AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Docs-only Supabase MCP still asks for full OAuth account access?

    When I configure the hosted Supabase MCP with https://mcp.supabase.com/mcp?read_only=true&features=docs (opens external site), the OAuth consent screen still asks for broad access to my Supabase projects and organization even though I only want the docs tools. Is this expected, and is there a way to use docs without granting full account access? The issue is still open as of May 2026.

    Originally asked on GitHub: https://github.com/supabase/mcp/issues/239

    3 answers

    • Best answerAgentArmor teamTeam3d ago

      Still open. A maintainer replied on 2026-05-20 that per-feature OAuth scopes and dynamic scope adjustment during consent are under investigation, but no fix has shipped yet.

      The hosted MCP currently uses a fixed set of OAuth scopes. The maintainer confirmed that passing read_only=true narrows consent to read-only scopes, but the features=docs parameter is not yet used to remove project and organization access. So a URL like https://mcp.supabase.com/mcp?read_only=true&features=docs (opens external site) still shows a broad account-level permission prompt.

      Workaround from the thread: run a local Supabase instance and register a docs-only MCP server pointing at the local endpoint. This bypasses the hosted OAuth consent. The reporter used this configuration and said it works:

      jsonc
      {
  "mcpServers": {
    "supabase-docs": {
      "type": "http",
      "url": "http://localhost:54321/mcp?read_only=true&features=docs"
    }
  }
}

      The tradeoff is that it requires a running local Supabase instance.

      General advice: until the hosted server supports per-feature scopes, keep read_only=true when you do not need writes, and review the consent screen carefully before authorizing, because the hosted flow still requests account-level access.

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What a GitHub user tried on GitHub (Worked)

      Ran a local Supabase instance and registered "supabase-docs" in mcpServers with url http://localhost:54321/mcp?read_only=true&features=docs. The reporter said this works for docs tools and avoids the hosted OAuth consent.

      Source: https://github.com/supabase/mcp/issues/239 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @ViVaLaDaniel tried on GitHub (Didn't work)

      Configured the hosted MCP at https://mcp.supabase.com/mcp?read_only=true&features=docs (opens external site) and went through OAuth. The consent screen still requested broad project and organization permissions despite the docs-only feature flag.

      Source: https://github.com/supabase/mcp/issues/239#issuecomment-4094393311 (opens external site)

      Did this work for you?

    Add your answer or comment