Review Supabase database health
Connect one non-production Supabase project and prepare a bounded, read-only database health brief.
The Supabase database health review template turns schema structure, database advisors, and recent service signals into a prioritized weekly brief. It is designed for staging, development, or other non-production projects—not for production customer data.
Connect a non-production project
An operator must first enable MANAGED_MCP_SUPABASE_ENABLED. Open
Connections → Supabase, enter the project's 20-letter reference, and confirm
that the project is non-production and contains no production customer data.
Continue through Supabase OAuth using a user who has access only to the intended
organization and project.
Supabase's hosted MCP may show broader account-level read scopes on its consent screen than this routine needs. Work on Repeat sends the resulting token only to the exact project-scoped resource above, but cannot narrow Supabase's consent grant itself. Review that screen and use a least-privilege Supabase user. The provider is tracking tool-aware minimum scopes in supabase/mcp#239.
Work on Repeat constructs the hosted MCP target itself. Every connection is fixed to:
- the one confirmed
project_ref; read_only=true; and- only the
databaseanddebuggingfeature groups.
There is no API-key fallback and no UI option to broaden those parameters. To review another project, create a separate confirmed connection.
Runnable boundary
Only four exact, reviewed tools are runnable:
| Tool | Classification | Intended use |
|---|---|---|
list_tables | Read | Inspect table and schema structure. |
execute_sql | Read | Run narrow read-only aggregate or metadata SQL. |
get_advisors | Read | Review Supabase security or performance advisors. |
get_logs | Read | Inspect a bounded service-log window. |
Supabase's server enforces read-only SQL for this connection. Work on Repeat also blocks every tool outside this allowlist and rejects a reviewed tool if its input schema changes. Migrations, schema changes, data writes, project or branch management, Edge Functions, storage, and all newly discovered tools stay unavailable.
Configure and prove the routine
Choose Supabase database health review, attach the confirmed connection, and run it manually before scheduling. The template asks for compact public schema context, security and performance advisors, and only the previous 24 hours of relevant Postgres or API logs. It uses narrow aggregate SQL only when those sources do not answer the question.
Review the first result for its evidence windows and query descriptions. It must not include raw row values, PII, secrets, access tokens, connection strings, or instructions copied from database contents. Keep the connection off any project that may hold production customer data, even if the planned query appears harmless.
If Supabase access is revoked, open Connections and reauthorize. Work on Repeat updates the saved credentials while preserving the original project and read-only bounds. Calls remain subject to the connected Supabase account's limits.
See Supabase's official MCP server guide for its current hosted endpoint, project scoping, read-only mode, feature groups, and security guidance.