Check a Supabase project URL shape. Secrets discarded.
ConnectorNo auth
711,348 tools. Updated 2026-10-28 07:25
"Supabase" matching MCP tools:
- WRITE to the Knowledge Base. This tool has TWO modes: **MODE 1 — SAVE a new card**: Provide `content` with full Markdown following the ACTIONABLE schema below. **MODE 2 — REPORT OUTCOME**: Provide `kb_id` + `outcome` ('success' or 'failure'). WHEN TO USE: - Mode 1: After successfully fixing a bug IF no existing KB card covered it. - Mode 2: ALWAYS after applying a solution from `read_kb_doc` and running verification. INPUT: - `content`: (Mode 1) Full Markdown KB card content — follow the EXACT template below. - `overwrite`: (Mode 1) Set to True to update an existing card. - `kb_id`: (Mode 2) ID of the card to report outcome for. - `outcome`: (Mode 2) 'success' or 'failure'. - `enrichment`: (Mode 2, optional) Additional context to merge into the card when outcome is 'failure'. ━━━ CARD TEMPLATE (Mode 1) — copy this structure EXACTLY ━━━ ``` --- kb_id: "[PLATFORM]_[CATEGORY]_[NUMBER]" # e.g. WIN_TERM_001, CROSS_DOCKER_002 title: "[Short Title — max 5 words]" category: "[terminal|devops|supabase|fastmcp|network|database|...]" platform: "[windows|linux|macos|cross-platform]" technologies: [tech1, tech2] complexity: [1-10] criticality: "[low|medium|high|critical]" created: "[YYYY-MM-DD]" tags: [tag1, tag2, tag3] related_kb: [] --- # [Short Title — max 5 words] > **TL;DR**: [One sentence — what's the problem + solution] > **Fix Time**: ~[X min] | **Platform**: [Windows/Linux/macOS/All] --- ## 🔍 This Is Your Problem If: - [ ] [Symptom 1 — specific symptom or error message] - [ ] [Symptom 2 — specific error code or log line] - [ ] [Symptom 3 — environment/version condition] **Where to Check**: [console / logs / env / task manager / etc.] --- ## ✅ SOLUTION (copy-paste) ### 🎯 Integration Pattern: [Global Scope] / [Inside Init] / [Event Handler] ```[language] # [One-line comment — what this code does] [depersonalized code WITHOUT specific paths, use __VAR__ for things to replace] ``` ### ⚡ Critical (won't work without this): - ✓ **[Critical Point 1]** — [why it's essential] - ✓ **[Critical Point 2]** — [common mistake to avoid] ### 📌 Versions: - **Works**: [OS/library versions where confirmed working] - **Doesn't Work**: [OS/library versions where known broken] --- ## ✔️ Verification (<30 sec) ```bash [single command to verify the fix worked] ``` **Expected**: ✓ [Specific output or behavior that confirms success] **If it didn't work** → see Fallback below ⤵ --- ## 🔄 Fallback (if main solution failed) ### Option 1: [approach name] ```bash [command] ``` **When**: [condition to use this option] | **Risks**: [what might break] ### Option 2: [alternative approach] ```bash [command] ``` **When**: [condition] | **Risks**: [what might break] --- ## 💡 Context (optional) **Root Cause**: [1 sentence — why this problem occurs] **Side Effects**: [what might change after applying the fix] **Best Practice**: [how to avoid this in future — 1 point] **Anti-Pattern**: ✗ [what NOT to do — common mistake] --- **Applicable**: [OS, library versions, conditions] **Frequency**: [rare / common / very common] ``` ━━━ END OF TEMPLATE ━━━ RULES for ACTIONABLE cards: 1. Solution FIRST — after diagnosis, code immediately 2. Depersonalize — no names, project names, or absolute paths 3. Use `__VAR__` markers for anything the user must replace 4. One Verification command, result visible in <30 sec 5. Fallback — 1-2 options max, always include When/Risks 6. Context at End — WHY is optional reading for curious agentsConnectorNo auth
- Side effect when confirmSend is true: sends one current draft email or Slack message for review, but does not publish, schedule, or edit the workflow. Use after authoring or inspection when the user wants to verify an important message before publishing. Returns sent-test details, app URLs, a confirmation request, or a clarification request with user-facing message choices. If the test has no data because row level security hides a source table's rows from Dreamlit, returns error code table_rows_hidden_by_rls with unreadableTables[].fixSql to run, or ask the user to run, in the Supabase SQL editor. Do not expose test target ids as copy; ask users to choose by message label and confirm before sending.ConnectorNo auth
- Check whether one AI or developer API provider (OpenAI, Anthropic, Gemini, Mistral, Groq, GitHub, Stripe, Cloudflare, Vercel, Supabase, Twilio, ~40 total) is up, degraded, or down right now. Use before calling that provider, or right after 5xx/429/timeouts, to choose retry, wait, or a fallback. Not for a model id (check_model_deprecation), the filtered change feed (list_recent_api_changes), or the daily rollup (get_digest). Returns summary, verdict (up|degraded|partially down|down|unknown), recommended_action, incidents, affected_components, checked_at, and freshness; status is rechecked about every 5 minutes. An unknown provider id returns 404 unknown_provider. Example: {"provider":"openai"}. Free within the daily quota, then $0.003 via x402. Alias: get_status.ConnectorNo auth
- Start a Brain document file upload (PDF, DOCX, TXT or Markdown, 10 MB max): returns a signed upload_url that the client PUTs the raw file to, with the returned content-type header, and an upload_id valid for 2 hours. Then call aidelly_complete_brain_document_upload with the upload_id. Works only for clients with direct network access to Supabase storage, such as Claude Code or a local CLI; the hosted server hides it from browser-sandboxed chat clients, which use aidelly_add_brain_document instead. Requires workspace settings permission. Retry-safe with the same idempotency_key.ConnectorNo auth
- Returns 10 HBM market sub-tables: accelerators, specs, marketShare, spotPrices (RETIRED 2026-07-28 — frozen), leadingIndicators, qualificationFeed, revenueForecast, supplierRevenue, validationChecks, bitDemand. Optional `table` parameter narrows to a single sub-table; omitting returns all 10. USE THIS for: HBM3/3e/4 generation specs, SK Hynix/Samsung/Micron share of HBM revenue (marketShare: Q2 2026, Counterpoint Research, the latest quarter; the quarterly series and IDC full-year actuals are get_market_dataset dataset='hbm-market-share'; not share of bit shipments), derived HBM bit demand by SKU class and customer type (bitDemand, EB ranges, monthly). spotPrices is a RETIRED series: no public HBM spot market exists in any generation — HBM sells via annual/multi-year LTAs. Its rows are frozen estimates served for the record with per-row retired marking; for current, sourced HBM pricing use get_market_dataset with dataset='hbm-pricing'. bitDemand is NOT a workload split — it is a SKU-class/customer-type cut. Dominant HBM SKUs are dual-use, so a training-vs-inference HBM attribution would be dishonest; no public source publishes one. DO NOT USE for: HBM price history or current HBM pricing (use get_market_dataset dataset='hbm-pricing'); per-accelerator HBM cost in a specific chip (use get_accelerator_costs.costBreakdown.hbmCostUsd); HBM cost in a hypothetical chip cost calc (use calculate_chip_cost with hbmStacks/hbmCost). Returns INTERNAL_ERROR if the upstream Supabase HBM tables are unreachable. Only two sub-tables refresh on a schedule: qualificationFeed (Mon/Thu) and bitDemand (monthly, 1st). accelerators, specs and validationChecks are hand-curated reference tables, the editorial tables are revised by hand, and spotPrices is frozen (retired 2026-07-28). meta.table_freshness dates each sub-table; meta.data_freshness.stale flags an overdue refresh.ConnectorNo auth
Matching MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables natural-language management of your cloud database backend, including running SQL, applying migrations, managing tables, storage, edge functions, and branches, plus searching documentation. Connects via one-click magic-link without keys or tokens.MIT
- FlicenseNot gradedqualityBmaintenanceEnables direct Postgres queries, storage management, user authentication, edge function invocation, and project administration through 24 grouped tools.-
Matching MCP Connectors
- SupabaseOAuth
MCP server for interacting with the Supabase platform
Your Supabase account in natural language: run SQL, apply migrations, manage tables, storage, edge f
- FIRST STEP in any troubleshooting workflow. Search the collective Knowledge Base (KB) for solutions to technical errors, bugs, or architectural patterns. Uses full-text search across titles, content, tags, and categories. Results are ranked by relevance and success rate. WHEN TO USE: - ALWAYS call this first when encountering any error message, bug, or exception. - Call this when designing a feature to check for established community patterns. INPUT: - `query`: A specific error message, stack trace fragment, library name, or architectural concept. - `category`: (Optional) Filter by category (e.g., 'devops', 'terminal', 'supabase'). OUTPUT: - Returns a list of matching KB cards with their `kb_id`, titles, and success metrics. - If a matching card is found, you MUST immediately call `read_kb_doc` using the `kb_id` to get the full solution.ConnectorNo auth
- Creates a new Dreamlit workflow draft or updates an existing draft from an outcome-oriented natural-language prompt. Use after get_status; use get_workflow_and_preview_url first when editing an existing workflow, then describe the steps to change by what they do, not by step id. Each call continues the workflow's current chat; pass startNewChat to start fresh. Broadcasts that are scheduled, sent, or cancelled can't be edited; duplicate them in the Dreamlit web app instead. Existing Supabase Auth workflows can be edited except for the immutable trigger step; creating Supabase Auth workflows must happen through Supabase Auth email setup in the Dreamlit web app. Side effect: may create or modify a draft, but does not publish or install live triggers. Returns the workflow/draft result, action-required or handoff details when more input is needed, and relevant app URLs. Do not use for publishing, direct database changes, or low-level graph edits.ConnectorNo auth
- Orientation for wiring a redu.cloud capability (backups, DNS, extra storage, a managed DB, ...) INTO an app already deployed on redu, e.g. 'add a backup feature to the Supabase I deployed on redu'. Explains the pattern: mint a LEAST-PRIVILEGE scoped API key (with the user's approval via create_api_key), inject it into the app, and call the redu API from the app. Call this when a user asks to add/integrate a redu feature into a running deployment and you are unsure how.ConnectorNo auth
- Use this when the user, or the agent building the app, wants to check an app they control for exposed files and leaked secret keys before launch. A deeper security scan than check_app_security, for an app the caller controls (for example one the agent itself is building). It looks for sensitive things left publicly reachable: an environment (.env) file, an exposed .git folder, a directory listing, or a published source map. It also reads the app's own public code (the home page and its scripts) for the Supabase project it uses and for secret keys shipped to the browser (a Supabase service role or secret key, a database password, a paid AI key). It never contacts the app's database, never writes, and never stores, logs or returns any key; it reports the exposed PATH or the KIND of key, never a file's contents or a secret value. Because it probes an app directly, each scan runs only after ownership is proven now: call it once to receive a one-time code and a check id, add the code to the app (a meta tag on the home page, or a line in /7it-verify.txt), then call again with the check id and the scan runs.ConnectorNo auth
- Store PUBLIC build settings: the values a web frontend's bundler bakes into the JavaScript every visitor downloads (e.g. Supabase URL, anon key). Names must start with a framework public prefix (NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, NUXT_PUBLIC_, GATSBY_, VUE_APP_, NG_APP_, PUBLIC_). A service_role key, Stripe secret key, database URL, password or any token is NOT public: it goes to lavela.set_compute_secret, and a whole local .env goes through lavela.env_link (never read its values yourself; secrets in chat only if env_link has no secure route); a secret-looking name or value is refused. Stored: nothing restarts, nothing is billed; the NEXT build uses them, so call lavela.compute_rebuild after (confirm first: it replaces the running server). `vars` sets, `unset` removes; with neither, the current set comes back.ConnectorAPI key
- Issues a key so a script — a nightly import, a till, a bank feed — can work in one company without a person signing in. It carries an explicit list of capabilities and nothing else, it can never reach another company, and it cannot hold a capability you do not hold yourself — at issuance and at every use: if you lose a capability or leave the company, the key loses it too. Its posting_mode is fixed now and never raised afterwards: review by default, autopilot only when the user asks for it in so many words. The secret comes back once and is stored only as a hash: show it to the user and say it cannot be read back. Prefer this to sharing anybody’s password, and never suggest a service key.ConnectorDestructiveOAuth
- Takes over the books a user kept elsewhere — a FEC, an XML audit file, an export of journal items, a journal report, a transaction journal, a trial balance, or the export of odoo or xero or quickbooks-online or pennylane or sage-50 or exact-online by name — whole or not at all. Each file is read by the reader of its source; every account of the old chart is matched to one of this company's chart and every old journal to a journal of the company. The codes give a candidate (the same code, the same digits without the padding zeros, or the longest beginning of three digits or more), and what the files say of the old account — its type, its name, the side of its balance — is held against what the chart says the candidate is, never a country: only the same code, not contradicted, is `exact`; anything else is `suggested` with its reason, or `none`. Each old journal is proposed from what its entries touch, never its name — the opening (entries on the first day of a year, balance accounts only), sales, purchases, bank, else the general journal — with its reason under journal_reasons. Call it with dry_run first: it returns the correspondence proposed, the suggestions under mapping.suggested, what is unanswered, and — when everything is answered — what the database would write, rehearsed and rolled back. Show the user every suggested line and its reason first; nothing is posted while one is unconfirmed. Settle each by writing its code under mapping.accounts, or, once the user has read and approved them all, pass accept_suggestions. Every entry is posted through post_entry(); a trial balance becomes the opening entry, on the first day of a year or the day inside it the books were taken over, and the open items beside it (open_items) posted documents that statement matching finds. Imported lines carry no tax and feed no VAT box. The same files twice are refused. The files travel as text, up to 256 KiB in all: a larger export is imported from the terminal with `ekwo import`, which reads it from the disk. Ask the user before the real call.ConnectorDestructiveOAuth
- Sets the prefix one journal prints in place of {CODE} in the numbers it draws — FAC instead of SAL, for instance — or puts its code back with null. The journal keeps its code and its counter: the series goes on at the next number. A prefix another journal of the company already prints is refused. The pattern around it (year, width) is the company's number_format in update_company_profile. Needs settings.write.ConnectorOAuth
- Issues every period that has come on that day: for each schedule of a signed or active contract whose next_on is on or before it, one draft document per period — a sales invoice on a sale, a purchase invoice on a purchase — to the contract's party, contract_reference set to its number, and next_on moved on. Renewals and expiries come first. Twice for the same day issues once: the socle refuses a second document for one period. Drafts stay drafts unless the schedule says auto_post. Show the user what is due first (contracts_deadlines, kinds next_issue) and issue only once they agree; then show the drafts before anything is posted.ConnectorDestructiveOAuth
- See how the BEST products each build the same hard pattern — one call, cross-product. Use before building any complex pattern: compare_recipes("Command Palette") returns a ranked panel (one per product), each entry carrying the at-a-glance layer you pick a reference by — overlay radius, whether it ships a shadow, backdrop filter, the open-motion string and the names of the captured states — so you see that Vercel animates the open where Supabase blurs the backdrop, instead of guessing at the invisible motion/state layer. This is the comparison view; call get_recipe(site, recipe_type) on the one you choose for its full measured anatomy tree, easings, state captures and video. Args: recipe_type: e.g. "Command Palette", "Pricing Table", "Toast", "Data Table", "Multi-step Form". industry: optional filter, e.g. "Dev Tools", "Fintech". scheme: optional "dark" or "light" (matches the recipe's measured overlay background). limit: panel size (1-12, default 8). Returns available recipe types if the requested one has no matches.ConnectorNo auth
- Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.ConnectorNo auth
- Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.ConnectorNo auth
- Use this tool only when the host has already decided to start; if the host is still evaluating, use hemmabo_check_host_readiness instead — it returns the same onboarding URL in next_step. Never call both in the same turn. Return a safe HemmaBo onboarding handoff URL for a vacation-rental host who wants their own booking website or booking engine. Not for guests — guests should use hemmabo_search_properties instead. Use after explaining the fit or when the host asks to start; if the host is still evaluating whether HemmaBo fits, run hemmabo_check_host_readiness first — it already returns the same prefilled URL in its next_step. This tool is read-only and does not create a HemmaBo account, buy a domain, configure Stripe, write to Supabase, or provision a booking site. It returns the URL, the category sentence, the host's price atom, the agent's role, and what the host should prepare. All parameters are optional prefill: they never change where the host lands — the URL always opens the same onboarding page with the passed details filled in; blank values are simply left out, and nothing is stored server-side. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.ConnectorNo auth
- Publishes a posted sales invoice, credit note or quote behind a link the customer opens without an account and without a password: the token in the url is the whole secret. It returns that token once and stores only its hash, so give the url to the customer and say it cannot be read back. The page shows the document as it was sent and what is still owed on it today, so the link stays worth opening after a payment. A purchase document is refused — it is a third party’s own document — and so is a draft. A link is never edited: to change when it expires, withdraw it and make another.ConnectorDestructiveOAuth
- Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), ory (a web hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.ConnectorNo auth