Aliyun Supabase

🎉 Supabase on Alibaba Cloud is FREE! Deploy Supabase for free on Alibaba Cloud today.

Free for Developers: Learn more about our product Supabase on Alibaba Cloud (AnalyticDB for PostgreSQL) - available at no cost.

Learn more about Alibaba Cloud Supabase MCP.

Supabase MCP Server

Connect your Supabase projects to Cursor, Claude, Windsurf, Lingma, Qoder, and other AI assistants.

The Model Context Protocol (MCP) standardizes how Large Language Models (LLMs) talk to external services like Supabase. It connects AI assistants directly with your Supabase project and allows them to perform tasks like managing tables, fetching config, and querying data. See the full list of tools.

Prerequisites

You will need Node.js installed on your machine. You can check this by running:

node -v

If you don't have Node.js installed, you can download it from nodejs.org.

Setup

1. Aliyun AK & SK

First, go to your Aliyun console and create a personal access key. Give it a name that describes its purpose, like "Cursor MCP Server".

This will be used to authenticate the MCP server with your Supabase account. Make sure to copy the token, as you won't be able to see it again.

2. Configure MCP client

Next, configure your MCP client (such as Cursor) to use this server. Most MCP clients store the configuration as JSON in the following format:

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": [
        "-y",
        "@aliyun-supabase/mcp-server-supabase@latest",
        "--features=aliyun",
      ],
      "env": {
        "ALIYUN_ACCESS_TOKEN": "<YOUR_AK>|<YOUR_SK>"
      }
    }
  }
}

Replace <ALIYUN_ACCESS_TOKEN> with the token you created in step 1.

Alternatively, you can use the separate environment variables:

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": [
        "-y",
        "@aliyun-supabase/mcp-server-supabase@latest",
        "--features=aliyun",
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_AK>",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_SK>"
      }
    }
  }
}

Scoping to a Specific Aliyun Project

To scope the MCP server to a specific Aliyun project and avoid traversing all regions and projects, you can use the --project-id and --region-id flags:

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": [
        "-y",
        "@aliyun-supabase/mcp-server-supabase@latest",
        "--features=aliyun",
        "--project-id=your-project-id",
        "--region-id=cn-hangzhou"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_AK>",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_SK>"
      }
    }
  }
}

When --project-id is specified:

• All Aliyun tools will automatically use this project ID
• The project_id parameter will be automatically injected and removed from tool parameters
• You won't need to specify the project ID when calling tools

When --region-id is specified:

• All Aliyun tools will automatically use this region ID
• The region_id parameter will be automatically injected and removed from tool parameters
• This helps avoid traversing all regions to find projects

Note: Both --project-id and --region-id are optional. If not specified, tools will work as before, requiring you to provide these parameters when calling tools.

Read-Only Mode

For enhanced security, especially when working with production databases, you can enable read-only mode by adding the --read-only flag. In read-only mode:

• The execute_sql tool will automatically wrap SQL queries in read-only transactions
• All write operations (CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, etc.) are blocked
• Only SELECT queries and other read operations are permitted
• The server will reject any attempts to modify data or schema

Enable read-only mode by adding --read-only to your args:

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": [
        "-y",
        "@aliyun-supabase/mcp-server-supabase@latest",
        "--features=aliyun",
        "--read-only"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_AK>",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_SK>"
      }
    }
  }
}

Note: When --read-only mode is enabled, write operations will automatically be wrapped in a read-only transaction that will be rolled back, ensuring no data changes are committed.

Tools

Note: This server is pre-1.0, so expect some breaking changes between versions. Since LLMs will automatically adapt to the tools available, this shouldn't affect most users.

The following Supabase tools are available to the LLM, grouped by feature.

Aliyun

Disabled by default. Use aliyun to target this group of tools with the --features option.

The Aliyun tools are organized into the following categories:

Project Management:

• list_aliyun_supabase_projects: Lists all Supabase projects deployed on the Aliyun platform. Use this to retrieve a list of existing projects with their basic information. If no projects are found in the default region (cn-hangzhou), try other regions obtained from the describe_regions tool.
• get_supabase_project: Gets details for a specific Supabase project on Aliyun platform.
• create_supabase_project: Create a new Supabase project on Aliyun platform.
• delete_supabase_project: Delete a Supabase project on Aliyun platform.

Project Configuration:

• get_supabase_project_api_keys: Gets the Supabase project API keys including anon key and serviceRoleKey.
• modify_supabase_project_security_ip_list: Modify the IP whitelist for a Supabase project. You need to add the client IP address or IP address range to the whitelist before using the Supabase instance.
• reset_supabase_project_password: Reset the database password for a Supabase project.

Infrastructure:

• describe_regions: Describe available regions and zones for Aliyun Supabase projects.
• describe_rds_vpcs: Describe available VPCs in Aliyun for Supabase project deployment.
• describe_rds_vswitches: Describe available vSwitches in Aliyun for Supabase project deployment.

Database Operations:

• execute_sql: Executes custom SQL queries on a Supabase project database by building and running a curl command. Requires PublicConnectUrl and serviceRoleKey. When run in read-only mode (with --read-only flag), write operations are automatically wrapped in a read-only transaction and rolled back to prevent data changes.
• list_table: Lists all tables in specified schemas of a Supabase project database. By default lists all non-system tables, but can filter by schema. Useful for exploring database structure and existing data models. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools.
• list_columns: Lists all columns in a table with detailed metadata including data type, nullable status, default values, and constraints. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools.
• list_indexes: Lists all indexes on tables in a schema including index name, table name, and index definition. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools.
• list_extensions: Lists all PostgreSQL extensions installed in the database. Shows extension name, version, schema, and description. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools.

Authentication Users

• list_auth_users: Lists all authentication users in a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools. Uses Supabase Admin API to retrieve user information. Supports pagination with optional page and per_page parameters.
• get_auth_user: Retrieves details for a specific user in a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools. Uses Supabase Admin API to retrieve user information.
• create_auth_user: Creates a new user using Supabase Admin API in a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools. Supports email, phone, password, and custom metadata.
• update_auth_user: Updates user details using Supabase Admin API in a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools. Can update email, phone, password, and metadata.
• delete_auth_user: Deletes a user using Supabase Admin API in a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key obtained from other tools.

Edge Functions

• deploy_edge_function: Deploys an Edge Function to a Supabase project on Aliyun. Requires the project's PublicConnectUrl as url and serviceRoleKey as api_key. The function file must be named index.ts and written in TypeScript. Supports optional JWT verification configuration. Note: If your function code contains import statements, ensure your Supabase instance has public internet access to download dependencies.
• list_edge_functions: Lists all Edge Functions in a Supabase projec

---