A way to operate Supabase through its REST APIs, including project administration, database queries, authentication, file storage, realtime features, and Edge Functions. Supabase is a hosted backend platform for applications.

Use it to list projects, retrieve API keys, read or write database tables, manage users and storage buckets, and work with supported project services when the required credentials are available.

It lets an agent perform supported Supabase operations without an MCP server. It also separates organization and project administration from requests to a specific project's services.

supabase — Skill for Claude Code and Codex by mnlt/teleport

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add mnlt/teleport --skill supabase

Clone the repo

git clone --depth 1 https://github.com/mnlt/teleport

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/mnlt/teleport/supabase/github.svg)](https://agentmods.dev/skills/mnlt/teleport/supabase)

Your own site

<a href="https://agentmods.dev/skills/mnlt/teleport/supabase"><img src="https://agentmods.dev/badge/skills/mnlt/teleport/supabase/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/mnlt/teleport/supabase"><img src="https://agentmods.dev/badge/skills/mnlt/teleport/supabase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 67 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,040 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00067	$0.02040
Opus 5.5	$0.00027	$0.00816
Sonnet 5.5	$0.00013	$0.00408
Haiku 4.5	$0.00007	$0.00204

Measured 1mo ago against content hash 5680d55f494a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

supabase scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

> That covers the Management API PAT (`SUPABASE_ACCESS_TOKEN`). For per-project keys (`SUPABASE_URL` + `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY`), grab them from your project's dashboard → Settings → API — those

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sL \

skills/supabase/SKILL.md · 128 lines

How it starts

The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Supabase

Direct HTTP against Supabase's REST APIs — no MCP server required. Two distinct API surfaces on different hosts with different auth. Picking the wrong one is the single most common failure mode; internalize the split before sending any request.

Usage

Use for: Listing projects / fetching API keys, PostgREST table reads/writes, auth admin, storage bucket CRUD.
Skip for: Concept questions (RLS theory), direct psql over postgres://…, debugging user's supabase-js code, schema design.

Credentials check

# For Management API tasks
[ -n "$SUPABASE_ACCESS_TOKEN" ] && echo "SUPABASE_ACCESS_TOKEN: PRESENT" || echo "SUPABASE_ACCESS_TOKEN: MISSING"

# For Project REST tasks
for v in SUPABASE_URL SUPABASE_ANON_KEY SUPABASE_SERVICE_ROLE_KEY; do
  eval "val=\${$v}"
  [ -n "$val" ] && echo "$v: PRESENT" || echo "$v: MISSING"
done

Never echo these variable values directly — they would appear in the conversation transcript. Use only the boolean patterns above.

If the credentials for the task are MISSING, respond to the user with EXACTLY this message (do NOT paraphrase, do NOT suggest manual JSON edits for the management PAT):

I need your Supabase credentials. Run this in another terminal:
teleport-setup add-key supabase
That covers the Management API PAT (SUPABASE_ACCESS_TOKEN). For per-project keys (SUPABASE_URL + SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY), grab them from your project's dashboard → Settings → API — those still need to be added to ~/.claude/settings.local.json manually (not yet covered by add-key).

Then restart Claude Code (/exit, then claude) and ask me again.

Do NOT suggest editing ~/.claude/settings.local.json manually for the management PAT. teleport-setup add-key supabase handles it safely with backup + masked input. Stop execution until the user has run the command and restarted.

The two-surface split — read this first

Surface	Base URL	Auth header(s)	Env vars
Management API	`https://api.supabase.com/v1/...`	`Authorization: Bearer $SUPABASE_ACCESS_TOKEN`	`SUPABASE_ACCESS_TOKEN` (personal access token)
Per-project REST	`$SUPABASE_URL/rest/v1/...`	Both: `apikey: $KEY` AND `Authorization: Bearer $KEY` (same value in both)	`SUPABASE_URL` + `SUPABASE_ANON_KEY` or `SUPABASE_SERVICE_ROLE_KEY`
Per-project Auth	`$SUPABASE_URL/auth/v1/...`	Same two-header pattern	Same as REST
Per-project Storage	`$SUPABASE_URL/storage/v1/...`	Same two-header pattern	Same as REST

Read the full file on GitHub · 128 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 128 lines · 67 tokens per session scan B 5680d55f494a

Subscribe to this mod's changes

supabase is a skill published in the GitHub repository mnlt/teleport (8 stars, last pushed 5mo ago), licensed MIT. It adds 67 tokens to every session and 2,040 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Claude Code Databases anthropic cli developer-tool mcp model-context-protocol

system-design

Production system design — scalability patterns, trade-off analysis, database selection, caching strategy, API design, and architecture decisions.

chandrudp29/skillhub · 26 tokens

content-modeling-best-practices

Structured content modeling guidance for schema design, content architecture, content reuse, references versus embedded objects, separation of concerns, and taxonomies across Sanity and other headless CMSes. Use this skill when designing or refactoring content types, deciding field shapes, debating reusable versus…

opencue/cuecards · 84 tokens

backend-patterns

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes. Use when building or reviewing Node.js, Express, or Next.js API routes and their data access.

affaan-m/ECC · 51 tokens

event-store-design

Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.

wshobson/agents · 33 tokens

cqrs-implementation

Implement Command Query Responsibility Segregation for scalable architectures. Use when separating read and write models, optimizing query performance, or building event-sourced systems.

wshobson/agents · 35 tokens

ai-persistence/build-drizzle-adapter

Use when an app already runs Drizzle ORM and needs TanStack AI chat persistence — writes a chat-persistence.ts into the app against its existing db handle, schema file, and drizzle-kit journal. Covers the four tables (SQLite/Postgres/MySQL), the onConflict idempotency rules, JSON columns, and per-request bindings like…

TanStack/ai · 79 tokens

supabase