supabase-community/supabase-mcp

Minor capabilities, nothing alarming.

Outbound network 3

Environment variables (config / keys) 2

AI review

This is an official Supabase MCP server extension with no hidden instructions, prompt injection, or data exfiltration mechanisms. The network calls and environment variable accesses are all legitimate for the stated purpose of connecting AI assistants to Supabase projects.

low Legitimate network calls to Supabase API — The fetch() calls in release.yml, server.ts, and graphql.ts are all expected network operations for a Supabase MCP server that needs to communicate with the Supabase API and registry. No suspicious or unauthorized endpoints detected.
low Expected environment variable usage — SUPABASE_ACCESS_TOKEN is used for authentication to the Supabase API, which is standard and documented. The CI check in vitest.setup.ts is a common pattern for test configuration. No secrets are being exfiltrated.
low No deceptive tool descriptions or hidden instructions — The CONTRIBUTING.md and README.md contain standard development and usage instructions. No prompt injection, hidden commands, or instructions that manipulate the agent beyond its stated purpose were found.

Model: deepseek-chat

Static findings

Outbound network · Makes outbound network requests

info .github/workflows/release.yml:159 fetch(url)

low packages/mcp-server-postgrest/src/server.ts:55 const response = await fetch(ensureTrailingSlash(apiUrl), {

low packages/mcp-server-supabase/src/content-api/graphql.ts:164 const response = await fetch(url, {

Environment variables (config / keys) · Reads environment variables (config / API keys)

low packages/mcp-server-supabase/src/transports/stdio.ts:51 const accessToken = cliAccessToken ?? process.env.SUPABASE_ACCESS_TOKEN;

low packages/mcp-server-supabase/vitest.setup.ts:5 if (!process.env.CI) {

Scanning every extension your team installs?

Pro & Team add monitoring, private scans, and a CI gate for unsafe extensions.

MCPVet is a heuristic aid, not a security guarantee. A clean grade does not prove an extension is safe; always review code and instructions you don't trust.