---|---|---|
| `get_project_url` | none | The project's API URL, to use as `SUPABASE_URL`. |
| `get_publishable_keys` | none | The `anon` key (type `legacy`). The `service_role` key is never returned. |
| `generate_typescript_types` | `schemas` (default `["public"]`) | TypeScript types for supabase-js (`createClient<Database>()`). |

## functions

| Tool | Arguments | Returns |
|---|---|---|
| `list_edge_functions` | none | Each function's slug, URL, `verify_jwt`, `version` (latest), `deployed_version` (live), `status` (`deploying`, `active`, `error`), `error` and timestamps. |
| `get_edge_function` | `function_slug` | The same plus the source `files`. |
| `get_edge_function_logs` | `function_slug` (optional), `limit` (1–500, default 100) | Recent log entries, newest first: console output, boot errors, exceptions and request lines. |
| `deploy_edge_function` ✎ | `name`, `files` (`[{ name, content }]`, must include `index.ts`), `verify_jwt` (optional), `entrypoint_path` (optional, must be `index.ts`) | Returns straight away with `status: "deploying"`, the new `version` and the URL. |
| `delete_edge_function` ✎ | `function_slug` | Deletes the function; it stops serving within about a minute. |

After `deploy_edge_function`, poll `list_edge_functions` (it takes about a minute) until the function's status is `active` with `deployed_version` equal to the new version, or `error` with the build message. On an error, the previous version keeps serving. Limits: 50 files, 1 MB of source, 100 functions per project. See [Deploying functions](/docs/functions/deploying).

## storage (off by default)

Add `storage` to the `features` URL option to get these.

| Tool | Arguments | Returns |
|---|---|---|
| `list_storage_buckets` | none | Buckets with id, name, public flag, file size limit and creation date. |
| `get_storage_config` | none | The Storage API URL, the 50 MB per-file limit, and that image transformations and the S3 protocol are off. |

## Where writes show up

Every write made through the server (`apply_migration`, `create_project`, deploys and deletes) is recorded in *Dashboard → **Activity*** with the actor `MCP (<token name>)`.

## Related

- [Rules and prompts for AI agents](/docs/ai-tools/agent-rules)
- [SQL migrations](/docs/database/migrations)
- [Generating TypeScript types](/docs/api/generating-types)
- [Edge Functions on SupaHost](/docs/functions/overview)