Connect Supabase to Microsoft Copilot via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Supabase, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Supabase + Microsoft Copilot

Let your AI look after your Supabase projects: list projects and check their health, explore schemas and tables, run read-only SQL, read logs, security and performance advisors, Edge Functions, migrations, branches and storage buckets. Through the Management API with a personal access token.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

SUPABASE_ACCESS_TOKEN

Step 1 — Get credentials

1. In the Supabase dashboard, open the account menu → Account preferences → Access Tokens (or go straight to https://supabase.com/dashboard/account/tokens) and click Generate new token.
2. Prefer a scoped token: pick the organization and the projects the AI may see, and give each capability Read (or Read-write only where it should change something). The tools here use Projects, Project Settings, Database, Migrations, Backups, Edge Functions, API Keys (not API Key Secrets), Logs, Usage Analytics, Advisors, Storage, Development Branches and Organizations.
3. Set an expiry (at most one year) and copy the token. It starts with sbp_ and Supabase shows it only once.
4. Paste the token into SUPABASE_ACCESS_TOKEN, without the word Bearer, then install the connector.
5. Start with supabase_list_projects: it lists every project the token can reach, with its status and its ref. The ref (the 20 lowercase letters in https://<ref>.supabase.co) is what every other tool takes.

Changing access later: a token's access cannot be changed after it is created. To widen or narrow it, create a new token and delete the old one. A legacy (unscoped) token has your full access to every organization instead.

Read-only setup: give a scoped token Read on every capability. With Database on Read only, even supabase_execute_sql runs its SQL read-only. No other tool changes data: everyday questions go through supabase_run_read_only_sql, which runs one statement as a read-only database user and cuts results over 200 KB.

Switched off at install: supabase_execute_sql. It runs SQL as postgres with full rights, so DDL, writes and grants take effect at once and cannot be undone. Turn it on only if the AI should change the database; it shows you each statement and waits for your confirmation. For schema changes that belong in version control, your own migration workflow is the better place.

A project owner's view: the connector works through the Supabase Management API, not as an app user, so it does not go through your project's REST API or row level security. supabase_list_api_keys names every key but shows the value only of public ones; secret keys and the legacy service_role key are listed without their value on purpose, and no tool reveals them. Edge Function code is not downloaded either.

Paused projects: free projects pause after a week without activity and then show status INACTIVE. Database tools fail until you restore the project in the dashboard. When an app reports errors, run supabase_get_project_health first.

Logs and advisors: supabase_query_logs searches only the last minute unless you give it a time range; a range may span at most 24 hours and must lie within your plan's log retention (1 day on Free, 7 on Pro, 28 on Team). supabase_get_security_advisors and supabase_get_performance_advisors run the same checks as the dashboard's Advisors page; fix ERROR findings first, especially tables exposed without row level security. Preview branches (supabase_list_branches) need a paid plan.

Limits: Supabase allows 120 Management API requests per minute per user and endpoint (all of a user's tokens share it), and 30 per minute for logs and usage. Over the limit it answers 429 for the rest of the minute: wait a minute and try again.

Common errors: 401 "Invalid access token" means the token is wrong, expired or was deleted: create a new one under Access Tokens. 403 means the token may not do this: a scoped token lists what it lacks in missing_permissions, so create a new token that includes it. 404 is an unknown project ref, or a project outside the token's organizations. 402 on logs means the organization's usage quota is used up. A failing SQL statement comes back with Postgres' own message, for example "relation "orders" does not exist" when a table is not qualified with its schema (public.orders).

The connector does not create, pause, restore or delete projects, deploy Edge Functions, manage secrets, auth configuration, custom domains, network restrictions or billing, and it does not read your app's tables through PostgREST.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Microsoft Copilot

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.

1. In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
2. Enter a Server name (for example AnythingMCP), a Server description that says what the connector does, and the Server URL https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server.
3. Under authentication, choose API key, set Type to Header and the header name to X-API-Key, then select Create.
4. In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
5. Try it in the agent's Test pane: ask for something that needs the Supabase tools.
6. Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.

Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.

Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.

Available tools

Example prompts

• "Which of my Supabase projects are not healthy right now, and what is wrong with them?"
• "Run the security advisor on the Acme Shop project and tell me which tables are exposed without row level security."
• "How many orders were created per day last week in public.orders of the Acme Shop project?"
• "Show me the Postgres errors from the last hour in the Acme Shop logs and explain what caused them."

FAQ

Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.

What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.

The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Gemini
• Connect to Meta Muse