Skip to content
Truto
Truto Blog
Back
AI & Agents

Connect Supabase to ChatGPT: Run SQL Queries and Manage Projects

Learn how to connect Supabase to chatgpt using Truto. Step-by-step guide to tool calling, API quirks, and autonomous workflows.

Uday Gajavalli Uday Gajavalli · · 8 min read

If you need to give ChatGPT read and write access to your Supabase infrastructure - allowing it to execute SQL queries, deploy Edge Functions, analyze logs, and manage project secrets - you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool calls and the Supabase Management API.

If your team uses Claude, check out our guide on connecting Supabase to Claude or explore our broader architectural overview on connecting Supabase to AI Agents.

Giving a Large Language Model (LLM) access to a sprawling Backend-as-a-Service (BaaS) platform like Supabase is an engineering challenge. You must map complex JSON schemas for database operations, manage project references, and handle specialized endpoints for log analysis and compute scaling. Every time Supabase updates an endpoint, your custom server code breaks. This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Supabase, connect it natively to ChatGPT, and execute complex database workflows using natural language.

The Engineering Reality of the Supabase API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Supabase's APIs - or maintaining custom connectors for 100+ other platforms - is a massive operational burden.

If you decide to build a custom MCP server for Supabase, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with Supabase:

The ClickHouse Log Querying Paradigm Fetching logs in Supabase is not a standard paginated REST endpoint. Supabase unifies its logs (Edge Functions, Postgres, Auth, PostgREST) into a ClickHouse data warehouse. To retrieve logs via the API, your MCP server must expose an endpoint (list_all_supabase_endpoints_logs) that accepts raw ClickHouse SQL queries against the unified log stream. The LLM must be explicitly instructed on the schema of this log stream to construct valid queries. If your server cannot handle the specific data typing returned by ClickHouse, the LLM will fail to interpret the telemetry.

Strict Project References (Refs) vs UUIDs Unlike APIs that use standard integer IDs or UUIDs for all resources, Supabase relies heavily on the ref string - a precise 20-character lowercase string assigned to each project. Almost every management endpoint requires this ref. If your MCP server's JSON schema definitions do not rigidly enforce this format and clearly describe it to the LLM, the model will hallucinate project IDs or pass invalid UUIDs, resulting in endless 400 Bad Request errors.

Rate Limits and Compute Boundaries Supabase enforces strict rate limits on management operations, particularly around branching, project creation, and heavy database queries. It is a critical factual note that Truto does not absorb rate limits, retry requests, or apply exponential backoff under the hood. If Supabase returns an HTTP 429 Too Many Requests error, Truto passes that error directly to the caller, normalizing the upstream rate limit information into standardized IETF headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset). The caller - in this case, the LLM or your agent framework - is entirely responsible for handling the retry and backoff logic.

Generating the Supabase MCP Server

Instead of building a translation layer from scratch, you can use Truto to dynamically generate an MCP server based on Supabase's API documentation. Truto evaluates the available endpoints and schemas, generating a secure URL that exposes these capabilities to ChatGPT.

You can generate this server via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For administrators setting up an internal ChatGPT instance:

  1. Navigate to the Integrated Accounts page in your Truto dashboard and select your connected Supabase account.
  2. Click the MCP Servers tab.
  3. Click Create MCP Server.
  4. Define your security configuration (e.g., restrict to "read" methods only, or filter by specific tool tags).
  5. Copy the generated MCP Server URL (e.g., https://api.truto.one/mcp/abc123xyz...).

Method 2: Via the Truto API

For developers provisioning MCP servers dynamically for end-users, you can create the server programmatically. The API validates the integration, provisions a cryptographic token, and returns a ready-to-use URL.

curl -X POST https://api.truto.one/integrated-account/{account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Supabase DevOps Server",
    "config": {
      "methods": ["read", "write", "custom"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The response contains the secure connection URL:

{
  "id": "mcp_srv_98765",
  "name": "Supabase DevOps Server",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

Connecting the MCP Server to ChatGPT

Once you have the Truto MCP URL, you must register it with your ChatGPT environment.

Method A: Via the ChatGPT UI

If you are using ChatGPT Enterprise, Plus, or Pro with Developer Mode enabled:

  1. In ChatGPT, navigate to Settings → Apps → Advanced settings.
  2. Ensure Developer mode is enabled.
  3. Under MCP servers / Custom connectors, click to add a new server.
  4. Name: Supabase (Truto)
  5. Server URL: Paste the URL generated in the previous step.
  6. Click Save. ChatGPT will immediately connect, perform an initialization handshake, and load the available Supabase tools.

Method B: Via Manual Config File (SSE Transport)

If you are running a custom OpenAI-compatible agent framework or local client that requires a standard configuration file, you can map the Truto SSE (Server-Sent Events) endpoint using the official MCP CLI proxy:

{
  "mcpServers": {
    "supabase_truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Supabase Hero Tools for AI Agents

Truto exposes over a hundred Supabase endpoints. By relying on documentation-driven generation, tools only appear if they have explicitly defined schemas, ensuring high-quality LLM interactions. Here are the 6 highest-leverage tools available for ChatGPT.

1. Execute SQL Queries (create_a_supabase_database_query)

Allows the LLM to run arbitrary SQL queries against a project's database. This is a beta endpoint that returns query results dynamically based on the SQL statement executed.

Contextual note: The LLM must construct valid Postgres SQL syntax and handle unstructured response shapes, as the output depends entirely on the query.

"Write and execute a SQL query on project 'ref123abc' to find the top 5 largest tables by disk size in the public schema."

2. Query Unified Logs (list_all_supabase_endpoints_logs)

Executes a ClickHouse SQL query against the project's unified logs stream.

Contextual note: If iso_timestamp_start and iso_timestamp_end are omitted, only the last 1 minute of logs is queried. The LLM must filter by the source column to target edge_logs, postgres_logs, or auth_logs.

"Query the edge_logs for project 'ref123abc' over the last 15 minutes and group the errors by HTTP status code."

3. Manage Database Branches (create_a_supabase_project_branch)

Creates a new database branch from a Supabase project, isolating schema changes for development and testing.

Contextual note: This operation can take time to provision. The LLM should be instructed to check the branch status asynchronously if immediate operations on the new branch are required.

"Create a new database branch named 'feature-auth-migration' for project 'ref123abc' so we can test the new user table schema."

4. Deploy Edge Functions (create_a_supabase_functions_deploy)

Deploys an Edge Function to a Supabase project. It creates the function if it does not exist or updates the existing one.

Contextual note: The tool requires metadata regarding the entrypoint path and import map.

"Deploy the updated 'stripe-webhook' edge function to project 'ref123abc' ensuring verify_jwt is set to false for external webhook ingestion."

5. Manage Project Secrets (create_a_supabase_project_secret)

Bulk creates multiple secrets and injects them into the specified Supabase project environment.

Contextual note: Secrets are write-only. Once set, you can list secret names via list_all_supabase_project_secrets, but you cannot retrieve their values.

"Inject the new SENDGRID_API_KEY into project 'ref123abc' and confirm the secret was stored successfully."

6. List Projects (list_all_supabase_projects)

Retrieves all Supabase projects you have access to, returning the database configuration, region, status, and the critical ref needed for subsequent tool calls.

Contextual note: This is typically the first tool ChatGPT will call to discover the target ref string.

"List all my Supabase projects and find the 'ref' for the production database hosted in eu-central-1."

View the complete Supabase tool inventory and schemas on the Truto integration page.

Workflows in Action

Here is how specialized engineering personas use ChatGPT and Truto MCP to automate complex infrastructure tasks.

Scenario 1: The DevOps Engineer (Incident Response & Log Analysis)

When an Edge Function begins failing in production, manually writing ClickHouse queries in the Supabase dashboard costs valuable time. The engineer delegates the analysis to ChatGPT.

"Check the edge function logs for project 'ref123abc' for the last hour to see why the 'stripe-webhook' function is failing, summarize the root cause, and then list the current environment secrets to see if STRIPE_KEY is missing."

Execution Steps:

  1. ChatGPT calls list_all_supabase_endpoints_logs, passing a ClickHouse SQL query filtering by source='edge_logs' and the specific function ID, with timestamps bound to the last hour.
  2. The LLM parses the structured JSON logs returned by Truto, identifying a signature verification failure.
  3. ChatGPT calls list_all_supabase_project_secrets to retrieve the names of active secrets.
  4. It summarizes the issue for the engineer, noting that the webhook signature key is missing from the environment.
sequenceDiagram
    participant User as User
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP Server
    participant Supabase as Supabase API

    User->>ChatGPT: "Analyze webhook failures..."
    ChatGPT->>Truto: Call list_all_supabase_endpoints_logs
    Truto->>Supabase: Execute ClickHouse SQL
    Supabase-->>Truto: Return log stream
    Truto-->>ChatGPT: Parsed JSON telemetry
    ChatGPT->>Truto: Call list_all_supabase_project_secrets
    Truto->>Supabase: Fetch secret keys
    Supabase-->>Truto: Return ["DB_PASS", "API_KEY"]
    Truto-->>ChatGPT: Secret list missing STRIPE_KEY
    ChatGPT-->>User: "STRIPE_KEY is missing from the environment."

Scenario 2: The Database Administrator (Schema Migration)

Before running a destructive migration, a DBA wants to spin up an isolated branch and verify table sizes.

"Create a new database branch called 'migration-test' for project 'ref123abc'. Once created, run a SQL query on the parent project to count the exact number of rows in the 'auth.users' table so we have a baseline."

Execution Steps:

  1. ChatGPT calls create_a_supabase_project_branch with branch_name='migration-test'.
  2. ChatGPT calls create_a_supabase_database_query with a raw SQL payload: SELECT count(*) FROM auth.users;.
  3. Truto proxies the raw query to the Supabase data plane.
  4. ChatGPT formats the integer result and confirms the branch creation status to the user.

Security and Access Control

Exposing your database infrastructure to an LLM requires strict boundary enforcement. Truto handles this at the MCP server configuration layer, allowing you to scope access cryptographically before ChatGPT ever makes a request.

  • Method Filtering: You can restrict a server to safe operations. By passing methods: ["read"] during token creation, the MCP server will only generate tools for get and list endpoints. Write operations like create_a_supabase_project_branch will simply not exist in the LLM's tool list.
  • Tag Filtering: Limit the LLM's capabilities to specific functional domains. If you only want the AI to analyze telemetry, you can filter tools by the logs tag.
  • Extra Authentication (require_api_token_auth): If enabled, possessing the MCP URL is not enough. The client making the connection (or the user session triggering the agent) must provide a valid Truto API token in the Authorization header. This prevents leaked MCP URLs from being utilized.
  • Time-to-Live (expires_at): You can generate an MCP server with a precise ISO datetime expiration. Once the clock hits, Truto's durable state alarms physically purge the token from edge storage and the database, permanently invalidating the ChatGPT connection.

More from our Blog