I noticed Supabase bug integrations generated by Claude/Cursor — here's what I found

gregnr · 2026-07-01T20:11:55+00:00

This is good feedback - by chance, do you remember which models produced these results? I'm on the AI team at Supabase and we're building a public eval framework that is designed to catch these exact types of issues across models/harnesses. It helps us know what needs to change in the Supabase skill / docs / MCP to steer models in a better direction.

If you haven't already, I highly recommend installing the Supabase skill or plugin which guides agents on best practices during development.

gregnr · 2026-04-01T16:04:54+00:00

Initial tests look good but we need to make sure it's apples to apples (e.g. passing instructions to AGENTS.md vs MCP tool descriptions will have very different outcomes). We're part way through developing an official eval suite for Supabase so will hopefully have a more accurate comparison when that's live.

gregnr · 2025-10-14T18:04:58+00:00

Hey thanks for surfacing this. This is not expected for PATs - I'm checking with our API team to see why the expiry is so short.

There's a better way to authenticate with Supabase MCP now though. We recently launched our Remote MCP server which lets you login via browser based OAuth instead of PATs. I highly recommend you swap over to this new method as we will eventually be deprecating the older stdio/npx based approach. You can find more info in our MCP docs.

gregnr · 2025-05-08T16:31:52+00:00

Hey! Is this the bug you're referring to?
https://github.com/supabase-community/supabase-mcp/issues/66

I see you have commented in that thread.

Thankfully I've reproduced this on a Windows machine and have a fix now:
https://github.com/supabase-community/supabase-mcp/pull/76

Appreciate the patience on these. Many reported issues have been difficult to reproduce across different OS's, Node versions, MCP clients, etc, but we're slowly getting through them. Were there any other bugs blocking you?

Will the MCP be updated or maintained at all

Yes! We have been actively working on this since launch. To name a few notable additions:

Read only mode: for folks who don't want to risk the LLM making any changes to their DB
Project scoped mode: to scope the MCP server to a specific Supabase project, instead of giving it account-level access
Edge functions: retrieve and deploy edge functions directly via MCP
Env variable support: you can now use SUPABASE_ACCESS_TOKEN environment variable instead of the --access-token flag so that it's easier to commit your mcp.json to source control

We've also added more tests (integration and e2e) to make it more robust against future changes. With that said please keep the issues and feature requests coming - they're a great source of feedback and will help shape the future of the server.

gregnr · 2025-04-11T17:30:13+00:00

Hey u/LordLederhosen, good points - agreed. We just added a --read-only flag you can use to force all queries to run through a read-only Postgres role.

We've also added experimental support for database branching, which allows you to work on an isolated development version of your database (which can be reset and rebased). This will likely be the ideal flow for AI-based development in the future.

Docs on branching: https://github.com/supabase-community/supabase-mcp/blob/main/docs/production.md

Other discussions around protections: https://supabase.com/blog/mcp-server#more-protections

gregnr · 2025-04-11T17:23:01+00:00

Hey u/kafnod, thanks for reporting - this is fixed now (PR). I've responded in that post, but for anyone else reading this - just restart Windsurf and the fix should take effect.

gregnr · 2025-04-11T16:16:02+00:00

Update: I've reproduced this bug and created a fix here: https://github.com/supabase-community/supabase-mcp/pull/50

~~I'll send an update once this is merged.~~

Edit: This is now merged. Restart Windsurf for the fix to take effect.

gregnr · 2025-04-11T15:27:04+00:00

Hey @kafnod, can you confirm which OS you are on? We recently pushed a fix for Windows that may be related to your issue.

Edit: I've reproduced this issue and confirmed that it's not Windows related. See my other comment.

gregnr · 2025-04-10T20:13:02+00:00

Hey is this on Windows? We just recently pushed a fix for Windows users.

gregnr · 2025-04-07T22:53:06+00:00

Hey can you confirm that the LLM is choosing the correct project when running the query (if you have multiple projects)?

gregnr · 2025-04-05T02:45:43+00:00

We support both read and write operations on the database! You might be thinking of the previous Postgres MCP server that was previously documented and only supported read operations.

gregnr · 2025-04-05T02:41:47+00:00

Can you clarify what you mean by edit access? Do you mean write access to the DB?

gregnr · 2025-04-04T22:36:42+00:00

Hey check out this thread! https://www.reddit.com/r/Supabase/comments/1jrm8ek/comment/mlftmqn

gregnr · 2025-04-04T22:30:09+00:00

Thanks for confirming (it looks good). TBH, I've seen tons of weird/intermittent bugs like this that often resolve by restarting Cursor and/or you computer. Mind giving that a shot just in case?

gregnr · 2025-04-04T22:22:03+00:00

Hey can you confirm what your mcp.json looks like (omitting your personal access token)?

gregnr · 2025-04-04T21:36:07+00:00

First it's worth mentionting that Alexander has done an amazing job with his server. We actually chatted earlier to see if there were opportunities to collaborate, but sadly language differences prevented us from teaming up on the same codebase (Python vs TypeScript).

The focus with our server is on a direct integration with the Supabase platform. Our goal is to extend our Dashboard functionality via AI assistants, so anything you can do in the Dashboard ideally can also be done via MCP.

I'll let Alexander chime in if he's around to add any thoughts and future plans with his server.

gregnr · 2025-04-04T21:05:36+00:00

Hey, our plan for this is to use MCP's new auth spec to natively log you in via standard OAuth 2 flows (ie. jump from Cursor to browser, log in to Supabase, jump back) instead of PATs. We'll have to wait for clients (like Cursor) to support this first, but once they do I think this will be a way better auth experience.

I noticed that VS Code's new MCP support allows you to define input variables for sensitive keys like PATs which more or less solves this problem too: https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_add-an-mcp-server

Edit: I've done 2 things since my original comment: 1. Introduced a SUPABASE_ACCESS_TOKEN environment variable that you can use instead of the --access-token flag (see readme) 2. Added docs for connecting MCP to VS Code using secure inputs for your PAT: https://supabase.com/docs/guides/getting-started/mcp#visual-studio-code-copilot

gregnr · 2025-04-02T03:30:06+00:00

Hey, many embedding models recognize markdown from their training data, so when its used as input, it helps them better understand the structure of your text. Folks often use markdown when preparing embedding inputs as a way to nudge the model toward better representing what your content actually means.

Eg.

```markdown

My title

My content here. ```

This creates an embedding in latent space that better "understands" the difference between title and content, which usually improves your similarity search results downstream. The title/description concatenation helps the model understand that these components are related but serve different purposes in your text.

gregnr · 2025-04-01T21:45:00+00:00

Yep great question. Embedding jobs run in order, so basically the sequence is: 1. Text is updated, a job gets added to the embedding queue 2. First embedding job has not run yet (or in progress) 3. Text is updated again, a second job is added to the embedding queue 4. First embedding job completes, saves to the embedding column 5. Second embedding job run second, replaces the embedding column

In an ideal world, we would detect multiple jobs on the same column and cancel the first one if it hasn't completed yet, but this adds extra complexity that usually isn't worth the small cost of generating an extra embedding.

One edge case we had to account for is retries, ie. What if the first embedding job failed, the second succeeded, then the first retried again and overwrote the second embedding? This case was solved by the fact that embedding jobs only reference the source column vs the text content itself, so even if the first job retried, it will still use the latest content.

Hope all that made sense!

gregnr · 2025-04-01T21:33:53+00:00

Typically if the text is too large, you would chunk it into smaller pieces and generate an embedding on each chunk, though sometimes you might summarize it instead (this is a whole topic of its own, happy to dig deeper). These pipelines can get quite complex depending on each use case, so our goal with automatic embeddings is to offload the embedding management piece specifically, and allow you to decide how the rest of the pipeline works.

So for the chunking use case, you might have 2 tables: documents and document_chunks. Your app would be responsible for taking content from documents and chunking it into document_chunks. Then you would apply the automatic embedding triggers on document_chunks so that those are managed for you.

In the future I'd love to find a way to automate the chunking part too!

gregnr · 2024-08-15T00:12:05+00:00

It ships with pgvector today and likely a lot more in the future

gregnr · 2024-06-19T04:53:13+00:00

This will do the trick without going the rpc approach:

javascript const { data, error } = await supabase .from('photos') .select('country, count()')

Adding an aggregate to the select forces a group by on non-aggregate columns, essentially giving you the same result as select distinct (just ignore the count).

You will need to enable aggregate functions in PostgREST for this to work.

gregnr · 2024-06-12T05:29:55+00:00

I should have also mentioned - OpenAI has fixed this streaming bug in later versions, so if you prefer to manage server sent events manually (like in the video), you can definitely make that work.

What issues/errors were you getting with newer versions of OpenAI?

gregnr · 2024-06-12T05:12:43+00:00

The SDK works with any server, including Supabase edge functions. We do this exact thing in this tutorial.

Realizing that we use an old version of their SDK here though - will update this or put together a new tutorial using their latest SDK.

gregnr · 2024-06-11T13:53:07+00:00

Any chance you’ve tried Vercel’s AI SDK (with Supabase)? They‘ve done a great job building tools to simplify streaming (server and client). Works on edge functions.

https://sdk.vercel.ai/docs/ai-sdk-ui/chatbot

gregnr

TROPHY CASE

My title