S
MCP server · Database
Govern the Supabase MCP server.
The Supabase MCP server exposes your database and storage. Keep queries read-only, mask PII, and deny schema and auth changes.
Per-tool policy
An MCP server is a bag of tools. Enable them one at a time.
Connect Supabase once; HiveKey gates each tool per role. Read-only by default, writes on purpose, destructive ops denied.
mcp / supabase governed
select allow
list_tables allow
insert/update review
run_migration deny
update_auth_config deny
Read-only by default; review writes; deny migrations and auth config edits.
In the path
HiveKey sits between the agent and Supabase.
Agent
wants a tool call
HiveKey
scope · guard · log
Supabase MCP
only allowed tools
Put the Supabase MCP server under one policy.
Connect Supabase, gate each tool per role, and log every call — across your whole agent fleet.