Skip to main content
Connect Supabase to let CloudThinker agents review your projects, tables, migrations, branches, logs, and performance advisors, plus run SQL, apply migrations, and deploy Edge Functions through your Approvals. Supabase connects with OAuth through Supabase’s hosted MCP server (MCP is the protocol agents use to call a service’s tools), so you don’t create or paste an access token.
The connection reaches production projects, and Supabase’s own read-only mode isn’t available on it. Under the default Approval mode, AI can approve a migration, an Edge Function deploy, or a project pause on its own. Choose Manual before you connect an organization with production projects, so every write waits for a person. An Ask first or Deny Rule adds to that once CloudThinker turns on Rule enforcement for your workspace.

​
Prerequisites

  • A Supabase account that can see the organization and projects you want to investigate.
  • The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

​
Setup

1

Open the Supabase connection

In CloudThinker, click More → Workspace settings → Connections in the sidebar. On the Builtin Connections tab, search for Supabase and click Connect.
2

Authorize CloudThinker in Supabase

CloudThinker opens Supabase in a new window. Sign in with the Supabase account that can access your projects, then approve access.
If Supabase asks you to pick an organization, the connection covers only that organization’s projects. Pick the one that owns the projects you want agents to reach. A wrong pick shows up later as a project agents can’t find.
If the window doesn’t open, your browser blocked the pop-up. CloudThinker shows a dialog instead: click Open Supabase in it.
3

Return to CloudThinker

Switch back to the CloudThinker tab. If you used the Open Supabase dialog, it closes on its own once the connection is ready.Success state: Supabase shows a Connected status.
4

Run the verify prompt

Run the verify prompt to confirm the authorized account sees the projects you expect.Success state: CloudThinker lists your projects, then the tables and latest migrations of the one you named.

​
Connection details

Supabase has no fields to fill in. Supabase issues OAuth tokens during authorization and CloudThinker stores them for you. A workspace holds one Supabase connection. To use a different Supabase account or organization, click Disconnect on the Supabase connection, then click Connect and sign in again.

​
Required permissions

CloudThinker gets the same access as the Supabase account you authorize, across every project the authorization covers: the organization you picked during sign-in, or every project the account can see if Supabase didn’t ask. Supabase’s own project scoping and read-only mode aren’t available on this connection. To get close, authorize with an account that belongs only to the organizations agents should reach, and use Rules to block writes.

​
Agent capabilities

If you decline a change, CloudThinker doesn’t retry it. See Write access.

​
Verify the connection

Replace <project-name> with one of your Supabase projects. Success state: CloudThinker lists your projects, then the tables and latest migrations of the one you named. Name one project to keep the answer short on a large organization.

​
Example prompts

​
Write access

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. Pausing a project, deploying an Edge Function, and applying a migration to production are high-impact, so don’t leave them to AI judgment. Choose Manual so a person approves every change. This connection has no Allow writes switch, so that is the control that works today. Once CloudThinker turns on Rule enforcement for your workspace, a Rule can narrow that:
  • Approve production writes with a Rule: add an Ask first Rule on the Supabase connection so a person reviews every SQL statement, migration, and deploy.
  • Make it effectively read-only: add a Deny Rule on the Supabase connection that covers every operation. Every statement through the SQL tool counts as a change, a SELECT included, so Deny stops all SQL. Listing projects and tables, extensions, migrations, logs, advisors, Edge Functions, storage buckets, and keys keep working.
To build either Rule once enforcement is on:
1

Ask for the Rule

In a chat, type /create-policy Ask first for every write on the Supabase connection. To block instead, ask for a Deny Rule.
2

Check the proposal

Open Approvals in the sidebar, then Rules → Needs review, and open the Rule. Check that Effect is Ask first (or Deny), the Rule carries the Every operation badge, and Connections names your Supabase connection. What would change should show recent Supabase writes as asking first (or refused).
3

Accept it

Select the Rule and click Accept.Success state: a toast confirms the accepted Rule, and it moves to the Active tab.

​
Troubleshooting

Your browser may be signed in to a different Supabase account, or the pop-up was blocked. Sign in to the right account in the same browser, then click Connect again.
You authorized a Supabase account without access to that project, or the project is in another organization. Click Disconnect, then Connect with an account that can see it.
The OAuth authorization expired or was revoked in Supabase. Click Connect in the error alert on the connection to authorize again.
On the free plan, Supabase pauses a project after about 7 days of inactivity, and a paused project answers no SQL. Restore it in the Supabase dashboard, or ask CloudThinker to restore it (that’s a change, so it goes through approvals), then run the statement again.
Supabase manages the auth and storage schemas itself, so a statement that alters their tables can fail with permission denied. Put your own tables and functions in public or a schema you create.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • No read-only mode on this connection: Supabase does ship a read-only mode and per-project scoping, but this connection doesn’t offer them, and it has no Allow writes switch, so the read-only advice above can’t apply. Choose Manual instead, so a person approves every change, and add an Ask first or Deny Rule once Rule enforcement is on (see Write access).
  • Reach: the connection reaches every project the authorization covers (see Required permissions), including production. Your Supabase memberships are the real boundary.
  • Data path: agents call Supabase’s hosted MCP server at https://mcp.supabase.com/mcp. SQL, logs, and other results pass through it and show in the chat, so they’re kept with the conversation. Logs can hold personal data, so ask for the narrowest window you need. CloudThinker stores the OAuth tokens.
  • Cutting access: click Disconnect on the Supabase connection. If the grant is revoked on the Supabase side instead, the connection shows an error until someone authorizes again.
  • Keys in answers: agents can read a project’s publishable keys and logs, and an app can print secrets into its own logs. Treat those answers as sensitive.

Neon Connection

OAuth-connected serverless Postgres

PostgreSQL Connection

Connect any Postgres database directly

Approvals

Decide which changes run on their own and which wait for you