# Supabase

Supabase is an open-source backend-as-a-service providing a Postgres database, authentication, storage, and real-time subscription APIs for building modern applications

- **Category:** developer tools
- **Auth:** OAUTH2, API_KEY
- **Composio Managed App Available?** Yes
- **Tools:** 121
- **Triggers:** 0
- **Slug:** `SUPABASE`
- **Version:** 20260429_01

## Tools

### Create project api key

**Slug:** `SUPABASE_ALPHA_CREATE_API_KEY`

Creates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description; 'secret' keys can have customized JWT templates.

### Delete an API key from the project

**Slug:** `SUPABASE_ALPHA_DELETE_API_KEY`

Permanently deletes a specific API key (identified by `id`) from a Supabase project (identified by `ref`), revoking its access.

### Delete third party auth config

**Slug:** `SUPABASE_ALPHA_DELETE_THIRD_PARTY_AUTH_INTEGRATION`

Removes a third-party authentication provider (e.g., Google, GitHub) from a Supabase project's configuration; this immediately prevents users from logging in via that method.

### Get a third-party integration

**Slug:** `SUPABASE_ALPHA_GET_THIRD_PARTY_INTEGRATION`

Retrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by `tpa_id`, within an existing Supabase project specified by `ref`.

### List third-party auth integrations for project

**Slug:** `SUPABASE_ALPHA_LIST_THIRD_PARTY_AUTH_INTEGRATIONS`

Lists all configured third-party authentication provider integrations for an existing Supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.

### Update an API key for the project

**Slug:** `SUPABASE_ALPHA_UPDATE_API_KEY`

Updates an existing Supabase project API key's `description` and/or `secret_jwt_template` (which defines its `role`); does not regenerate the key string.

### Apply a database migration

**Slug:** `SUPABASE_APPLY_A_MIGRATION`

Tool to apply database migrations to a Supabase project. Use when you need to execute SQL schema changes, create tables, alter columns, or run other DDL/DML operations as part of a tracked migration. This is a Beta feature in the Supabase Management API.

### Beta activate custom hostname for project

**Slug:** `SUPABASE_BETA_ACTIVATE_CUSTOM_HOSTNAME`

Activates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally.

### Activate vanity subdomain for project

**Slug:** `SUPABASE_BETA_ACTIVATE_VANITY_SUBDOMAIN`

Activates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co'). Important notes: - Vanity subdomains require a paid plan (Pro/Team/Enterprise) - Usage of vanity subdomains and custom domains is mutually exclusive - After activation, your project's auth services will no longer work on the original {project-ref}.supabase.co hostname - Schedule a downtime window to update client code and OAuth providers before activating

### Authorize user through OAuth

**Slug:** `SUPABASE_BETA_AUTHORIZE_USER_THROUGH_OAUTH`

Generates a Supabase OAuth 2.0 authorization URL for user redirection. IMPORTANT: This action requires a pre-registered OAuth client_id and a redirect_uri that matches one of the pre-registered URIs for that OAuth application. Without a valid registered OAuth application, this endpoint will return a 400 error. To use this action: 1. Register an OAuth application in the Supabase dashboard 2. Use the client_id from the registered application 3. Ensure redirect_uri matches one of the registered callback URLs

### Check vanity subdomain availability

**Slug:** `SUPABASE_BETA_CHECK_VANITY_SUBDOMAIN_AVAILABILITY`

Checks if a specific vanity subdomain is available for a Supabase project; this action does not reserve or assign the subdomain.

### Setup read replica for project

**Slug:** `SUPABASE_BETA_CREATE_READ_REPLICA`

Provisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency.

### Enable project database webhooks

**Slug:** `SUPABASE_BETA_ENABLE_DATABASE_WEBHOOKS`

Enables database webhooks for the Supabase project `ref`, triggering real-time notifications for INSERT, UPDATE, or DELETE events.

### Beta get project's custom hostname config

**Slug:** `SUPABASE_BETA_GET_PROJECT_CUSTOM_HOSTNAME_CONFIG`

Retrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan.

### Retrieve network bans for project

**Slug:** `SUPABASE_BETA_GET_PROJECT_NETWORK_BANS`

Retrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string; this is a read-only operation.

### Get project network restrictions

**Slug:** `SUPABASE_BETA_GET_PROJECT_NETWORK_RESTRICTIONS`

Retrieves the network restriction settings (IP allowlists) for a Supabase project. Use this action to: - Check which IPv4/IPv6 CIDR blocks are allowed to connect to the project's database - Verify if network restrictions are enabled (entitlement: "allowed") or disabled ("disallowed") - Audit current network security configuration - Check if network restrictions have been modified (old_config present) Note: Default values 0.0.0.0/0 (IPv4) and ::/0 (IPv6) mean all IPs are allowed. Network restrictions require a Pro, Team, or Enterprise plan.

### Get project pgsodium config

**Slug:** `SUPABASE_BETA_GET_PROJECT_PGSODIUM_CONFIG`

Retrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its `ref`.

### Get project SSL enforcement configuration

**Slug:** `SUPABASE_BETA_GET_PROJECT_SSL_ENFORCEMENT_CONFIG`

Retrieves the SSL enforcement configuration for a specified Supabase project, indicating if SSL connections are mandated for its database.

### Get current vanity subdomain config

**Slug:** `SUPABASE_BETA_GET_VANITY_SUBDOMAIN_CONFIG`

Fetches the current vanity subdomain configuration, including its status and custom domain name, for a Supabase project identified by its reference ID.

### Remove project network bans

**Slug:** `SUPABASE_BETA_REMOVE_NETWORK_BANS`

Removes specified IPv4 addresses from a Supabase project's network ban list, granting immediate access; IPs not currently banned are ignored.

### Remove read replica

**Slug:** `SUPABASE_BETA_REMOVE_READ_REPLICA`

Remove a read replica from a Supabase project (Pro plan or higher required). This beta endpoint initiates the removal of a specified read replica database. The operation is irreversible. Before removal, ensure all application traffic is redirected from the replica to the primary database. Requirements: - Project must be on Pro plan or higher - Bearer token with infra_read_replicas_write permission (FGA) - Valid read replica database identifier Note: Returns 201 on success with an empty response body.

### Execute project database query

**Slug:** `SUPABASE_BETA_RUN_SQL_QUERY`

Executes a given SQL query against the project's database; use for advanced data operations or when standard API endpoints are insufficient, ensuring queries are valid PostgreSQL and sanitized. Use the get_table_schemas or generate_type_script_types tool to retrieve the table schema, then base your query on it.

### Beta update project network restrictions

**Slug:** `SUPABASE_BETA_UPDATE_PROJECT_NETWORK_RESTRICTIONS`

Updates and applies network access restrictions (IPv4/IPv6 CIDR lists) for a Supabase project, which may terminate existing connections not matching the new rules.

### Upgrade the project's PostgreSQL version

**Slug:** `SUPABASE_BETA_UPGRADE_PROJECT_POSTGRES_VERSION`

Initiates an asynchronous upgrade of a Supabase project's PostgreSQL database to a specified `target_version` from a selected `release_channel`, returning a `tracking_id` to monitor status; the `target_version` must be available in the chosen channel.

### Count action runs

**Slug:** `SUPABASE_COUNT_ACTION_RUNS`

Counts the number of action runs for a Supabase project using a HEAD request. Use this when you need to retrieve the total count of action runs without fetching the full list of runs.

### Create new project

**Slug:** `SUPABASE_CREATE_A_PROJECT`

Creates a new Supabase project, requiring a unique name (no dots) within the organization; project creation is asynchronous.

### Bulk create secrets

**Slug:** `SUPABASE_CREATE_BULK_SECRETS`

Tool to bulk create secrets for a Supabase project. Use when you need to create multiple project secrets at once. Each secret name must not start with SUPABASE_.

### Create a database branch

**Slug:** `SUPABASE_CREATE_DATABASE_BRANCH`

Creates a new, isolated database branch from an existing Supabase project (identified by `ref`), useful for setting up separate environments like development or testing, which can optionally be linked to a Git branch.

### Create a function

**Slug:** `SUPABASE_CREATE_FUNCTION`

Creates a new serverless Edge Function for a Supabase project (identified by `ref`), requiring valid JavaScript/TypeScript in `body` and a project-unique `slug` identifier.

### Create CLI login role

**Slug:** `SUPABASE_CREATE_LOGIN_ROLE`

Creates a temporary CLI login role for database access with specified permissions; use when setting up CLI authentication for development or administrative tasks.

### Create an organization

**Slug:** `SUPABASE_CREATE_ORGANIZATION`

Creates a new Supabase organization, which serves as a top-level container for projects, billing, and team access.

### Create project signing key

**Slug:** `SUPABASE_CREATE_PROJECT_SIGNING_KEY`

Create a new signing key for JWT authentication in a Supabase project. The key is created in standby status by default and must be activated separately.

### Create SSO provider configuration

**Slug:** `SUPABASE_CREATE_SSO_PROVIDER`

Creates a new SAML 2.0 Single Sign-On (SSO) provider for a Supabase project, requiring either `metadata_xml` or `metadata_url` for SAML IdP configuration.

### Create a new third-party auth integration

**Slug:** `SUPABASE_CREATE_THIRD_PARTY_AUTH_INTEGRATION`

Call this to add a new third-party authentication method (OIDC or JWKS) to a Supabase project for integrating external identity providers (e.g., for SSO); the API may also support `custom_jwks` if sent directly.

### Delete custom hostname config

**Slug:** `SUPABASE_DELETE_CUSTOM_HOSTNAME_CONFIG`

Deletes an active custom hostname configuration for the project identified by `ref`, reverting to the default Supabase-provided hostname; this action immediately makes the project inaccessible via the custom domain and requires subsequent updates to client, OAuth, and DNS settings.

### Delete branch by id

**Slug:** `SUPABASE_DELETE_DATABASE_BRANCH`

Permanently and irreversibly deletes a specific, non-default database branch by its `branch_id`, without affecting other branches.

### Delete an edge function by slug

**Slug:** `SUPABASE_DELETE_FUNCTION`

Permanently deletes a specific Edge Function (by `function_slug`) from a Supabase project (by `ref`); this action is irreversible and requires prior existence of both project and function.

### Delete CLI login roles

**Slug:** `SUPABASE_DELETE_LOGIN_ROLES`

[Beta] Deletes existing login roles used by the Supabase CLI for the specified project. Use when you need to remove CLI authentication roles that were previously created for project access.

### Delete project by ref

**Slug:** `SUPABASE_DELETE_PROJECT`

Permanently and irreversibly deletes a Supabase project, identified by its unique `ref` ID, resulting in complete data loss.

### Delete vanity subdomain for project

**Slug:** `SUPABASE_DELETE_PROJECT_VANITY_SUBDOMAIN`

Permanently and irreversibly deletes an active vanity subdomain configuration for the specified Supabase project, reverting it to its default Supabase URL.

### Bulk delete secrets

**Slug:** `SUPABASE_DELETE_SECRETS`

Tool to bulk delete secrets from a Supabase project. Use when you need to remove multiple secrets at once. Requires the edge_functions_secrets_write scope.

### Remove an SSO provider

**Slug:** `SUPABASE_DELETE_SSO_PROVIDER`

Deletes a specific SSO provider by its ID (`provider_id`) from a Supabase project (`ref`), which disables it and returns its details; ensure this action will not inadvertently lock out users.

### Deploy function

**Slug:** `SUPABASE_DEPLOY_FUNCTION`

Deploys Edge Functions to a Supabase project using multipart upload.

### Disable preview branching

**Slug:** `SUPABASE_DISABLE_PREVIEW_BRANCHING`

Disables the preview branching feature for an existing Supabase project, identified by its unique reference ID (`ref`). Note: Preview branching must be enabled on the project for this operation to succeed. If the project does not have preview branching enabled, a 422 error will be returned.

### Disable project readonly mode

**Slug:** `SUPABASE_DISABLE_PROJECT_READONLY`

Temporarily disables a Supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only.

### Exchange auth code for access and refresh token

**Slug:** `SUPABASE_EXCHANGE_OAUTH_TOKEN`

(Beta) Implements the OAuth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on `grant_type`. This is a standard OAuth 2.0 token endpoint that uses application/x-www-form-urlencoded content type as per OAuth 2.0 specification. Requires a valid registered OAuth application client_id and client_secret. For authorization_code grant type: - Requires valid authorization code obtained from the OAuth authorization flow - Optionally requires code_verifier if PKCE was used during authorization For refresh_token grant type: - Requires valid refresh_token from a previous token exchange

### Generate TypeScript types

**Slug:** `SUPABASE_GENERATE_TYPESCRIPT_TYPES`

Generates and retrieves TypeScript types from a Supabase project's database; any schemas specified in `included_schemas` must exist in the project.

### Get action run status

**Slug:** `SUPABASE_GET_ACTION_RUN`

Retrieves the status and details of a specific action run, including its steps, timestamps, and configuration. Use this to monitor or check the progress of an action execution.

### Get action run logs

**Slug:** `SUPABASE_GET_ACTION_RUN_LOGS`

Retrieves the execution logs for a specific action run by its ID. Use this to debug action executions, view output messages, and investigate errors that occurred during action runs.

### Get Available Regions

**Slug:** `SUPABASE_GET_AVAILABLE_REGIONS`

Tool to get the list of available regions for creating a new Supabase project. Use when you need to determine which regions are available for project deployment, or to get region recommendations based on geographic location and instance size requirements. Note: This is a Beta endpoint.

### Get a database branch

**Slug:** `SUPABASE_GET_BRANCH`

Retrieves detailed information about a specific database branch by its name and project reference. Use this to check branch status, configuration, and metadata before performing operations on the branch.

### Get database branch config

**Slug:** `SUPABASE_GET_DATABASE_BRANCH_CONFIG`

Retrieves the read-only configuration and status for a Supabase database branch, typically for monitoring or verifying its settings.

### Get Database Metadata

**Slug:** `SUPABASE_GET_DATABASE_METADATA`

Gets database metadata for the given project. Returns information about databases, schemas, and tables structure. Note: This endpoint is deprecated and may be removed in future versions.

### Retrieve a function

**Slug:** `SUPABASE_GET_FUNCTION`

Retrieves detailed information, metadata, configuration, and status for a specific Edge Function using its project reference ID and function slug.

### Retrieve a function body

**Slug:** `SUPABASE_GET_FUNCTION_BODY`

Retrieves the source code (body) for a specified serverless Edge Function using its project reference and function slug; this is a read-only operation that does not execute the function or return runtime logs.

### Get API Health Status

**Slug:** `SUPABASE_GET_HEALTH`

Tool to check the health status of the Supabase API. Use when you need to verify API availability or troubleshoot connectivity issues.

### Get JIT access config

**Slug:** `SUPABASE_GET_JIT_ACCESS_CONFIG`

[Beta] Retrieves the project's just-in-time (JIT) access configuration, including user roles and their expiration settings. Use this to check temporary access grants and their validity periods.

### Get legacy signing key

**Slug:** `SUPABASE_GET_LEGACY_SIGNING_KEY`

Retrieves the signing key information for the JWT secret imported as signing key for this project. This endpoint is deprecated and will be removed in the future; check for HTTP 404 Not Found which indicates the endpoint is no longer available.

### Get a migration

**Slug:** `SUPABASE_GET_MIGRATION`

Retrieves a specific database migration entry from the migration history using its version identifier. Use when you need to inspect migration details, SQL statements, or rollback commands for a specific migration version.

### Get information about an organization

**Slug:** `SUPABASE_GET_ORGANIZATION`

Fetches comprehensive details for a specific Supabase organization using its unique slug.

### Get performance advisors

**Slug:** `SUPABASE_GET_PERFORMANCE_ADVISORS`

Retrieves project performance advisors for a Supabase project. Returns a list of performance lints that identify potential issues and optimization opportunities. Note: This endpoint is deprecated.

### Get project

**Slug:** `SUPABASE_GET_PROJECT`

Retrieves detailed information about a specific Supabase project by its unique reference ID. Use when you need to get comprehensive project details including status, database configuration, and metadata. Authentication: - Requires a valid Bearer token in the Authorization header. - Token format: 'Bearer <access_token>' where access_token is either: - A Personal Access Token (PAT) generated from https://supabase.com/dashboard/account/tokens - An OAuth2 access token with the 'project_admin_read' scope Required Scope: - project_admin_read: Allows retrieval of project information. Returns: Project object containing id, ref, name, organization details, region, status, database configuration, and created_at timestamp.

### Get project API key

**Slug:** `SUPABASE_GET_PROJECT_API_KEY`

Retrieves details of a specific API key for a Supabase project by its UUID. Use when you need to inspect a single key's configuration, type, or metadata.

### Get project API keys

**Slug:** `SUPABASE_GET_PROJECT_API_KEYS`

Retrieves all API keys for an existing Supabase project, specified by its unique reference ID (`ref`); this is a read-only operation.

### Get project legacy API keys status

**Slug:** `SUPABASE_GET_PROJECT_LEGACY_API_KEYS`

Checks whether JWT-based legacy API keys (anon, service_role) are enabled for a Supabase project. This API endpoint is deprecated and may be removed in the future (returns HTTP 404 Not Found when unavailable).

### Get project logs

**Slug:** `SUPABASE_GET_PROJECT_LOGS`

Retrieves analytics logs for a Supabase project. Use this to fetch and analyze project logs including edge function logs, database logs, and API logs for monitoring and debugging.

### Get project PgBouncer config

**Slug:** `SUPABASE_GET_PROJECT_PGBOUNCER_CONFIG`

Retrieves the active PgBouncer configuration (PostgreSQL connection pooler) for a Supabase project, used for performance tuning, auditing, or getting the connection string.

### Get project postgres config

**Slug:** `SUPABASE_GET_PROJECT_POSTGRES_CONFIG`

Retrieves the current read-only PostgreSQL database configuration for a specified Supabase project's `ref`, noting that some advanced or security-sensitive details might be omitted from the response.

### Get project's PostgREST config

**Slug:** `SUPABASE_GET_PROJECT_POSTGREST_CONFIG`

Retrieves the PostgREST configuration for a specific Supabase project.

### Get project's read-only mode status

**Slug:** `SUPABASE_GET_PROJECT_READONLY_MODE_STATUS`

Retrieves the read-only mode status for a specified Supabase project to check its operational state; this action does not change the read-only state.

### Get project signing keys

**Slug:** `SUPABASE_GET_PROJECT_SIGNING_KEYS`

Tool to list all signing keys for a Supabase project. Use when you need to retrieve JWT signing keys for authentication verification or rotation management.

### Get project Supavisor configuration

**Slug:** `SUPABASE_GET_PROJECT_SUPAVISOR_CONFIG`

Retrieves the Supavisor (connection pooler) configuration for a specified Supabase project, identified by its reference ID.

### Get Project Upgrade Eligibility

**Slug:** `SUPABASE_GET_PROJECT_UPGRADE_ELIGIBILITY`

Checks a Supabase project's eligibility for an upgrade, verifying compatibility and identifying potential issues; this action does not perform the actual upgrade.

### Get project upgrade status

**Slug:** `SUPABASE_GET_PROJECT_UPGRADE_STATUS`

Retrieves the latest status of a Supabase project's database upgrade for monitoring purposes; does not initiate or modify upgrades.

### Get TUS resumable upload base options

**Slug:** `SUPABASE_GET_RESUMABLE_UPLOAD_BASE_OPTIONS`

Handles OPTIONS request for TUS Resumable uploads to discover server capabilities. Use when preparing resumable upload requests to verify supported TUS protocol versions and extensions.

### Get TUS resumable upload options

**Slug:** `SUPABASE_GET_RESUMABLE_UPLOAD_OPTIONS`

Handles OPTIONS request for TUS Resumable uploads to discover server capabilities. Use when preparing resumable upload requests to verify supported TUS protocol versions and extensions.

### Get Security Advisors

**Slug:** `SUPABASE_GET_SECURITY_ADVISORS`

Retrieves security advisor findings and recommendations for a Supabase project. Use when you need to audit project security posture, identify SQL-based security issues, or get remediation guidance. Note: This endpoint is deprecated and may be removed in future API versions.

### Get project's auth config

**Slug:** `SUPABASE_GETS_PROJECT_S_AUTH_CONFIG`

Retrieves the project's complete read-only authentication configuration, detailing all settings (e.g., providers, MFA, email/SMS, JWT, security policies) but excluding sensitive secrets.

### Get project's service health status

**Slug:** `SUPABASE_GETS_PROJECT_S_SERVICE_HEALTH_STATUS`

Retrieves the current health status for a Supabase project, for specified services or all services if the 'services' list is omitted.

### Get a specific SQL snippet

**Slug:** `SUPABASE_GET_SQL_SNIPPET`

Retrieves a specific SQL snippet by its unique identifier.

### Get a SSO provider by its UUID

**Slug:** `SUPABASE_GET_SSO_PROVIDER`

Retrieves the configuration details for a specific Single Sign-On (SSO) provider (e.g., SAML, Google, GitHub, Azure AD), identified by its UUID, within a Supabase project.

### Get Table Schemas

**Slug:** `SUPABASE_GET_TABLE_SCHEMAS`

Retrieves column details, types, and constraints for multiple database tables to help debug schema issues and write accurate SQL queries. Use the SUPABASE_LIST_TABLES action first to discover available tables, the fetch their detailed schemas.

### OPTIONS for resumable upload sign

**Slug:** `SUPABASE_HANDLE_RESUMABLE_UPLOAD_SIGN_OPTIONS`

Handles CORS preflight OPTIONS request for TUS resumable upload signing. Use when preparing cross-origin resumable upload requests to verify allowed methods and headers.

### OPTIONS for resumable upload sign

**Slug:** `SUPABASE_HANDLE_RESUMABLE_UPLOAD_SIGN_OPTIONS_WITH_ID`

Handles CORS preflight OPTIONS request for TUS resumable upload signing endpoints. Use when preparing cross-origin resumable upload requests to verify allowed methods and headers.

### Invoke Edge Function

**Slug:** `SUPABASE_INVOKE_EDGE_FUNCTION`

Tool to invoke a deployed Supabase Edge Function over HTTPS. Use for testing and debugging Edge Functions with configurable method, headers, body, and authentication.

### List all organizations

**Slug:** `SUPABASE_LIST_ALL_ORGANIZATIONS`

Lists all organizations (ID and name only) associated with the Supabase account, excluding project details within these organizations.

### List all projects

**Slug:** `SUPABASE_LIST_ALL_PROJECTS`

Retrieves a list of all Supabase projects, including their ID, name, region, and status, for the authenticated user. Authentication: - Requires a valid Bearer token in the Authorization header. - Token format: 'Bearer <access_token>' where access_token is either: - A Personal Access Token (PAT) generated from https://supabase.com/dashboard/account/tokens - An OAuth2 access token with the 'Projects.Read' scope Required Scope: - Projects.Read: Allows retrieval of project metadata. Returns: List of Project objects containing id, name, organization_id, region, status, database info, and created_at.

### List project database backups

**Slug:** `SUPABASE_LIST_BACKUPS`

Lists all database backups for a Supabase project, providing details on existing backups but not creating new ones or performing restores; availability may depend on plan and configuration.

### List all buckets

**Slug:** `SUPABASE_LIST_BUCKETS`

Retrieves a list of all storage buckets for a Supabase project, without returning bucket contents or access policies.

### List all database branches

**Slug:** `SUPABASE_LIST_DATABASE_BRANCHES`

Lists all database branches for a specified Supabase project, used for isolated development and testing of schema changes; ensure the project reference ID is valid.

### List all functions

**Slug:** `SUPABASE_LIST_FUNCTIONS`

Lists metadata for all Edge Functions in a Supabase project (specified by 'ref'), excluding function code or logs; the project must exist.

### List migration history

**Slug:** `SUPABASE_LIST_MIGRATION_HISTORY`

Retrieves the list of applied database migration versions for a Supabase project. Use this to track which migrations have been applied to the project's database. This is a read-only operation that requires the project reference ID.

### List members of an organization

**Slug:** `SUPABASE_LIST_ORGANIZATION_MEMBERS`

Retrieves all members of a Supabase organization, identified by its unique slug, including their user ID, username, email, role, and MFA status.

### List all secrets

**Slug:** `SUPABASE_LIST_SECRETS`

Retrieves all secrets for a Supabase project using its reference ID; secret values in the response may be masked.

### List SQL snippets for the logged in user

**Slug:** `SUPABASE_LIST_SQL_SNIPPETS`

Retrieves a list of SQL snippets for the logged-in user, optionally filtered by a specific Supabase project if `project_ref` is provided.

### List all SSO providers

**Slug:** `SUPABASE_LIST_SSO_PROVIDERS`

Lists all configured Single Sign-On (SSO) providers for a Supabase project, requiring the project reference ID (`ref`) of an existing project.

### List Database Tables

**Slug:** `SUPABASE_LIST_TABLES`

Lists all tables and views in specified database schemas, providing a quick overview of database structure to help identify available tables before fetching detailed schemas.

### Patch a migration

**Slug:** `SUPABASE_PATCH_MIGRATION`

[Beta] Patches an existing entry in the project's migration history, updating the name or rollback script. Use this to correct migration metadata after the migration has been created.

### Patch project network restrictions

**Slug:** `SUPABASE_PATCH_NETWORK_RESTRICTIONS`

Updates project's network restrictions by incrementally adding or removing IPv4/IPv6 CIDR blocks. Use when you need to modify existing restrictions without replacing the entire configuration.

### Push a database branch

**Slug:** `SUPABASE_PUSH_BRANCH`

Pushes a database branch, applying migrations and changes to the specified branch. Use when you need to deploy schema changes or migrations to a database branch.

### Reset a database branch

**Slug:** `SUPABASE_RESET_DATABASE_BRANCH`

Resets an existing Supabase database branch, identified by `branch_id`, to its initial clean state, irreversibly deleting all its current data and schema changes.

### Restore database PITR backup

**Slug:** `SUPABASE_RESTORE_PITR_BACKUP`

Restores a Supabase project's database to a specific Unix timestamp using Point-in-Time Recovery (PITR), overwriting the current state; requires a paid plan with PITR and physical backups enabled.

### Execute read-only database query

**Slug:** `SUPABASE_RUN_READ_ONLY_QUERY`

[Beta] Run a SQL query as supabase_read_only_user. Use when you need to safely execute SELECT queries without risk of modifying data. Only read operations are allowed.

### Select From Table

**Slug:** `SUPABASE_SELECT_FROM_TABLE`

Tool to select rows from a Supabase/PostgREST table. Use for read-only queries with filtering, sorting, and pagination.

### Update a function

**Slug:** `SUPABASE_UPDATE_A_FUNCTION`

Updates an existing Supabase Edge Function's properties (like name, slug, source code, JWT settings, import map) identified by project `ref` and `function_slug`, supporting plain text code or ESZIP for the body. Use RETRIEVE_A_FUNCTION_BODY action first to get the current source code, as this action requires sending the complete function code, not just the changes.

### Update database branch config

**Slug:** `SUPABASE_UPDATE_DATABASE_BRANCH_CONFIG`

Updates the configuration of a Supabase database branch, allowing modification of its name, associated Git branch, reset-on-push behavior, persistence, and status. Note: Database branching requires a paid Supabase plan (Pro or higher). This action requires a valid branch_id which must be exactly 20 lowercase alphabetic characters. Authentication: - Requires a valid Bearer token in the Authorization header. - Token format: 'Bearer <access_token>' Required Scope: - Environment:Write

### Update database password

**Slug:** `SUPABASE_UPDATE_DATABASE_PASSWORD`

Updates the database password for a Supabase project. Use when needing to rotate credentials or recover database access.

### Bulk update functions

**Slug:** `SUPABASE_UPDATE_FUNCTIONS`

Tool to bulk update Edge Functions in a Supabase project. Use when you need to update multiple functions at once with new configurations such as status, version, or other properties.

### Update JIT access config

**Slug:** `SUPABASE_UPDATE_JIT_ACCESS_CONFIG`

[Beta] Update a Supabase project's just-in-time (JIT) access configuration. Use to enable or disable JIT access features for privileged operations on the project.

### Update pgsodium root key

**Slug:** `SUPABASE_UPDATE_PGSODIUM_CONFIG`

Critically updates or initializes a Supabase project's pgsodium root encryption key for security setup or key rotation, requiring secure backup of the new key to prevent irreversible data loss.

### Update a project

**Slug:** `SUPABASE_UPDATE_PROJECT`

Updates a Supabase project's configuration (currently supports updating the project name). Use when you need to rename an existing project.

### Update project's auth config

**Slug:** `SUPABASE_UPDATE_PROJECT_AUTH_CONFIG`

Update Supabase project Auth configuration via the Management API. Use to fix misconfigured Auth redirects, SMTP settings, or other auth parameters. Only provided fields are updated; others remain unchanged. Before updating, confirm the Auth service status is ACTIVE_HEALTHY by checking project health.

### Update project's custom hostname configuration

**Slug:** `SUPABASE_UPDATE_PROJECT_CUSTOM_HOSTNAME`

Updates the custom hostname for a Supabase project, requiring subsequent DNS changes to a user-controlled domain for SSL certificate issuance and domain ownership.

### Update project legacy API keys

**Slug:** `SUPABASE_UPDATE_PROJECT_LEGACY_API_KEYS`

Tool to disable or re-enable JWT-based legacy API keys (anon, service_role) for a Supabase project. Use when you need to toggle legacy API key access for security or migration purposes. Note: This API endpoint may be removed in the future - check for HTTP 404 Not Found if the endpoint is no longer available.

### Update project's postgres config

**Slug:** `SUPABASE_UPDATE_PROJECT_POSTGRES_CONFIG`

Updates specified PostgreSQL configuration parameters for an existing Supabase project (`ref`) to optimize database performance; note that unspecified parameters remain unchanged, and caution is advised as incorrect settings can impact stability or require a restart.

### Update project's PostgREST config

**Slug:** `SUPABASE_UPDATE_PROJECT_POSTGREST_CONFIG`

Updates PostgREST configuration settings (e.g., `max_rows`, `db_pool`, `db_schema`, `db_extra_search_path`) for a Supabase project to fine-tune API performance, data exposure, and database resource usage.

### Update database pooler config

**Slug:** `SUPABASE_UPDATE_PROJECT_SUPAVISOR_CONFIG`

Updates the Supavisor (database pooler) configuration, such as `default_pool_size`, for an existing Supabase project identified by `ref`; the `pool_mode` parameter in the request is deprecated and ignored.

### Update SSL enforcement config

**Slug:** `SUPABASE_UPDATE_SSL_ENFORCEMENT_CONFIG`

Updates the SSL enforcement configuration (enable/disable) for a specified Supabase project's database.

### Update an SSO provider by its UUID

**Slug:** `SUPABASE_UPDATE_SSO_PROVIDER`

Updates an existing SSO provider's SAML metadata, associated email domains, or attribute mappings for a Supabase project, identified by `ref` and `provider_id`.

### Upsert migration

**Slug:** `SUPABASE_UPSERT_MIGRATION`

Tool to upsert a database migration without applying it. Use when you need to track migration changes for a project. [Beta] This endpoint stores migration metadata without executing the SQL.

### Reverify custom hostname

**Slug:** `SUPABASE_VERIFY_CUSTOM_HOSTNAME_DNS`

Re-verifies DNS and SSL configurations for an existing custom hostname associated with a Supabase project.