---
title: "Supabase MCP in Slack: ask an AI teammate to query your project | Chickpea"
description: "Use Supabase's MCP server from Slack. Give a channel an AI teammate pinned to one project, then ask it for rows, a query, or the advisors. Open source."
canonical: https://chickpea.co/connectors/supabase
keyword: "Supabase MCP in Slack"
verified: 2026-09-17
---

# Ask a Supabase project a question in Slack, on Supabase's MCP server.

> Chickpea gives a channel a named AI teammate that holds its own Supabase connection. It signs in with OAuth and calls Supabase's MCP server, so there is no client to configure and no key to paste. The connection is pinned to one project, read-only unless you say otherwise, and Supabase asks you to use a development project rather than production.

Facts checked against the sources on September 17, 2026. The HTML page is at https://chickpea.co/connectors/supabase; every connector is listed at https://chickpea.co/connectors; the site index for agents is at https://chickpea.co/llms.txt.

**Supabase** (Supabase, Inc., https://supabase.com): Manage projects, databases, storage, functions, and development settings. Category: Data and infrastructure. Lane: Vendor MCP server. Sign in: OAuth.

**Chickpea**: an open source Slack app that gives a workspace named AI teammates, each with its own handle, instructions, memory, connected accounts, schedules, and model, deployed to your own Cloudflare account or a Node host.

## What people ask it
The teammate in these examples is @oncall, published to #eng.

### Tables, rows, and migrations
- @oncall what tables are in the staging project, and how many rows in each
- @oncall which migrations landed this week, and what did they change

Supabase's database tools list tables, extensions, and migrations, so this is one round trip and no SQL from you. Reads never need confirmation, and a long answer comes back as a table in the thread.

### Run a query
- @oncall how many orders went to failed since Monday, by error code
- @oncall find the customers with more than one refund this month

Say what you want to know and the teammate writes the SQL. On a read-only connection Supabase runs every query as a read-only Postgres user, so a query that tried to change something would fail at the database rather than at the prompt.

### Logs and advisors
- @oncall what is in the API logs for the last hour, worst first
- @oncall what do the security and performance advisors flag on staging

Supabase's debugging tools run read-only queries against project logs and return its security and performance advisors. Useful when a deploy went out and nobody wants to open the dashboard to find out what it did.

### Edge functions and schema changes
- @oncall which edge functions are deployed, and when did each last change
- @oncall add a nullable retry_count integer to orders and apply it as a migration

Listing or reading an edge function is a read. Deploying one, or applying a migration, changes the project, so the teammate shows what it would do and waits for a yes. It also needs your message to name that action, because a thread on its own cannot authorize one.

### On a schedule
- @oncall every weekday at 9am Pacific, post the advisors for staging here
- @oncall every Monday at 8am Eastern, post the row counts for orders and refunds

A schedule saves on the spot. It needs an explicit time zone, runs under the Supabase connection of the person who asked, and fails with a named reason rather than running if that connection is disconnected. Supabase asks that unattended work like this run read-only.

### Example conversations

**What is in the project**
> **Dana:** @oncall what tables are in the staging project, and how many rows in each?
> **@oncall:** Six tables in public, on the staging project. Row counts are as of now, and nothing here changed.
>
> | Table | Rows | Size | Last migration |
> |---|---|---|---|
> | orders | 48,210 | 62 MB | Sep 15 |
> | order_items | 151,884 | 188 MB | Sep 15 |
> | customers | 12,047 | 9 MB | Aug 28 |
> | refunds | 1,905 | 2 MB | Sep 15 |
> | webhook_events | 92,663 | 140 MB | Sep 09 |
> | sessions | 6,418 | 4 MB | Aug 12 |

**Run a query**
> **Marco:** @oncall in staging, how many orders went to failed since Monday, and what are the top error codes?
> **@oncall:** 412 orders failed since Mon Sep 14. Three codes cover 380 of them, and card_declined is flat week over week. The jump is gateway_timeout, which was 11 last week.
>
> | Error code | Orders | Last week |
> |---|---|---|
> | gateway_timeout | 212 | 11 |
> | card_declined | 118 | 124 |
> | insufficient_funds | 50 | 47 |
> | other | 32 | 29 |

**Apply a migration**
> **Priya:** @oncall add a nullable retry_count integer to orders in staging and apply it as a migration.
> **@oncall:** Here is what I would apply to staging, as migration add_orders_retry_count: alter table public.orders add column retry_count integer; It is nullable, so nothing backfills and no row changes. A migration changes the schema, so I will wait. Go ahead?
> Buttons: Yes, apply it · Show me the schema first

**Every weekday**
> **Sofia:** @oncall every weekday at 9am Pacific, post the security and performance advisors for staging here.
> **@oncall:** Saved. Every weekday at 9:00 AM Pacific I’ll post what the advisors flag on staging, security first, in #eng. First run is Thu Sep 18. It runs on your Supabase connection, so say "pause the morning advisors" to stop it.

## Connect Supabase
1. Pick the project. Chickpea's catalog says to use a development or test project rather than production data, and Supabase says to connect to a production project only when the task needs production evidence. Have that project's reference ready.
2. In Chickpea Admin, open the teammate, then **Connections**, find **Supabase**, and choose **Connect**. Or ask in Slack, `@oncall connect Supabase`, and follow the link it posts.
3. Choose who uses it. **Team** is one shared Supabase account that everyone who can use the teammate acts through. **Personal** means each member signs in as themselves.
4. Give the project reference, then choose **read-only** or **read and write**. Read-only is the recommended default: Supabase runs every query as a read-only Postgres user. Choose **Continue to sign in**, and Supabase asks you to approve the organization and the projects it may reach.
5. Chickpea connects to [mcp.supabase.com/mcp](https://supabase.com/docs/guides/getting-started/mcp) and records the tools the server answered with. Ask something. `@oncall what tables are in the project` is a good first question, because it reads and cannot change anything.

A connection belongs to one teammate. Giving a second teammate Supabase means a second sign-in with its own consent and its own project reference, so a support teammate never inherits the project the on-call teammate can reach.

## What the teammate is handed with Supabase
There is no built-in Chickpea skill for Supabase, and none is needed. The tools arrive from Supabase's MCP server: Chickpea connects before it saves anything, records what the server answered with, and exposes only those tools. Supabase groups them by feature, and the ones a channel uses are database (tables, extensions, migrations, SQL), debugging (logs and the security and performance advisors), edge functions, development, and docs search. Account management is switched off whenever the connection is pinned to one project.

Supabase documents the server and its feature groups: https://supabase.com/docs/guides/getting-started/mcp

## Beside Supabase
- **Sentry:** The stack trace in Sentry, then the rows behind it in Supabase
- **PostHog:** What the product data says beside what the database says
- **Linear:** A query that turns up a bug becomes an issue with the numbers in it
- **Neon:** Postgres in two places, one teammate that can read either
- All 37 connectors: https://chickpea.co/connectors

## Questions people ask

### Is there an MCP for Supabase?
Yes. Supabase runs a hosted MCP server at mcp.supabase.com/mcp, and the local CLI serves one at localhost:54321/mcp. Sign-in uses dynamic client registration against your Supabase organization, so there is no token to create. Chickpea connects to that same hosted server, which is how a teammate in Slack uses it with no client installed.

### Is the Supabase MCP read only?
Not by default on Supabase's side. Read-only is a setting, and Supabase describes it as executing all queries as a read-only Postgres user. In Chickpea it is a question you answer when you connect, and read-only is the recommended default. Supabase also asks that unattended routines run read-only, which covers anything on a schedule.

### Is it safe to point this at production?
The product's own catalog says no: the Supabase preset is intended for a development or test project, not production data, with read-only as the recommended default. Supabase puts it as connecting to a production project only when the task needs production evidence, and suggests a development branch for testing. The risk it names is prompt injection, where untrusted content inside your data tries to steer the model. A read-only connection on a development project takes most of that off the table.

### Does it use Supabase's MCP server or the API?
The MCP server. Supabase is a vendor MCP lane: the deployment connects to mcp.supabase.com/mcp over streamable HTTP and signs in with OAuth. There is no database password, service role key, or connection string anywhere in this connector, and the connection cannot reach any other address.

### Can it run a migration or delete data?
That depends on how you connected it. On a read-only connection it cannot, because Supabase runs the queries as a read-only Postgres user. On a read and write connection the database tools can apply a migration and edge function tools can deploy. Two things sit in front of that. A schema change is consequential, so the teammate shows what it would do and waits for a yes. Underneath, during a Slack turn Chickpea refuses any MCP tool whose name does not start with an unambiguous read verb unless your message names that action, and thread history, retrieved content, and memory cannot authorize one.

### How do I set up the Supabase MCP?
For a coding client, follow Supabase's own docs, since each client keeps its own config file. For Slack there is nothing to configure. Open the teammate in Chickpea Admin, choose Supabase, give the project reference, pick read-only or read and write, and sign in. Or ask "@oncall connect Supabase" in the channel and follow the link it posts.

### Can I use this from Claude Code or Cursor instead?
Yes, and Supabase documents both. Those put the server in one person's editor, scoped to that person's developer permissions. A teammate puts it in a channel, with a stored connection, saved instructions, schedules, and every query visible in the thread where someone asked for it. Teams often run both, and the editor one usually points at a different project.

### What does it see in the project, and what stays hidden?
What the connection was given. The project reference pins it to one project and switches off the account management tools, so it cannot wander into your other projects. Supabase leaves storage tools off unless they are turned on, and the binding in Chickpea is a ceiling: it can later be narrowed to fewer tools but never widened, and reauthorizing the Supabase account with more access does not widen the teammate.

### Do I still need a Supabase Slack integration?
What Supabase's own pages offer for Slack is an Edge Function example that answers a Slack mention, and a Sign in with Slack auth provider. Teams that want more than that usually build the Edge Function or wire the two together through an automation tool. A Chickpea teammate is a different thing again: it holds the Supabase connection itself and answers in the channel, through Supabase's MCP server, with nothing to host.

### Does everyone act as the same Supabase user?
That is your choice when you connect. A team account is one shared sign-in that everyone with access to the teammate acts through. A personal account belongs to one member inside one teammate, so your sign-in is used only for your requests. Either way the OAuth token lives on your deployment, outside the teammate record. It never enters the model's context, the tool arguments the model writes, or Slack. Disconnect the account and the stored secret is removed, and any schedule that depended on it stops.

## Sources
- [Chickpea docs: connector catalog, the Supabase preset, its lane and the development-project note](https://docs.chickpea.co/reference/connector-catalog/)
- [Chickpea docs: connections, team and personal accounts, the binding as a ceiling](https://docs.chickpea.co/agents/connections/)
- [Chickpea docs: authority and confirmation, including the read-verb gate](https://docs.chickpea.co/security/authority-and-confirmation/)
- [Chickpea docs: connect a service, the project reference and the read-only choice](https://docs.chickpea.co/agents/connect-a-service/)
- [Chickpea docs: schedules, time zones and what each run rechecks](https://docs.chickpea.co/agents/schedules/)
- [Chickpea source: the Supabase preset (server URL, transport, OAuth scope, the project note)](https://github.com/pejmanjohn/chickpea/blob/main/src/config/presets.ts)
- [Chickpea source: an MCP connection exposes approved tools that are still discovered](https://github.com/pejmanjohn/chickpea/blob/main/src/config/types.ts)
- [Supabase docs: the MCP server, its URL, feature groups, read-only mode and project scoping](https://supabase.com/docs/guides/getting-started/mcp)
- [Supabase docs: AI tools, the MCP page the Chickpea preset links to](https://supabase.com/docs/guides/ai-tools/mcp)
- [Supabase docs: an Edge Function that answers a Slack mention](https://supabase.com/docs/guides/functions/examples/slack-bot-mention)
- [Chickpea source on GitHub](https://github.com/pejmanjohn/chickpea)

## More
- [Ahrefs MCP in Slack](https://chickpea.co/connectors/ahrefs.md)
- [Airtable MCP in Slack](https://chickpea.co/connectors/airtable.md)
- [Asana AI agent in Slack](https://chickpea.co/connectors/asana.md)
- [Jira and Confluence MCP in Slack](https://chickpea.co/connectors/atlassian.md)
- [BugSnag MCP in Slack](https://chickpea.co/connectors/bugsnag.md)
- [Cloudflare MCP in Slack](https://chickpea.co/connectors/cloudflare-api.md)
- [Exa MCP in Slack](https://chickpea.co/connectors/exa.md)
- [Firecrawl MCP in Slack](https://chickpea.co/connectors/firecrawl.md)
- [Fireflies MCP in Slack](https://chickpea.co/connectors/fireflies.md)
- [Gamma MCP in Slack](https://chickpea.co/connectors/gamma.md)
- [Gmail AI agent in Slack](https://chickpea.co/connectors/gmail.md)
- [Gong AI agent in Slack](https://chickpea.co/connectors/gong-managed.md)
- [Google Ads AI agent in Slack](https://chickpea.co/connectors/google-ads.md)
- [Google Analytics AI agent in Slack](https://chickpea.co/connectors/google-analytics.md)
- [Google Calendar AI agent in Slack](https://chickpea.co/connectors/google-calendar.md)
- [Google Docs AI agent in Slack](https://chickpea.co/connectors/google-docs.md)
- [Google Drive AI agent in Slack](https://chickpea.co/connectors/google-drive.md)
- [Google Search Console AI agent in Slack](https://chickpea.co/connectors/google-search-console.md)
- [Google Sheets AI agent in Slack](https://chickpea.co/connectors/google-sheets.md)
- [Google Slides AI agent in Slack](https://chickpea.co/connectors/google-slides.md)
- [Granola MCP in Slack](https://chickpea.co/connectors/granola.md)
- [HubSpot AI agent in Slack](https://chickpea.co/connectors/hubspot-managed.md)
- [Hugging Face MCP in Slack](https://chickpea.co/connectors/huggingface.md)
- [incident.io MCP in Slack](https://chickpea.co/connectors/incident-io.md)
- [Intercom MCP in Slack](https://chickpea.co/connectors/intercom.md)
- [Linear MCP in Slack](https://chickpea.co/connectors/linear.md)
- [LunarCrush MCP in Slack](https://chickpea.co/connectors/lunarcrush.md)
- [Meta Ads MCP in Slack](https://chickpea.co/connectors/meta-ads.md)
- [Monday.com MCP in Slack](https://chickpea.co/connectors/monday.md)
- [Neon MCP in Slack](https://chickpea.co/connectors/neon.md)
- [Notion Slack integration with an AI agent](https://chickpea.co/connectors/notion-managed.md)
- [PostHog MCP in Slack](https://chickpea.co/connectors/posthog.md)
- [Sentry MCP in Slack](https://chickpea.co/connectors/sentry.md)
- [Stripe MCP in Slack](https://chickpea.co/connectors/stripe.md)
- [YouTube AI agent in Slack](https://chickpea.co/connectors/youtube-managed.md)
- [Zendesk AI agent in Slack](https://chickpea.co/connectors/zendesk.md)
- [All connectors](https://chickpea.co/connectors.md)

## Try Chickpea
- Site: https://chickpea.co/
- Deploy to Cloudflare: https://deploy.workers.cloudflare.com/?url=https://github.com/pejmanjohn/chickpea
- Source, Apache 2.0: https://github.com/pejmanjohn/chickpea
- Docs: https://docs.chickpea.co