From the source
Supabase announced a way for developers to give their own Supabase app its own MCP server, so customers can use that app from ChatGPT, Claude or another MCP client while signed in with the account they already have.
- The MCP Server block installs an Edge Function into supabase/functions/mcp containing the MCP handler, authentication middleware and a whoami tool, with each tool in its own file registered by tools/index.ts.
- Every tool call runs as the signed-in user, so Postgres applies the table's RLS policies and tools need no service role key.
- Supabase Auth handles the OAuth flow, and helpers from @supabase/server give each tool a Supabase client for that user.
- The block uses the official MCP TypeScript SDK, and the helpers also work in other backends that use standard Web Request and Response handlers, including
Cloudflare Workers.
- Tools can also show part of the app's UI inside the chat through MCP Apps, as shown in the Sizzle demo, which reuses the web app's React components bundled into one HTML file.
- Setup requires asymmetric signing keys, the OAuth 2.1 server, dynamic client registration and the OAuth Consent block, with the built-in JWT check turned off.
