MCP Directory

How to add Supabase MCP Server to Windsurf

Official Supabase server: manage tables, run SQL, branches, configs and edge functions from your AI client. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.

Last updated June 15, 2026 · 2.7k★ · http · oauth · official

Windsurf config for Supabase MCP Server

Add remote URL https://mcp.supabase.com/mcp to your MCP client (OAuth login)
{
  "mcpServers": {
    "supabase-mcp-server": {
      "serverUrl": "https://mcp.supabase.com/mcp?read_only=true&project_ref=<your-project-ref>"
    }
  }
}

Remote server — no local install needed. Restart the client after saving the config.

Setup steps

  1. 1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
  2. 2Paste the Supabase MCP Server config below.
  3. 3Fill in placeholder secrets, then save.
  4. 4Click Refresh in the MCP panel.
  5. 5Supabase MCP Server's tools become available to Cascade.

Before you start

  • A Supabase account and at least one project (sign up at supabase.com)
  • An MCP-capable client (Cursor, Claude Code, VS Code, Windsurf, etc.)
  • For the remote server: nothing to install — authentication is handled by an OAuth 2.1 browser flow, no manual token needed
  • For local/self-hosted stdio mode: Node.js and the Supabase CLI; a Supabase personal access token can be created in the dashboard under Account > Access Tokens
  • Know your project ref (the `project_ref` ID from your project URL) to scope access

What Supabase MCP Server can do in Windsurf

list_projects / get_project / create_project

List, inspect, and create Supabase projects

list_tables

List database tables and their schema

execute_sql

Run an arbitrary SQL query against the project database

apply_migration

Apply a named SQL migration (DDL/schema change)

list_migrations / list_extensions

Inspect applied migrations and installed Postgres extensions

deploy_edge_function

Deploy a Supabase Edge Function; list_edge_functions and get_edge_function inspect them

create_branch / list_branches / merge_branch / reset_branch / rebase_branch / delete_branch

Manage development branches of the database

get_logs / get_advisors

Fetch service logs and security/performance advisor findings for debugging

Security

Grants broad access to your Supabase project including data and configuration; always scope with project_ref and enable read_only mode unless writes are explicitly needed. The OAuth flow authorizes the MCP client against your whole org, so review requested scopes.

Supabase MCP Server + Windsurf FAQ

Where is the Windsurf config file?

Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the Supabase MCP Server config there under the "mcpServers" key and restart the client.

Is Supabase MCP Server safe to use with Windsurf?

Grants broad access to your Supabase project including data and configuration; always scope with project_ref and enable read_only mode unless writes are explicitly needed. The OAuth flow authorizes the MCP client against your whole org, so review requested scopes.

Do I need a personal access token?

Not for the recommended remote server — it uses an OAuth 2.1 browser login. A personal access token is only relevant for local/self-hosted CLI setups; create one in the dashboard under Account > Access Tokens.

How do I stop the agent from modifying my database?

Add read_only=true to the server URL. This forces all database operations into read-only transactions so the agent cannot write or run DDL.

Can I limit it to one project?

Yes. Pass project_ref=<id> in the URL to scope the server to a single project instead of your whole account.

View repo Full Supabase MCP Server page