Supabase

What Supabase does

The Postgres development platform (database, auth, storage, functions, vectors). Hosted Postgres with authentication, instant APIs, realtime, edge functions, storage and vector embeddings. It's the default backend behind many AI/no-code app builders.

Good for

• Backend for a no-code/AI-built app
• User auth and database for a SaaS MVP
• Vector search for an AI knowledge-base app
• Give your own Supabase app an MCP server: install the MCP Server block (npx shadcn@latest add supabase.com), add one read-only tool such as 'list my open orders', turn on the OAuth 2.1 server, then connect it from Claude (custom connector) and check that a test user sees only their own rows
• Lock down your coding agent: in Dashboard > Access Tokens create a token scoped to one project, start from the 'No access' preset, turn on Database: read, set a 1-week expiry, then give it to Claude Code or the Supabase MCP server (SUPABASE_ACCESS_TOKEN). Check that a write fails with a permission error
• If you have a us-west-2 project: join the Compute waitlist (supabase.com/compute) with your Project ID. Once invited, have Claude Code run supabase compute new (Node, 2 GB), turn your nightly embedding backfill or a slow AI agent into a private service, and save its progress to a Postgres table so a restart doesn't lose work

Honest take

Some claims not independently checked

• App MCP servers (announced at Supabase Select, blog 22 Oct 2026): real and documented (blog, Server SDK feature page, open-source @supabase/server docs on GitHub), but labelled Public Beta.
• It's a developer kit, not a switch: you copy an Edge Function (MCP Server block), write your own tools in TypeScript, enable asymmetric JWT signing, the OAuth 2.1 server and dynamic client registration, host a consent page, and set verify_jwt = false.
• Security depends on your Row Level Security policies being right, since agent calls see whatever RLS allows that user.
• ChatGPT custom MCP apps need developer mode (plan-dependent), while Claude supports custom connectors.
• The in-chat UI uses the MCP Apps extension and only shows in clients that support it.
• No extra fee: it runs on normal Auth MAU and Edge Function quotas.
• Available wherever Supabase is (UK fine; London eu-west-2 region exists).
• Don't confuse it with Supabase's own MCP server (mcp.supabase.com), which connects your coding agent to your project.
• Scoped PATs (blog 26 Oct 2026, 'Scope your Personal Access Tokens'; docs supabase.com/docs/guides/platform/personal-access-tokens): real and shipped.
• GA since 28 Sep and announced at Supabase Select on 2 Oct, so the 26 Oct X post is a recap, not a fresh launch.
• Scoped tokens start with sbp_fc.
• A review screen shows the exact Management API endpoints and MCP tools each permission covers, plus a Low/Medium/High risk banner.
• Tokens can never exceed your own role.
• Works with the MCP server: each tool checks permissions, and e.g. apply_migration needs Migrations read-write.
• Gotchas: the 'Read-only' preset includes secrets such as API keys (so start from 'No access'); scope is fixed at creation; `supabase login` in the browser still makes full-access tokens for now (use --token); commands that use SUPABASE_DB_PASSWORD bypass token permissions.
• It's a Dashboard account feature, so it should be available on every plan (Free included), but no page says 'all plans' explicitly.
• Old full-access tokens keep working (shown as 'Legacy').
• Supabase Compute (blog 27 Oct 2026 'Supabase Compute: run your agents inside your project'; landing supabase.com/compute; X post 2115121820391055406).
• What it is: container-style services in their own microVMs, deployed with the Supabase CLI (v2.120.0+: set compute = true under [experimental] in config.toml, then supabase compute new and supabase compute push).
• Alpha Management API endpoints exist too.
• They fill the gap Edge Functions leave: work over 400 s, more CPU/RAM, or another language.
• Public services get a URL and suspend when idle; private ones keep running.
• Services get all project secrets and their logs appear in the dashboard.
• Private alpha, waitlist only, for evaluation not production, and it may change or end. us-west-2 projects only (no UK/EU region yet).
• Services can restart at any time, so save progress in Postgres.
• No autoscaling, GPU or persistent disk.
• Every service sees every project secret.
• The landing page sells more than the alpha ships: agent sandboxes, autoscaling, per-workload firewalls and scoped secrets are pitched there, but the blog says sandboxes aren't in the alpha and there's no autoscaling.
• Pricing: free during the alpha (via the waitlist).
• Later it will bill per compute-hour by instance size, with no per-request fees, nothing while suspended, free traffic to its own database, on the existing invoice.
• Final rates will come before GA.
• Alternatives today: Trigger.dev (free $5/month credits), Inngest (free 50K executions/month, open source), Modal (free $30/month credits), Railway (30-day trial with $5, Hobby $5 min), Render background workers, Fly.io Machines.

What we couldn’t verify

• Dreambase reports a 2.9 ms median Postgres query vs 65 ms cross-region (a customer claim).
• Fact vs hype: real but early.

Our Hype or Fact? checks

• Partly factSupabase Compute: run agents next to your database 28 Oct
• FactSupabase scoped access tokens: give your AI agent one project, not your whole account 27 Oct
• FactSupabase: give your app its own MCP server 22 Oct

Pricing

Free $0: 2 active projects, 500 MB database, 50K monthly active users, 1 GB storage, 5 GB egress, 500K Edge Function invocations; free projects pause after 1 week of inactivity. Pro from $25/mo (first project included, extra projects from $10/mo; 100K MAU, 8 GB disk, 250 GB egress, 2M invocations, then usage-based). Team from $599/mo; Enterprise custom. The OAuth 2.1 server needed for app MCP servers is included on every plan, Free too.

Prices as listed by the maker when we last checked (2026-10-28); usually in US dollars. Check the website for current prices.

Latest update

• 2026-10-27: Supabase Compute (private alpha, waitlist): run agents, background workers, APIs and long-running jobs (Node, Deno or any Dockerfile; 2 GB/1 vCPU or 4 GB/2 vCPU) inside your project next to Postgres, with no wall-clock limit. us-west-2 only; free to try during the alpha. | 2026-10-26: Scoped Personal Access Tokens: tokens limited to chosen orgs/projects, per-area permissions and an expiry. They work with the Management API, the Supabase MCP server and the CLI (GA since 28 Sep, now default in the Dashboard). | 2026-10-22: 'Give your Supabase app its own MCP server' (Server SDK, public beta): your customers can use your app from ChatGPT, Claude or Cursor, signed in with their existing account, with every tool call scoped by your RLS policies.

Is Supabase worth it? Quick answers