fix(mcp): scope the Supabase registry entry to one project, read-only

A personal access token reaches every project the user can see. The entry now pre-fills --project-ref with a placeholder the admin replaces, like the env placeholders, and starts read-only so writes are an explicit opt-in
This commit is contained in:
madhu19991 2026-09-29 09:32:07 -07:00
parent 694304be7a
commit 74bc42739d

View file

@ -300,7 +300,7 @@
"registry_url": null,
"transport": "stdio",
"command": "npx",
"args": ["-y", "@supabase/mcp-server-supabase"],
"args": ["-y", "@supabase/mcp-server-supabase", "--read-only", "--project-ref=<your-project-ref>"],
"env_vars": [
{"name": "SUPABASE_ACCESS_TOKEN", "description": "Supabase Personal Access Token", "secret": true}
]