Supabase scoped access tokens: give your AI agent one project, not your whole account

Supabase personal access tokens can now be limited to specific organisations and projects, with per-area permissions and an expiry of up to a year, plus a low, medium or high risk banner when you create one. They work with the Supabase MCP server, the Management API and the CLI; with only database read access, the MCP server's SQL tool becomes read-only. Fact vs hype: real and documented, but not brand new: it's been generally available since 28 September and is now the default, so the post is a reminder. Gotchas: the 'Read-only' preset still includes API-key secrets, so start from 'No access' and add only what you need; logging in to the CLI through the browser still creates a full-access token; and a database password set in the environment bypasses token permissions. It's included on all plans.

Why it mattersThe simplest security win for anyone letting Claude Code, Cursor or an MCP server near a database: create a token for one project with only database read access and a one-week expiry, and give the agent that.

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.