From 74bc42739d4fd1b1e35a1246253e39d15950be7a Mon Sep 17 00:00:00 2001
From: madhu19991 <madhu@thunkai.com>
Date: Tue, 29 Sep 2026 09:32:07 -0700
Subject: [PATCH] fix(mcp): scope the Supabase registry entry to one project,
 read-only

A personal access token reaches every project the user can see. The entry now pre-fills --project-ref with a placeholder the admin replaces, like the env placeholders, and starts read-only so writes are an explicit opt-in
---
 litellm/proxy/mcp_registry.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/litellm/proxy/mcp_registry.json b/litellm/proxy/mcp_registry.json
index 7a4844cdde6..fbdedd76d31 100644
--- a/litellm/proxy/mcp_registry.json
+++ b/litellm/proxy/mcp_registry.json
@@ -300,7 +300,7 @@
       "registry_url": null,
       "transport": "stdio",
       "command": "npx",
-      "args": ["-y", "@supabase/mcp-server-supabase"],
+      "args": ["-y", "@supabase/mcp-server-supabase", "--read-only", "--project-ref=<your-project-ref>"],
       "env_vars": [
         {"name": "SUPABASE_ACCESS_TOKEN", "description": "Supabase Personal Access Token", "secret": true}
       ]