MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header Authorization: Bearer <token> for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "" } after the user pastes, or with no args to get the link.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations show idempotentHint=true and readOnlyHint=false, but the description adds practical details: browser login flow, token permanence (non-expiring vs session-only), and behavior with no args. This exceeds annotation coverage and no contradiction is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences deliver the essential information without filler, but the structure is a bit run-on. It could be improved with bullets for the two modes, but it remains concise and front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers usage modes and token handling adequately, but it does not explicitly describe the return value or error scenarios. Since there is no output schema, the description should mention what the tool returns (e.g., a link or success message), which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one optional token parameter with no description and 0% coverage. The description fully explains the parameter: passing a JWT enables session login, while omitting it returns a link. This completely compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: authenticating MCP.AI for IDE agents by logging in and obtaining an access token. It uses a specific verb ('log in') and resource ('access token'), and it distinguishes from sibling tools by focusing on auth, not on other supabase operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains two usage modes: permanent via config header and session-only via token argument, and notes the no-arg case for getting a link. It gives clear context on when to use each approach, though it does not explicitly mention when not to use the tool or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The Supabase-prefixed tools are all distinct CRUD/lifecycle operations on different resource types (projects, branches, migrations, edge functions, etc.). The platform-level tools (authenticate, connect, marketplace, etc.) have clear non-overlapping purposes, though their names could momentarily be confused with Supabase-specific actions if an agent doesn't read descriptions.
The 29 supabase_* tools follow a consistent 'supabase_<verb>_<noun>' pattern. However, the 6 non-prefixed platform tools (authenticate, connect, marketplace, report_bug, show_version, toolkit_info) break this convention and are inconsistent among themselves, creating a mixed naming style across the set.
At 35 tools, the server is overweight. While the Supabase domain is broad (project management, database, edge functions, branches), the inclusion of 6 unrelated platform tools inflates the count. 29 domain tools still exceeds the comfortable 15-tool upper bound, making the surface feel bloated for agents to navigate.
The tool set covers core workflows: project lifecycle (create, get, list, pause, restore), branching (create, delete, list, merge, rebase, reset), SQL/migrations, edge functions, cost estimation, and advisors. However, there are notable gaps such as no delete_project, no update operations for projects or branches, and no deletion for edge functions, which leave lifecycle coverage incomplete.