Supabase
for LuumenAI
Read Supabase project config and database state, then change it with approval
Connect Supabase and your agent can read project state directly: network bans and IP restrictions, SSL enforcement, custom hostname and vanity subdomain config, third-party auth providers, and generated TypeScript types. Changes — migrations, API keys, read replicas, lifting network bans — are previewed, approved, and recorded. Luumen authenticates with an API key.
The Supabase toolbox
123 tools: 60 read, 63 write. Reads answer instantly. Writes require approval by default. Everything is logged.
- ReadGet a third-party integrationRetrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by `tpa_id`, within an existing Supabase project specified by `ref`.
- ReadList third-party auth integrations for projectLists all configured third-party authentication provider integrations for an existing Supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.
- ReadAuthorize user through OAuthGenerates a Supabase OAuth 2.0 authorization URL for user redirection.
- ReadCheck vanity subdomain availabilityChecks if a specific vanity subdomain is available for a Supabase project; this action does not reserve or assign the subdomain.
- ReadBeta get project's custom hostname configRetrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan.
- ReadRetrieve network bans for projectRetrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string; this is a read-only operation.
- ReadGet project network restrictionsRetrieves the network restriction settings (IP allowlists) for a Supabase project.
- ReadGet project pgsodium configRetrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its `ref`.
- ReadGet project SSL enforcement configurationRetrieves the SSL enforcement configuration for a specified Supabase project, indicating if SSL connections are mandated for its database.
- ReadGet current vanity subdomain configFetches the current vanity subdomain configuration, including its status and custom domain name, for a Supabase project identified by its reference ID.
- ReadCount action runsCounts the number of action runs for a Supabase project using a HEAD request.
- ReadGenerate TypeScript typesGenerates and retrieves TypeScript types from a Supabase project's database; any schemas specified in `included_schemas` must exist in the project.
- ReadGet action run statusRetrieves the status and details of a specific action run, including its steps, timestamps, and configuration.
- ReadGet action run logsRetrieves the execution logs for a specific action run by its ID.
- ReadGet project auth configRetrieves the complete authentication configuration for a Supabase project.
- ReadGet Available RegionsGet the list of available regions for creating a new Supabase project.
- ReadGet a database branchRetrieves detailed information about a specific database branch by its name and project reference.
- ReadGet database branch configRetrieves the read-only configuration and status for a Supabase database branch, typically for monitoring or verifying its settings.
- ReadRetrieve a functionRetrieves detailed information, metadata, configuration, and status for a specific Edge Function using its project reference ID and function slug.
- ReadRetrieve a function bodyRetrieves the source code (body) for a specified serverless Edge Function using its project reference and function slug; this is a read-only operation that does not execute the function or return…
- ReadGet API Health StatusCheck the health status of the Supabase API.
- ReadGet JIT access config[Beta] Retrieves the project's just-in-time (JIT) access configuration, including user roles and their expiration settings.
- ReadGet a migrationRetrieves a specific database migration entry from the migration history using its version identifier.
- ReadGet information about an organizationFetches comprehensive details for a specific Supabase organization using its unique slug.
- ReadGet projectRetrieves detailed information about a specific Supabase project by its unique reference ID.
- ReadGet project API keyRetrieves details of a specific API key for a Supabase project by its UUID.
- ReadGet project API keysRetrieves all API keys for an existing Supabase project, specified by its unique reference ID (`ref`); this is a read-only operation.
- ReadGet project logsRetrieves analytics logs for a Supabase project.
- ReadGet project PgBouncer configRetrieves the active PgBouncer configuration (PostgreSQL connection pooler) for a Supabase project, used for performance tuning, auditing, or getting the connection string.
- ReadGet project postgres configRetrieves the current read-only PostgreSQL database configuration for a specified Supabase project's `ref`, noting that some advanced or security-sensitive details might be omitted from the response.
- ReadGet project's PostgREST configRetrieves the PostgREST configuration for a specific Supabase project.
- ReadGet project's read-only mode statusRetrieves the read-only mode status for a specified Supabase project to check its operational state; this action does not change the read-only state.
- ReadGet project signing keysList all signing keys for a Supabase project.
- ReadGet project Supavisor configurationRetrieves the Supavisor (connection pooler) configuration for a specified Supabase project, identified by its reference ID.
- ReadGet Project Upgrade EligibilityChecks a Supabase project's eligibility for an upgrade, verifying compatibility and identifying potential issues; this action does not perform the actual upgrade.
- ReadGet project upgrade statusRetrieves the latest status of a Supabase project's database upgrade for monitoring purposes; does not initiate or modify upgrades.
- ReadGet TUS resumable upload base optionsHandles OPTIONS request for TUS Resumable uploads to discover server capabilities.
- ReadGet TUS resumable upload optionsHandles OPTIONS request for TUS Resumable uploads to discover server capabilities.
- ReadGet project's auth configRetrieves the project's complete read-only authentication configuration, detailing all settings (e.g., providers, MFA, email/SMS, JWT, security policies) but excluding sensitive secrets.
- ReadGet project's service health statusRetrieves the current health status for a Supabase project, for specified services or all services if the 'services' list is omitted.
- ReadGet a specific SQL snippetRetrieves a specific SQL snippet by its unique identifier.
- ReadGet a SSO provider by its UUIDRetrieves the configuration details for a specific Single Sign-On (SSO) provider (e.g., SAML, Google, GitHub, Azure AD), identified by its UUID, within a Supabase project.
- ReadGet Table SchemasRetrieves column details, types, and constraints for multiple database tables to help debug schema issues and write accurate SQL queries.
- ReadOPTIONS for resumable upload signHandles CORS preflight OPTIONS request for TUS resumable upload signing.
- ReadList all organizationsLists all organizations (ID and name only) associated with the Supabase account, excluding project details within these organizations.
- ReadList all projectsRetrieves a list of all Supabase projects, including their ID, name, region, and status, for the authenticated user.
- ReadList project database backupsLists all database backups for a Supabase project, providing details on existing backups but not creating new ones or performing restores; availability may depend on plan and configuration.
- ReadList database branchesLists all database branches for a specified Supabase project, providing information about each branch's status, configuration, and metadata.
- ReadList all bucketsRetrieves a list of all storage buckets for a Supabase project, without returning bucket contents or access policies.
- ReadList all database branchesLists all database branches for a specified Supabase project, used for isolated development and testing of schema changes; ensure the project reference ID is valid.
- ReadList all functionsLists metadata for all Edge Functions in a Supabase project (specified by 'ref'), excluding function code or logs; the project must exist.
- ReadList migration historyRetrieves the list of applied database migration versions for a Supabase project.
- ReadList members of an organizationRetrieves all members of a Supabase organization, identified by its unique slug, including their user ID, username, email, role, and MFA status.
- ReadList project secretsRetrieves all secrets (environment variables) for a Supabase project by its reference ID.
- ReadList all secretsRetrieves all secrets for a Supabase project using its reference ID; secret values in the response may be masked.
- ReadList SQL snippets for the logged in userRetrieves a list of SQL snippets for the logged-in user, optionally filtered by a specific Supabase project if `project_ref` is provided.
- ReadList all SSO providersLists all configured Single Sign-On (SSO) providers for a Supabase project, requiring the project reference ID (`ref`) of an existing project.
- ReadList Database TablesLists all tables and views in specified database schemas, providing a quick overview of database structure to help identify available tables before fetching detailed schemas.
- ReadExecute read-only database query[Beta] Run a SQL query as supabase_read_only_user.
- ReadSelect From TableSelect rows from a Supabase/PostgREST table.
- WriteCreate project api keyCreates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description; 'secret' keys can have customized JWT templates. Approval by default
- WriteDelete an API key from the projectPermanently deletes a specific API key (identified by `id`) from a Supabase project (identified by `ref`), revoking its access. Approval by default
- WriteDelete third party auth configRemoves a third-party authentication provider (e.g., Google, GitHub) from a Supabase project's configuration; this immediately prevents users from logging in via that method. Approval by default
- WriteUpdate an API key for the projectUpdates an existing Supabase project API key's `description` and/or `secret_jwt_template` (which defines its `role`); does not regenerate the key string. Approval by default
- WriteApply a database migrationApply database migrations to a Supabase project. Approval by default
- WriteBeta activate custom hostname for projectActivates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally. Approval by default
- WriteActivate vanity subdomain for projectActivates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co'). Approval by default
- WriteSetup read replica for projectProvisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency. Approval by default
- WriteEnable project database webhooksEnables database webhooks for the Supabase project `ref`, triggering real-time notifications for INSERT, UPDATE, or DELETE events. Approval by default
- WriteRemove project network bansRemoves specified IPv4 addresses from a Supabase project's network ban list, granting immediate access; IPs not currently banned are ignored. Approval by default
- WriteRemove read replicaRemove a read replica from a Supabase project (Pro plan or higher required). Approval by default
- WriteExecute project database queryExecutes a given SQL query against the project's database; use for advanced data operations or when standard API endpoints are insufficient, ensuring queries are valid PostgreSQL and sanitized. Approval by default
- WriteBeta update project network restrictionsUpdates and applies network access restrictions (IPv4/IPv6 CIDR lists) for a Supabase project, which may terminate existing connections not matching the new rules. Approval by default
- WriteUpgrade the project's PostgreSQL versionInitiates an asynchronous upgrade of a Supabase project's PostgreSQL database to a specified `target_version` from a selected `release_channel`, returning a `tracking_id` to monitor status; the… Approval by default
- WriteCreate new projectCreates a new Supabase project, requiring a unique name (no dots) within the organization; project creation is asynchronous. Approval by default
- WriteBulk create secretsBulk create secrets for a Supabase project. Approval by default
- WriteCreate a database branchCreates a new, isolated database branch from an existing Supabase project (identified by `ref`), useful for setting up separate environments like development or testing, which can optionally be… Approval by default
- WriteCreate a functionCreates a new serverless Edge Function for a Supabase project (identified by `ref`), requiring valid JavaScript/TypeScript in `body` and a project-unique `slug` identifier. Approval by default
- WriteCreate CLI login roleCreates a temporary CLI login role for database access with specified permissions; use when setting up CLI authentication for development or administrative tasks. Approval by default
- WriteCreate an organizationCreates a new Supabase organization, which serves as a top-level container for projects, billing, and team access. Approval by default
- WriteCreate project signing keyCreate a new signing key for JWT authentication in a Supabase project. Approval by default
- WriteCreate SSO provider configurationCreates a new SAML 2.0 Single Sign-On (SSO) provider for a Supabase project, requiring either `metadata_xml` or `metadata_url` for SAML IdP configuration. Approval by default
- WriteCreate a new third-party auth integrationCall this to add a new third-party authentication method (OIDC or JWKS) to a Supabase project for integrating external identity providers (e.g., for SSO); the API may also support `custom_jwks` if… Approval by default
- WriteDelete all branchesDisables preview branching for a Supabase project, which deletes all remaining branches. Approval by default
- WriteDelete custom hostname configDeletes an active custom hostname configuration for the project identified by `ref`, reverting to the default Supabase-provided hostname; this action immediately makes the project inaccessible via… Approval by default
- WriteDelete branch by idPermanently and irreversibly deletes a specific, non-default database branch by its `branch_id`, without affecting other branches. Approval by default
- WriteDelete edge functionDeletes an Edge Function from a Supabase project by its slug. Approval by default
- WriteDelete an edge function by slugPermanently deletes a specific Edge Function (by `function_slug`) from a Supabase project (by `ref`); this action is irreversible and requires prior existence of both project and function. Approval by default
- WriteDelete CLI login roles[Beta] Deletes existing login roles used by the Supabase CLI for the specified project. Approval by default
- WriteDelete a projectPermanently and irreversibly deletes a Supabase project and all associated resources, including databases, storage, and configurations. Approval by default
- WriteDelete vanity subdomain for projectPermanently and irreversibly deletes an active vanity subdomain configuration for the specified Supabase project, reverting it to its default Supabase URL. Approval by default
- WriteBulk delete secretsDeletes one or more secrets from a Supabase project by their names. Approval by default
- WriteRemove an SSO providerDeletes a specific SSO provider by its ID (`provider_id`) from a Supabase project (`ref`), which disables it and returns its details; ensure this action will not inadvertently lock out users. Approval by default
- WriteDeploy functionDeploys Edge Functions to a Supabase project using multipart upload. Approval by default
- WriteDisable preview branchingDisables the preview branching feature for an existing Supabase project, identified by its unique reference ID (`ref`). Approval by default
- WriteDisable project readonly modeTemporarily disables a Supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only. Approval by default
- WriteExchange auth code for access and refresh token(Beta) Implements the OAuth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on `grant_type`. Approval by default
- WriteInvoke Edge FunctionInvoke a deployed Supabase Edge Function over HTTPS. Approval by default
- WriteMerge a database branchMerges a database branch, applying all schema changes and migrations from the branch to the target database. Approval by default
- WritePatch a migration[Beta] Patches an existing entry in the project's migration history, updating the name or rollback script. Approval by default
- WritePatch project network restrictionsUpdates project's network restrictions by incrementally adding or removing IPv4/IPv6 CIDR blocks. Approval by default
- WritePush a database branchPushes a database branch, applying migrations and changes to the specified branch. Approval by default
- WriteReset a database branchResets an existing Supabase database branch, identified by `branch_id`, to its initial clean state, irreversibly deleting all its current data and schema changes. Approval by default
- WriteRestore database PITR backupRestores a Supabase project's database to a specific Unix timestamp using Point-in-Time Recovery (PITR), overwriting the current state; requires a paid plan with PITR and physical backups enabled. Approval by default
- WriteUpdate a functionUpdates an existing Supabase Edge Function's properties (like name, slug, source code, JWT settings, import map) identified by project `ref` and `function_slug`, supporting plain text code or ESZIP… Approval by default
- WriteUpdate API keyUpdates an existing Supabase project API key's metadata including name, description, and JWT template configuration. Approval by default
- WriteUpdate branch configurationUpdates the configuration of a Supabase database branch, allowing modification of its name, associated Git branch, notification URL, persistence settings, and status. Approval by default
- WriteUpdate database branch configUpdates the configuration of a Supabase database branch, allowing modification of its name, associated Git branch, reset-on-push behavior, persistence, and status. Approval by default
- WriteUpdate database passwordUpdates the database password for a Supabase project. Approval by default
- WriteBulk update functionsBulk update Edge Functions in a Supabase project. Approval by default
- WriteUpdate JIT access config[Beta] Update a Supabase project's just-in-time (JIT) access configuration. Approval by default
- WriteUpdate pgsodium root keyCritically updates or initializes a Supabase project's pgsodium root encryption key for security setup or key rotation, requiring secure backup of the new key to prevent irreversible data loss. Approval by default
- WriteUpdate a projectUpdates a Supabase project's configuration (currently supports updating the project name). Approval by default
- WriteUpdate project's auth configUpdate Supabase project Auth configuration via the Management API. Approval by default
- WriteUpdate project's custom hostname configurationUpdates the custom hostname for a Supabase project, requiring subsequent DNS changes to a user-controlled domain for SSL certificate issuance and domain ownership. Approval by default
- WriteUpdate project legacy API keysDisable or re-enable JWT-based legacy API keys (anon, service_role) for a Supabase project. Approval by default
- WriteUpdate project's postgres configUpdates specified PostgreSQL configuration parameters for an existing Supabase project (`ref`) to optimize database performance; note that unspecified parameters remain unchanged, and caution is… Approval by default
- WriteUpdate project's PostgREST configUpdates PostgREST configuration settings (e.g., `max_rows`, `db_pool`, `db_schema`, `db_extra_search_path`) for a Supabase project to fine-tune API performance, data exposure, and database resource… Approval by default
- WriteUpdate database pooler configUpdates the Supavisor (database pooler) configuration, such as `default_pool_size`, for an existing Supabase project identified by `ref`; the `pool_mode` parameter in the request is deprecated and… Approval by default
- WriteUpdate SSL enforcement configUpdates the SSL enforcement configuration (enable/disable) for a specified Supabase project's database. Approval by default
- WriteUpdate an SSO provider by its UUIDUpdates an existing SSO provider's SAML metadata, associated email domains, or attribute mappings for a Supabase project, identified by `ref` and `provider_id`. Approval by default
- WriteUpsert migrationUpsert a database migration without applying it. Approval by default
- WriteReverify custom hostnameRe-verifies DNS and SSL configurations for an existing custom hostname associated with a Supabase project. Approval by default
One prompt, start to finish
What a governed Supabase run looks like inside Luumen.
Questions
How does LuumenAI connect to Supabase?
Authorize once with API token. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.
Can LuumenAI change things in Supabase on its own?
Read actions answer immediately. Anything that writes — create project api key, delete an api key from the project, delete third party auth config, update an api key for the project, and more — is shown as a plan and requires approval by default, including the 22 actions classified as destructive. Administrators configure that per tool, so you decide exactly which actions can ever run unattended.
Who gets access to the integration?
You decide. Actions are granted per agent, skill, and team, and per environment — production is not staging. Read access can be broad while writes stay narrow.
Is there an audit trail?
Every call to Supabase — read or write, approved or declined — is recorded with the actor, the input, and the result, and can be linked to the ticket or change record.
Often connected alongside
All integrations
PostgreSQLQuery PostgreSQL state safely; maintenance held for approval.
MySQLQuery MySQL state safely; maintenance held for approval.
Microsoft SQL ServerQuery Microsoft SQL Server state safely; maintenance held for approval.Oracle DatabaseQuery Oracle Database state safely; maintenance held for approval.Put Supabase to work with Luumen
Connect in minutes. Every action scoped, approved, and audited from day one.