Direct answer: Finta's Aurora catalog includes Supabase's hosted MCP server at https://mcp.supabase.com/mcp. Supabase documents database, debugging, development, function, and branching tools, but explicitly warns against connecting an MCP client to production data and recommends project scoping and read-only mode.
This guide is for teams using Finta as relationship intelligence around a capital, investor, customer, or company-building workflow. Supabase remains the source system for its records. Aurora can use only the context and actions exposed to the connected account.
How the Supabase connection works
| Connection detail | Current Finta guidance |
|---|---|
| Classification | Catalog MCP |
| Configured endpoint | https://mcp.supabase.com/mcp |
| Authentication and transport | Provider OAuth through Aurora; Streamable HTTP |
| Source of truth | Supabase remains authoritative for provider records, permissions, and action results. |
| Human control | Review external communication, record changes, financial actions, publishing, deletion, and other consequential work before execution. |
What you can use it for
- Inspect tables, extensions, migrations, logs, and advisors in a development or test project.
- Retrieve project URLs, generated types, and other supported development context.
- Review Edge Functions or branch information when those tool groups are enabled.
- Apply a reviewed migration or SQL operation only in a controlled non-production environment.
- Restrict the connection by project reference, read-only mode, and feature groups.
These uses summarize the current provider documentation and Finta catalog purpose. The exact tool inventory varies by provider version, plan, workspace, user permissions, region, and authorization scopes.
Relationship intelligence workflows for Supabase
Check a fundraising portal before an investor demo
Outcome: Have engineering approve any migration or function change.
- Connect only the development or isolated test Supabase project.
- Inspect schema, advisors, and recent test logs for the demo path.
- Prepare a risk list with exact source references.
- Have engineering approve any migration or function change.
Human decision: Never connect Aurora MCP to the production project or use real investor, customer, or company data for this workflow.
Verify a non-production data-room feature
Outcome: Apply only an approved non-production change and retest the flow.
- Use a test branch or project with synthetic records.
- Inspect the relevant tables, policies, logs, and generated types.
- Identify unresolved security or data-quality issues.
- Apply only an approved non-production change and retest the flow.
Human decision: MCP inspection does not replace RLS, application, storage, or production deployment verification.
How to connect Supabase to Aurora
- Create or select a development, test, or disposable branch with no production data.
- In Aurora, open Apps and select Supabase.
- Authorize https://mcp.supabase.com/mcp and restrict the connection to the test project reference.
- Enable read-only mode and only the feature groups required for the task.
- Run a safe schema or advisor query before considering any write action.
Open the official Finta apps directory to confirm the catalog entry before authorizing a provider account.
Permissions and approval boundary
Follow Supabase's warning: do not connect to production data. Use a project-scoped, read-only development connection by default. Require engineering approval for SQL, migrations, function deployment, branch changes, or any operation that mutates state. Never expose secrets or personal data.
Limitations to understand
- Supabase explicitly advises against connecting MCP to production data.
- The hosted server can expose powerful SQL, migration, function, and management tools unless restricted.
- Tool availability varies with feature groups, project access, and platform changes.
- A clean advisor result does not prove complete application security or correctness.
Verification checklist
- Confirm the connected project is non-production and contains no production personal data.
- Record project_ref restrictions, read-only mode, feature groups, and OAuth identity.
- Capture the discovered tools and run a safe read-only schema or advisor call.
- If a write is tested, use a disposable branch after explicit approval and verify rollback or cleanup.
- Record Supabase's current safety guidance, limitations, and verification date before publication.
Verification status: On 2026-08-22, Finta confirmed that this connector appears in the enabled production Aurora catalog and reviewed the configured endpoint, authentication type, and first-party sources listed below. This is not a claim that every provider tool or an authenticated end-to-end action has been tested for every account.
Official provider sources
- Supabase official MCP documentation (supabase.com)
- Supabase official MCP documentation 2 (supabase.com)