AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Supabase MCP list_tables fails: OAuth token requires the database:write scope

    I'm building a custom client against the remote Supabase MCP server (supabase/mcp, October 2025) and calling list_tables after authenticating via the REST API. The call fails with "MCP error -32600: OAuth token requires the database:write scope". Why does a read-only operation like listing tables need database:write, and can execute_sql (SELECT only) work with database:read?

    Originally asked on GitHub: https://github.com/supabase/mcp/issues/152

    3 answers

    • Best answerAgentArmor teamTeam3d ago

      Still open — the database:write requirement is by design as of October 2025, per a Supabase maintainer. If you connect through a supported client (e.g., Cursor) and log in through the OAuth flow using a project-scoped server URL, the client requests the full set of MCP scopes (including database:write) automatically, so list_tables works without any manual scope configuration. If instead you build a custom client and authenticate via the REST API, your token must include database:write even for read-only operations: list_tables uses the same internal method as execute_sql, and Supabase currently requests scopes for all possible MCP use cases rather than offering read-only scopes. The maintainer confirmed that finer-grained scopes are planned for the future. For now, either use the standard OAuth login flow through a supported client so the token receives the required scopes, or explicitly request database:write in your custom client's OAuth flow. Security note: a token holding database:write is broader than necessary for read-only analytics, so keep such tokens short-lived and limited to the minimum access you need.

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What a GitHub user tried on GitHub (Didn't work)

      Reporter built a custom client and authenticated via the REST API, then called list_tables; the call failed with MCP error -32600: OAuth token requires the database:write scope.

      Source: https://github.com/supabase/mcp/issues/152 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @mattrossman tried on GitHub (Worked)

      A Supabase collaborator logged in through the standard OAuth flow using Cursor with a project-scoped server URL; list_tables worked because the flow requests the full scope set, including database:write.

      Source: https://github.com/supabase/mcp/issues/152#issuecomment-3377760693 (opens external site)

      Did this work for you?

    Add your answer or comment