Claude Code + Supabase
Monitor the Supabase project your Claude Code agent works on
Claude Code works from your terminal and runs the commands it writes. Its MCP docs ask you to trust every server you add, because a server that fetches outside content can carry prompt injection, and your Supabase rows count as outside content. Add Supabase's server read-only and scoped to one project. Supahound then scans that project's RLS daily for free and watches live traffic for a leaked secret key.
Last updated
Claude Code works with Supabase when you connect it yourself.
What are the Supabase security risks in Claude Code apps?
An MCP server you have not limited
You add Supabase with a claude mcp add command or a .mcp.json file and authenticate through /mcp. Claude Code's MCP docs tell you to trust each server, because a server that fetches outside content can carry prompt injection. Rows your users wrote are outside content too, so scope the server to one project and keep it read-only.
Migrations that run before anyone reads them
Claude Code runs commands, so it can write a migration and apply it in the same session. Tables created that way start with RLS off, and on existing projects new public tables grant anon and authenticated full privileges. Read the SQL before it runs.
A secret key behind a public prefix
If a change the agent makes puts a sb_secret_ or legacy service_role key under a NEXT_PUBLIC_ or EXPO_PUBLIC_ name, the key ships to every user. It maps to service_role, which bypasses RLS on every table, and Supabase's browser check does not stop someone who replays it from a server.
A dashboard view that ignores RLS
A view the agent adds to simplify a report is created as security definer by default and is usually owned by postgres, so it ignores RLS on the tables under it. Security Advisor reports this as lint 0010 at level ERROR. Set security_invoker = on.
How does Supahound protect your Claude Code app?
- The posture scan checks every connected project daily for RLS coverage, views without security_invoker and newly exposed tables, free for up to 3 projects.
- The service-key detector flags a secret key used from a browser or from a network the project has not used before, starting on day one.
- Database tampering alerts also start on day one, with no learning period.
- Each incident has a plain-English summary and a paste-ready SQL fix you can hand back to Claude Code to review.
- Alerts go to email or a signed webhook, and incident history stays for 30 days.
Frequently asked questions
- Does Claude Code set up Supabase for me?
- No. Claude Code has no built-in Supabase flow. Supabase's MCP guide shows how to add its hosted server with claude mcp add or a .mcp.json file, then sign in with OAuth through /mcp.
- Should Claude Code run migrations against production?
- Supabase advises connecting an agent to production only when a task needs it. Let Claude Code run migrations against a development project, read the SQL, and promote it to production as a separate, reviewed step.
- What is the Supahound hack-me scan?
- A free external scan of your live site. It checks security headers, TLS and any Supabase keys shipped in public JavaScript. You prove you own the domain through DNS before it runs.
Watch your Claude Code app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.
- Claude Code docs: Connect Claude Code to tools via MCP
- Supabase: Model Context Protocol (MCP) guide
- General Analysis: Supabase MCP prompt-injection demonstration (July 2025)
- Supabase: Tables and RLS defaults
- Supabase: Securing your API
- Supabase: API keys
- Supabase: Database Advisors (lint 0013 and related lints)