diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index a355b309cead8..1d631f4a7dc2c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -2,6 +2,7 @@
/packages/shared-data/pricing.ts @supabase/billing
/packages/shared-data/plans.ts @supabase/billing
/packages/common/telemetry-constants.ts @supabase/growth-eng
+/packages/dev-tools/ @supabase/growth-eng
/packages/pg-meta @supabase/postgres @avallete
/packages/ui-patterns @supabase/design
@@ -22,4 +23,4 @@
/apps/studio/data/sql/queries/ @supabase/postgres @avallete
-/packages/shared-data/compute-disk-limits.ts @supabase/infra
\ No newline at end of file
+/packages/shared-data/compute-disk-limits.ts @supabase/infra
diff --git a/apps/cms/package.json b/apps/cms/package.json
index cf248894b9001..da9b2ce3be4eb 100644
--- a/apps/cms/package.json
+++ b/apps/cms/package.json
@@ -20,9 +20,9 @@
"typecheck": "tsc --noEmit"
},
"dependencies": {
- "@payloadcms/admin-bar": "^3.52.0",
- "@payloadcms/db-postgres": "^3.52.0",
- "@payloadcms/live-preview-react": "^3.52.0",
+ "@payloadcms/admin-bar": "^3.74.0",
+ "@payloadcms/db-postgres": "^3.74.0",
+ "@payloadcms/live-preview-react": "^3.74.0",
"@payloadcms/next": "3.52.0",
"@payloadcms/payload-cloud": "3.60.0",
"@payloadcms/plugin-form-builder": "3.52.0",
diff --git a/apps/docs/app/api/ai/docs/route.ts b/apps/docs/app/api/ai/docs/route.ts
index 8e3df4206a643..d8c5b49c1ec00 100644
--- a/apps/docs/app/api/ai/docs/route.ts
+++ b/apps/docs/app/api/ai/docs/route.ts
@@ -1,10 +1,9 @@
import { SupabaseClient } from '@supabase/supabase-js'
-import { ApplicationError, UserError, clippy } from 'ai-commands/edge'
+import { ApplicationError, clippy, UserError } from 'ai-commands/edge'
+import { isFeatureEnabled } from 'common/enabled-features'
import { NextRequest, NextResponse } from 'next/server'
import OpenAI from 'openai'
-import { isFeatureEnabled } from 'common/enabled-features'
-
export const runtime = 'edge'
/* To avoid OpenAI errors, restrict to the Vercel Edge Function regions that
overlap with the OpenAI API regions.
@@ -57,7 +56,8 @@ export async function POST(req: NextRequest) {
}
const useAltSearchIndex = !isFeatureEnabled('search:fullIndex')
- const response = await clippy(openai, supabaseClient, messages, {
+ // @ts-ignore: We have 6 version of openai and the types are not compatible with each other, we need to consolidate to one
+ const response = await clippy(openai as any, supabaseClient, messages, {
useAltSearchIndex,
})
diff --git a/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx b/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
index c56f34d0fe9dd..c88b9525ed57a 100644
--- a/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
+++ b/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
@@ -8,6 +8,7 @@ import { memo, useState } from 'react'
import { useIsLoggedIn, useIsUserLoading, useUser } from 'common'
import { isFeatureEnabled } from 'common/enabled-features'
+import { DevToolbarTrigger } from 'dev-tools'
import { Button, buttonVariants, cn } from 'ui'
import { AuthenticatedDropdownMenu, CommandMenuTriggerInput } from 'ui-patterns'
import { getCustomContent } from '../../../lib/custom-content/getCustomContent'
@@ -43,6 +44,7 @@ const TopNavBar: FC = () => {
+
diff --git a/apps/docs/content/guides/getting-started/mcp.mdx b/apps/docs/content/guides/getting-started/mcp.mdx
index 30addfc75149a..3a6c8982a94be 100644
--- a/apps/docs/content/guides/getting-started/mcp.mdx
+++ b/apps/docs/content/guides/getting-started/mcp.mdx
@@ -30,6 +30,86 @@ To verify the client has access to the MCP server tools, try asking it to query
For curated, ready-to-use prompts that work well with IDEs and AI agents, see our [AI Prompts](/guides/getting-started/ai-prompts) collection.
+## Available tools
+
+The Supabase MCP server provides tools organized into feature groups. All groups except Storage are enabled by default. You can enable or disable specific groups using the [configuration panel above](#step-2-configure-your-ai-tool).
+
+### Database
+
+- `list_tables` - List all tables in the database
+- `list_extensions` - List available/installed Postgres extensions
+- `list_migrations` - List database migrations
+- `apply_migration` - Apply a database migration
+- `execute_sql` - Execute SQL queries
+
+### Debugging
+
+- `get_logs` - Retrieve service logs (API, Postgres, Edge Functions, Auth, Storage, Realtime)
+- `get_advisors` - Get security and performance advisors
+
+### Development
+
+- `get_project_url` - Get the API URL for a project
+- `get_publishable_keys` - Get anon/public keys
+- `generate_typescript_types` - Generate TypeScript types from schema
+
+### Edge Functions
+
+- `list_edge_functions` - List all Edge Functions
+- `get_edge_function` - Get a specific Edge Function
+- `deploy_edge_function` - Deploy an Edge Function
+
+### Account management
+
+
+
+Disabled when using project-scoped mode (`project_ref` parameter).
+
+
+
+- `list_projects` / `get_project` - List or get project details
+- `create_project` / `pause_project` / `restore_project` - Manage projects
+- `list_organizations` / `get_organization` - Organization management
+- `get_cost` / `confirm_cost` - Cost information
+
+### Docs
+
+- `search_docs` - Search Supabase documentation
+
+### Branching (experimental)
+
+
+
+Requires a paid plan.
+
+
+
+- `create_branch` / `list_branches` / `delete_branch` - Branch management
+- `merge_branch` / `reset_branch` / `rebase_branch` - Branch operations
+
+### Storage (disabled by default)
+
+- `list_storage_buckets` - List storage buckets
+- `get_storage_config` / `update_storage_config` - Storage configuration
+
+## Configuration options
+
+The [configuration panel above](#step-2-configure-your-ai-tool) can set these options for you. If you prefer to configure manually, the following URL query parameters are available:
+
+| Parameter | Description | Example |
+| ------------------- | ---------------------------------------------------- | ------------------------- |
+| `read_only=true` | Execute all queries as a read-only Postgres user | `?read_only=true` |
+| `project_ref=` | Scope to a specific project (disables account tools) | `?project_ref=abc123` |
+| `features=` | Enable only specific tool groups (comma-separated) | `?features=database,docs` |
+
+Parameters can be combined: `https://mcp.supabase.com/mcp?project_ref=abc123&read_only=true`
+
+
+
+When using [Supabase CLI](/docs/guides/cli) for local development, the MCP server is available at `http://localhost:54321/mcp`.
+
+
+
## Manual authentication
By default the hosted Supabase MCP server uses [dynamic client registration](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#dynamic-client-registration) to authenticate with your Supabase org. This means that you don't need to manually create a personal access token (PAT) or OAuth app to use the server.
@@ -108,10 +188,10 @@ We recommend the following best practices to mitigate security risks when using
- **Don't connect to production**: Use the MCP server with a development project, not production. LLMs are great at helping design and test applications, so leverage them in a safe environment without exposing real data. Be sure that your development environment contains non-production data (or obfuscated data).
- **Don't give to your customers**: The MCP server operates under the context of your developer permissions, so you should not give it to your customers or end users. Instead, use it internally as a developer tool to help you build and test your applications.
-- **Read-only mode**: If you must connect to real data, set the server to [read-only](https://github.com/supabase-community/supabase-mcp#read-only-mode) mode, which executes all queries as a read-only Postgres user.
-- **Project scoping**: Scope your MCP server to a [specific project](https://github.com/supabase-community/supabase-mcp#project-scoped-mode), limiting access to only that project's resources. This prevents LLMs from accessing data from other projects in your Supabase account.
+- **Read-only mode**: If you must connect to real data, set the server to [read-only](#configuration-options) mode, which executes all queries as a read-only Postgres user.
+- **Project scoping**: Scope your MCP server to a [specific project](#configuration-options), limiting access to only that project's resources. This prevents LLMs from accessing data from other projects in your Supabase account.
- **Branching**: Use Supabase's [branching feature](/docs/guides/deployment/branching) to create a development branch for your database. This allows you to test changes in a safe environment before merging them to production.
-- **Feature groups**: The server allows you to enable or disable specific [tool groups](https://github.com/supabase-community/supabase-mcp#feature-groups), so you can control which tools are available to the LLM. This helps reduce the attack surface and limits the actions that LLMs can perform to only those that you need.
+- **Feature groups**: Restrict which [tool groups](#available-tools) are available using the `features` [configuration option](#configuration-options). This helps reduce the attack surface and limits the actions that LLMs can perform to only those that you need.
## On GitHub
diff --git a/apps/docs/features/app.providers.tsx b/apps/docs/features/app.providers.tsx
index 99e73b93c98c6..6d6caf07877e5 100644
--- a/apps/docs/features/app.providers.tsx
+++ b/apps/docs/features/app.providers.tsx
@@ -1,6 +1,7 @@
import type { PropsWithChildren } from 'react'
import { FeatureFlagProvider, IS_PLATFORM, ThemeProvider } from 'common'
+import { DevToolbar, DevToolbarProvider } from 'dev-tools'
import { SonnerToaster, TooltipProvider } from 'ui'
import SiteLayout from '~/layouts/SiteLayout'
import { API_URL } from '~/lib/constants'
@@ -19,22 +20,25 @@ function GlobalProviders({ children }: PropsWithChildren) {
-
-
-
-
-
-