Hermes Supabase MCP
Provides PostgREST CRUD tools for interacting with Supabase structured data, allowing operations on allowed tables without exposing arbitrary SQL.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Hermes Supabase MCPshow me the school menus"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hermes Supabase MCP
A local, constrained MCP server for Supabase structured data. It exposes PostgREST CRUD tools without exposing arbitrary SQL. Tables can be restricted with SUPABASE_ALLOWED_TABLES.
Configuration
Set these in /home/jstarcher/.hermes/.env:
SUPABASE_URL=https://rjoebxpiajgjglemtayk.supabase.co
SUPABASE_SECRET_KEY=sb_secret_...
SUPABASE_ALLOWED_TABLES=school_menus,menu_itemsSUPABASE_SERVICE_ROLE_KEY remains accepted temporarily for migration, but SUPABASE_SECRET_KEY takes precedence.
Related MCP server: Supabase MCP Server
Local test
uv run --project /home/jstarcher/supabase-mcp --with pytest pytest -qHermes configuration
Add the MCP server to Hermes with the supported config command rather than hand-editing YAML:
hermes config set mcp_servers.supabase.command /home/jstarcher/supabase-mcp/.venv/bin/supabase-mcp
hermes config set mcp_servers.supabase.timeout 60
hermes config set mcp_servers.supabase.connect_timeout 30The MCP subprocess receives only explicitly configured environment variables. The next step is to add the Supabase variables to that MCP entry or use the project .env loading mechanism supported by the active Hermes version, then restart Hermes.
Available Tools
6 toolssupabase_deleteB
Delete rows matching required filters; unrestricted deletes are rejected.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | ||
| filters | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. It usefully discloses that unfiltered deletes are refused, which is real behavioral information for a destructive op. But it omits irreversibility, permission/auth requirements, and any side effects on related rows.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words, and the safety-relevant constraint is stated. It is arguably too terse for a destructive tool, but it is not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive two-parameter mutation with no annotations, no output schema, and 0% schema coverage, one sentence is not enough. Filter syntax, table qualification, permissions, and return/confirmation behavior are all absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the filters parameter is an opaque nested object of string values, so the description is the only source of param meaning. It only restates that filters are required (already in the schema) and never explains filter key/value syntax or how table names are resolved, leaving the critical filter format undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (delete) and resource (rows) and the scope condition (matching required filters). It is clearly distinguishable from siblings like supabase_select/insert/update, though it never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clause 'unrestricted deletes are rejected' tells the agent that filters are mandatory, which is useful precondition guidance. However, it offers no when-to-use framing, no guidance on delete vs upsert/update, and no prerequisites such as permissions or required confirmation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
supabase_healthA
Check connectivity to the configured Supabase project.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the burden, but the operation is a simple non-mutating probe and the presence of an output schema covers the result shape. It does not state whether the check is read-only (it inherently is), whether it can fail/time out, or what conditions constitute 'unhealthy', leaving modest gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is appropriately sized, though it errs toward minimalism for a tool whose failure modes an agent might benefit from knowing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and with zero parameters the schema is trivial. The definition is nearly complete for such a simple probe, missing only a note on failure/timeout semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline 4 applies. The empty schema is self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: checking connectivity to the configured Supabase project. This clearly separates it from the data-mutation siblings (select/insert/upsert/update/delete) without needing to name them. It stops just short of 5 because it doesn't articulate what 'health' covers beyond connectivity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the nature of a health check (verify the project is reachable before issuing data operations), but no explicit when-to-use or when-not-to-use guidance is given. For a single-purpose probe this is adequate but not instructive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
supabase_insertC
Insert rows into an allowed table and return inserted records.
| Name | Required | Description | Default |
|---|---|---|---|
| rows | Yes | ||
| table | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden for a write operation. It discloses the return of inserted records and the vague 'allowed table' restriction, but says nothing about conflict/duplicate handling, permission requirements, batch size limits, or whether the write is reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler and no redundancy. Its brevity reflects missing content rather than wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and 0% parameter coverage, the description is too thin. It partially compensates by mentioning the return value, but omits error/conflict behavior and the constraint that makes a table 'allowed'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for both required parameters, so the description must compensate. It only restates that rows go into a table, adding no detail on the shape of each row object, required keys, or batch limits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (insert), resource (rows), and target (an allowed table), plus the return behavior (inserted records). It is clear on its own but never distinguishes itself from the close sibling supabase_upsert, which an agent must choose against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use insert versus upsert, update, or select, which are all present as siblings. The phrase 'allowed table' hints at a precondition but does not explain it as a usage rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
supabase_selectC
Read rows from an allowed table using PostgREST filter expressions.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| order | No | ||
| table | Yes | ||
| columns | No | * | |
| filters | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and largely fails: it discloses nothing about the 100-row default limit, ordering behavior, pagination, error/permission responses, or the read-only nature implied by the verb. "Allowed table" is the sole behavioral hint, which is far short of what a 5-parameter data-access tool needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the core verb front-loaded and zero filler. It is concise, but the brevity comes at the cost of the parameter and behavior detail the tool actually needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter database read with no annotations, no output schema, and 0% schema description coverage, the description is too thin to be complete. An agent cannot infer the filter expression format, pagination behavior, or return shape from what is provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for five undocumented parameters. It adds only that filtering uses "PostgREST filter expressions" — useful syntax context for `filters` — while `limit`, `order`, `columns`, and `table` receive no explanation at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ("Read rows") and resource ("table") are stated plainly, and the name plus the read-vs-write sibling set (insert/upsert/update/delete) makes the operation's role clear. However, the description itself never contrasts with those siblings, so the differentiation relies on the tool name rather than the text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no statement that this is the read path contrasted with supabase_insert/update/delete, and no prerequisites or exclusions. The only hint is the phrase "allowed table," which gestures at permissions but gives no actionable conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
supabase_updateB
Update rows matching required filters; unrestricted updates are rejected.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | ||
| values | Yes | ||
| filters | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does disclose one real guardrail: unrestricted updates are rejected. It says nothing about permission requirements, reversibility of the mutation, affected-row counts, or what the response contains, which is a significant gap for a write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence, front-loaded with the core action and the key constraint. It is efficient, though it is arguably too terse given how much is left undocumented.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, nested filter/values objects, and 0% parameter coverage, the description is under-specified. An agent still lacks filter syntax, value formatting, and confirmation of what a successful update returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for all three required parameters. It conveys that 'filters' is required and match-based, but gives no syntax for filter operators, no format guidance for 'values', and no explanation of 'table'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Update rows matching required filters,' giving a clear verb (update) plus resource (rows) and the scoping mechanism. It does not explicitly name the near sibling supabase_upsert, so it is clear but not sibling-differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage by stating filters are required and that unrestricted updates are rejected, which tells the agent the precondition for calling it. However, it never contrasts with supabase_upsert, supabase_insert, or supabase_delete, so alternative selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
supabase_upsertC
Insert or merge rows, optionally using a comma-separated conflict key list.
| Name | Required | Description | Default |
|---|---|---|---|
| rows | Yes | ||
| table | Yes | ||
| on_conflict | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full behavioral burden. It does not state whether matching rows are fully overwritten or selectively merged, what permissions are needed, whether the operation is transactional, or what is returned. Only the vague word 'merge' hints at conflict behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the conflict-key detail is placed at the end where it belongs as an optional modifier. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with zero annotations, zero schema description coverage, and no output schema, the description is too thin. It omits return behavior, conflict-resolution semantics (overwrite vs merge per column), and permission requirements that an agent needs before invoking a write operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema gives no meaning for any parameter. The description rescues on_conflict by defining it as a 'comma-separated conflict key list', a real format detail absent from the schema. It adds nothing about rows (batch shape, partial vs full rows) or table, leaving two of three parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Insert or merge rows'), which conveys the upsert semantics and implicitly distinguishes it from a plain insert by mentioning merging. However, it never names supabase_insert or supabase_update, so an agent must infer the boundary between this tool and those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to prefer this over supabase_insert or supabase_update, nor any mention of prerequisites such as the table existing or a unique constraint being present for the conflict key. Usage is implied only by the word 'merge'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
supabase_delete - First observed
supabase_health - First observed
supabase_insert - First observed
supabase_select - First observed
supabase_update - First observed
supabase_upsert
TDQS
Scored across 6 tools
Each tool maps to a distinct CRUD operation or health check, with insert vs. upsert boundaries clearly explained (insert fails on conflict, upsert merges with conflict keys). No overlapping purposes that would cause misselection.
All tool names follow the same supabase_<operation> snake_case pattern. 'health' is the only non-verb label, but it remains a clear operation name within the same prefix convention.
Six tools are well-scoped for safe table-row operations plus a connectivity check. Each tool earns its place without redundancy or filler.
The set provides full CRUD lifecycle coverage (select, insert, upsert, update, delete) plus a health check for the stated allowed-table domain. No obvious dead ends exist for safe PostgREST-based row operations, though schema introspection or RPC is outside the apparent scope.
Maintenance
Related MCP Connectors
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Your Supabase account in natural language: run SQL, apply migrations, manage tables, storage, edge f
Manage Supabase projects end to end across database, auth, storage, realtime, and migrations. Moni…
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to perform CRUD operations on Supabase databases through natural language. Supports advanced filtering, pagination, and safety checks for seamless database interaction.MIT
- AlicenseNot gradedqualityNot gradedmaintenanceEnables AI assistants to interact with Supabase databases through standardized CRUD operations including querying, inserting, updating, and deleting records with support for filtering, pagination, and column selection.-
- AlicenseNot gradedqualityDmaintenanceEnables secure interaction with Supabase databases via the PostgREST API, supporting full CRUD operations and stored procedure calls. It utilizes the Dedalus MCP framework to provide encrypted credential handling and just-in-time token exchange.4MIT
- AlicenseNot gradedqualityBmaintenanceProvides secure access to Supabase databases via PostgREST API and management tools for projects, schemas, branches, logs, and code generation.MIT