Supabase announced a set of agent controls at its Select event on October 2. The most useful ones answer a plain question: what can your coding agent do to your database without asking you?

Supabase’s announcement describes three controls.

What changed

Confirmation before paid or destructive actions. Supabase calls this MCP elicitations. MCP is the connection standard that lets an agent use Supabase’s tools. With elicitations, before an agent creates a paid project or branch, the Supabase MCP server asks you to confirm the resource, the rate, and the billing interval. It also asks before running SQL that could delete data.

Confirmation requires client support. The client is the app you talk to your agent through, such as your coding agent. Supabase says clients must implement elicitations for the feature to work. Verify that your client requests confirmation before granting it access to paid or destructive actions; do not rely on a missing prompt to block them.

Scoped access tokens by default. A personal access token is a password-like key that lets a tool act as you. Supabase says scoped tokens, which you limit to the organizations, projects, and permissions you choose, are generally available and now the default for new tokens. Review the permissions on existing tokens separately.

Company-managed sign-in for MCP. Companies can decide who connects to the Supabase MCP server through their identity provider, starting with Okta. Tokens are short-lived and tied to the person who signed in. This matters mostly if you work inside a company.

New things your agent can see

Supabase also gave agents more to read when something breaks in production:

  • SQL queries over project logs through MCP.
  • Health checks for error rates across the Data API, Auth, Storage, and Edge Functions, run from the dashboard or the Management API.
  • A view of database connections showing which queries run long, which are stuck, and who holds a lock. Agents can cancel queries or end connections. Supabase says it is on by default for every project.
  • Notebooks, files that pair saved queries with notes. Supabase scheduled the Explorer rollout through October 12, with activation under Feature Previews once it reaches a project.

Supabase’s Unified Logs view is useful background for these agent-facing diagnostics. The agent can also act on what it finds.

Diagnosis and database changes need different permissions

More visibility lets an agent diagnose a slow app without you pasting in logs. But the ability to end connections and cancel queries is real power on a live database. Supabase’s own framing is that an agent needs permission to do only what is required. Give a diagnostic agent read-only access unless its job requires changes. Grant change permissions separately and only for the project it needs.

What to do next

Check confirmation behavior in a disposable project with no real data:

  1. Use a token limited to that disposable project. Keep production tokens read-only for diagnostic work, and revoke broad tokens you no longer need.
  2. If you need to test a data-deleting action, use a test table containing only dummy rows. Assume the action can run without a prompt.
  3. Check whether the client shows the proposed statement and lets you decline it. For paid actions, confirmation should identify the resource, rate, and billing interval.

If a prompt appears, that tested path requested confirmation. Keep the token narrowly scoped and check other paid or destructive paths before using production credentials. If the action runs silently, that path has no working confirmation guard. Check client support and configuration before granting write access to real data.

Supabase also announced Pipelines in public alpha on Pro, Team, and Enterprise plans. It streams Postgres data to analytics destinations such as BigQuery and Snowflake. It serves a separate need from controlling an agent’s database permissions.

End of article