Hermes Supabase MCP
# Hermes Supabase MCP
A local, constrained MCP server for Supabase structured data. It exposes PostgREST CRUD tools without exposing arbitrary SQL. Tables can be restricted with `SUPABASE_ALLOWED_TABLES`.
## Configuration
Set these in `/home/jstarcher/.hermes/.env`:
```env
SUPABASE_URL=https://rjoebxpiajgjglemtayk.supabase.co
SUPABASE_SECRET_KEY=sb_secret_...
SUPABASE_ALLOWED_TABLES=school_menus,menu_items
```
`SUPABASE_SERVICE_ROLE_KEY` remains accepted temporarily for migration, but `SUPABASE_SECRET_KEY` takes precedence.
## Local test
```bash
uv run --project /home/jstarcher/supabase-mcp --with pytest pytest -q
```
## Hermes configuration
Add the MCP server to Hermes with the supported config command rather than hand-editing YAML:
```bash
hermes config set mcp_servers.supabase.command /home/jstarcher/supabase-mcp/.venv/bin/supabase-mcp
hermes config set mcp_servers.supabase.timeout 60
hermes config set mcp_servers.supabase.connect_timeout 30
```
The MCP subprocess receives only explicitly configured environment variables. The next step is to add the Supabase variables to that MCP entry or use the project `.env` loading mechanism supported by the active Hermes version, then restart Hermes.
TDQS
Scored across 6 tools
Each tool maps to a distinct CRUD operation or health check, with insert vs. upsert boundaries clearly explained (insert fails on conflict, upsert merges with conflict keys). No overlapping purposes that would cause misselection.
All tool names follow the same supabase_<operation> snake_case pattern. 'health' is the only non-verb label, but it remains a clear operation name within the same prefix convention.
Six tools are well-scoped for safe table-row operations plus a connectivity check. Each tool earns its place without redundancy or filler.
The set provides full CRUD lifecycle coverage (select, insert, upsert, update, delete) plus a health check for the stated allowed-table domain. No obvious dead ends exist for safe PostgREST-based row operations, though schema introspection or RPC is outside the apparent scope.