Self-Hosted Supabase MCP Server

Instructions

Implementation Reference

• src/tools/verify_jwt_secret.ts:29-43 (handler)

  The execute handler function implementing the core logic of the verify_jwt_secret tool: retrieves the JWT secret via the client and returns status with a preview if found.

  execute: async (input: VerifyJwtInput, context: ToolContext) => {
      const client = context.selfhostedClient;
      const secret = client.getJwtSecret();
  
      if (secret) {
          // Return only a preview for security
          const preview = `${secret.substring(0, Math.min(secret.length, 5))}...`;
          return {
              jwt_secret_status: 'found',
              jwt_secret_preview: preview,
          };
      }
  
      return { jwt_secret_status: 'not_configured' };
  },

• src/tools/verify_jwt_secret.ts:6-20 (schema)

  Input (empty), output, and MCP static JSON schemas defining the structure and validation for the verify_jwt_secret tool.

  const VerifyJwtInputSchema = z.object({});
  type VerifyJwtInput = z.infer<typeof VerifyJwtInputSchema>;
  
  // Output schema
  const VerifyJwtOutputSchema = z.object({
      jwt_secret_status: z.enum(['found', 'not_configured']).describe('Whether the JWT secret was provided to the server.'),
      jwt_secret_preview: z.string().optional().describe('A preview of the JWT secret (first few characters) if configured.'),
  });
  
  // Static JSON Schema for MCP capabilities
  const mcpInputSchema = {
      type: 'object',
      properties: {},
      required: [],
  };

• src/tools/verify_jwt_secret.ts:23-44 (registration)

  Primary registration/definition of the verifyJwtSecretTool, exporting the complete tool object with name, description, schemas, and handler.

  export const verifyJwtSecretTool = {
      name: 'verify_jwt_secret',
      description: 'Checks if the Supabase JWT secret is configured for this server and returns a preview.',
      inputSchema: VerifyJwtInputSchema,
      mcpInputSchema: mcpInputSchema,
      outputSchema: VerifyJwtOutputSchema,
      execute: async (input: VerifyJwtInput, context: ToolContext) => {
          const client = context.selfhostedClient;
          const secret = client.getJwtSecret();
  
          if (secret) {
              // Return only a preview for security
              const preview = `${secret.substring(0, Math.min(secret.length, 5))}...`;
              return {
                  jwt_secret_status: 'found',
                  jwt_secret_preview: preview,
              };
          }
  
          return { jwt_secret_status: 'not_configured' };
      },
  }; 

• src/index.ts:112-112 (registration)

  Server-side registration of verifyJwtSecretTool into the availableTools map for MCP server initialization.

  [verifyJwtSecretTool.name]: verifyJwtSecretTool as AppTool,

• src/client/index.ts:358-360 (helper)

  Supporting getter method in SelfhostedSupabaseClient for retrieving the configured JWT secret, directly called by the tool handler.

  public getJwtSecret(): string | undefined {
      return this.options.jwtSecret;
  }