Supabase has moved the backend into the repo where the coding agent already works. In Build anything: Supabase from code, and an MCP server for your app, Wen Bo Xie, Lakshan Perera, Julien Goux, Andrew Valleteau, Rand Arete and Katerina Skroumpelou describe four releases from Supabase Select. Local Supabase now runs as native processes without Docker, so it starts inside Claude Code’s sandbox, Codex and CI runners, one stack per directory. Declarative Schemas 2.0 rests on one observation: “coding agents are good at editing schema files and bad at writing migrations,” so the agent edits SQL files and a new diff engine, pg-delta, writes the migration. Config lives in code next to the schema, and a dashboard change comes back with one pull command.
There are no figures, and two of the four pieces are alpha, which the post says. The piece that matters for this catalog is the fourth: “Your app can now have its own MCP server, deployed inside the Supabase project you already have. Users sign in the way they already do, and their agent sees only what they’re allowed to see.” One command adds an authenticated Edge Function to the codebase, the developer owns the code, and row-level security still decides which rows each user’s agent can reach. It needs asymmetric signing keys and the Supabase Auth OAuth server turned on. The post keeps this separate from the official Supabase MCP server that helps build the app, which is the right distinction and one the catalog has to make too. Supabase Compute, long-lived services next to the database with agent skills to deploy and debug them, is a waitlist.
The catalog holds the surface the launch builds on. The Supabase provider page lists 21 API pages, and a per-app MCP server deploys through the Supabase Functions API, authorizes through the Supabase O Auth API and the Supabase Authentication API, and the schema-as-code work lands on the Supabase Database API and the Supabase Projects API. On the Agent Readiness score, the MCP server, agent skills, the event surface, reversibility and the full identity layer are lit, delegated identity, protected resource metadata and dynamic client registration. The agentic access profile maps 78 operations, 49 of them acting.
The Kin Score is 42.9, developing band, and it is inverted against the agent layer. The Agent Readiness score is 50.6, agent-ready, higher than the composite. Contract quality is 63.2 and discoverability 65.0, while access clarity is 34.2, developer ergonomics 32.6, operational transparency 26.3 and contract governance 13.6. Idempotency, error semantics and OpenAPI examples are unlit. A company that has just made it one command to give every customer’s app an OAuth-protected MCP server has, on its own public record, an access clarity facet in the thirties. Supabase has given its users’ agents a clean way in. The catalog’s reading of how a developer gets into Supabase itself is still the weaker half of the score.