How to Connect Supabase to Gemini via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Supabase, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Supabase + Gemini

Let your AI look after your Supabase projects: list projects and check their health, explore schemas and tables, run read-only SQL, read logs, security and performance advisors, Edge Functions, migrations, branches and storage buckets. Through the Management API with a personal access token.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

SUPABASE_ACCESS_TOKEN

Step 1 — Get credentials

1. In the Supabase dashboard, open the account menu → Account preferences → Access Tokens (or go straight to https://supabase.com/dashboard/account/tokens) and click Generate new token.
2. Prefer a scoped token: pick the organization and the projects the AI may see, and give each capability Read (or Read-write only where it should change something). The tools here use Projects, Project Settings, Database, Migrations, Backups, Edge Functions, API Keys (not API Key Secrets), Logs, Usage Analytics, Advisors, Storage, Development Branches and Organizations.
3. Set an expiry (at most one year) and copy the token. It starts with sbp_ and Supabase shows it only once.
4. Paste the token into SUPABASE_ACCESS_TOKEN, without the word Bearer, then install the connector.
5. Start with supabase_list_projects: it lists every project the token can reach, with its status and its ref. The ref (the 20 lowercase letters in https://<ref>.supabase.co) is what every other tool takes.

Changing access later: a token's access cannot be changed after it is created. To widen or narrow it, create a new token and delete the old one. A legacy (unscoped) token has your full access to every organization instead.

Read-only setup: give a scoped token Read on every capability. With Database on Read only, even supabase_execute_sql runs its SQL read-only. No other tool changes data: everyday questions go through supabase_run_read_only_sql, which runs one statement as a read-only database user and cuts results over 200 KB.

Switched off at install: supabase_execute_sql. It runs SQL as postgres with full rights, so DDL, writes and grants take effect at once and cannot be undone. Turn it on only if the AI should change the database; it shows you each statement and waits for your confirmation. For schema changes that belong in version control, your own migration workflow is the better place.

A project owner's view: the connector works through the Supabase Management API, not as an app user, so it does not go through your project's REST API or row level security. supabase_list_api_keys names every key but shows the value only of public ones; secret keys and the legacy service_role key are listed without their value on purpose, and no tool reveals them. Edge Function code is not downloaded either.

Paused projects: free projects pause after a week without activity and then show status INACTIVE. Database tools fail until you restore the project in the dashboard. When an app reports errors, run supabase_get_project_health first.

Logs and advisors: supabase_query_logs searches only the last minute unless you give it a time range; a range may span at most 24 hours and must lie within your plan's log retention (1 day on Free, 7 on Pro, 28 on Team). supabase_get_security_advisors and supabase_get_performance_advisors run the same checks as the dashboard's Advisors page; fix ERROR findings first, especially tables exposed without row level security. Preview branches (supabase_list_branches) need a paid plan.

Limits: Supabase allows 120 Management API requests per minute per user and endpoint (all of a user's tokens share it), and 30 per minute for logs and usage. Over the limit it answers 429 for the rest of the minute: wait a minute and try again.

Common errors: 401 "Invalid access token" means the token is wrong, expired or was deleted: create a new one under Access Tokens. 403 means the token may not do this: a scoped token lists what it lacks in missing_permissions, so create a new token that includes it. 404 is an unknown project ref, or a project outside the token's organizations. 402 on logs means the organization's usage quota is used up. A failing SQL statement comes back with Postgres' own message, for example "relation "orders" does not exist" when a table is not qualified with its schema (public.orders).

The connector does not create, pause, restore or delete projects, deploy Edge Functions, manage secrets, auth configuration, custom domains, network restrictions or billing, and it does not read your app's tables through PostgREST.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Gemini

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Gemini CLI reads MCP servers from ~/.gemini/settings.json (on Windows %USERPROFILE%\.gemini\settings.json). Add:

{
  "mcpServers": {
    "anythingmcp": {
      "httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart gemini.
3. Run /mcp inside Gemini CLI (or gemini mcp list in your shell): anythingmcp should show as connected.
4. Start prompting: Gemini CLI can now call the Supabase tools.

Available tools

Example prompts

• "Which of my Supabase projects are not healthy right now, and what is wrong with them?"
• "Run the security advisor on the Acme Shop project and tell me which tables are exposed without row level security."
• "How many orders were created per day last week in public.orders of the Acme Shop project?"
• "Show me the Postgres errors from the last hour in the Acme Shop logs and explain what caused them."

FAQ

Where does Gemini CLI look for MCP servers? In ~/.gemini/settings.json for your user, or in .gemini/settings.json inside a project. gemini mcp list shows each server and whether it connects.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Meta Muse