AgentArmorHQ
Sign in
  • AgentArmor teamTeam4d agoNeeds helpSolved

    How to use Supabase MCP server with multiple projects without OAuth loops?

    I use the Supabase MCP server (npx @supabase/mcp-server-supabase@latest) in the Codex app (Claude Code also affected) and have projects in multiple orgs. Telling the agent to use a specifically named server still gets the wrong project, and I end up in a loop of OAuth authorization requests. How do I give an AI coding assistant MCP access to several Supabase projects reliably?

    Originally asked on GitHub: https://github.com/supabase/mcp/issues/233

    4 answers

    • Best answerAgentArmor teamTeam4d ago

      The issue is still open, but the thread contains a working setup: run one stdio MCP process per project in a .mcp.json file at your project root, each pinned to a different --project-ref. A commenter reported this setup worked for them, and another thread participant confirmed it works nicely. Configuration from the thread:

      json
      {
  "mcpServers": {
    "supabase": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@supabase/mcp-server-supabase@latest", "--project-ref=<staging-ref>"],
      "env": { "SUPABASE_ACCESS_TOKEN": "<your-pat>" }
    },
    "supabase-prod": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@supabase/mcp-server-supabase@latest", "--read-only", "--project-ref=<prod-ref>"],
      "env": { "SUPABASE_ACCESS_TOKEN": "<your-pat>" }
    }
  }
}

      Key points from the thread:

      • Supabase PATs are org-scoped, so one token covers all your projects. Generate one at supabase.com/dashboard/account/tokens to avoid OAuth prompts.
      • --project-ref locks each server to one project at startup. In Claude Code the tools get namespaced (mcp__supabase__* vs mcp__supabase-prod__*), so naming the server actually works.
      • The OAuth loop happens because project scope is resolved at process startup; a single server trying to switch projects mid-session has to re-authenticate. Running two processes sidesteps it entirely.
      • --read-only on the production server restricts it to SELECTs at the protocol level.
      • The official Supabase MCP docs only mention the remote MCP endpoint, not mcp-server-supabase. A contributor opened a PR to add multi-project documentation, but the thread does not say whether it was merged.

      General advice (not from the thread): the PAT is embedded in .mcp.json, so take care not to commit that file to version control.

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What a GitHub user tried on GitHub (Didn't work)

      The reporter (Codex app) told the agent to use a specifically named MCP server and asked it to verify the project id, but still got OAuth authorization loops and the wrong server being used.

      Source: https://github.com/supabase/mcp/issues/233 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @farmhutsoftwareteam tried on GitHub (Worked)

      A commenter configured a .mcp.json with two named server entries, each running npx -y @supabase/mcp-server-supabase@latest with a --project-ref, the same PAT via SUPABASE_ACCESS_TOKEN, and --read-only for production. They reported this is what ended up working for them.

      Source: https://github.com/supabase/mcp/issues/233#issuecomment-4022299960 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @scopendo tried on GitHub (Worked)

      Another thread participant applied the two-server .mcp.json approach and confirmed it is working nicely, noting the docs still lack it.

      Source: https://github.com/supabase/mcp/issues/233#issuecomment-4022991599 (opens external site)

      Did this work for you?

    Add your answer or comment