Build something useful with Chumbo.
Practical recipes for Supabase builders: connect your users’ agents, keep your app’s permissions, and give every tool a useful result.
Get started
Build your first useful MCP in the Supabase application you already have.
Your app already does the work. Give agents a way in. ↗
Take an existing Supabase application from a generated MCP function to one useful capability you can discover and call.
Access modesStart with who is connecting. Choose auth from there. ↗
Choose the Chumbo access mode that fits your callers, with a clear account of which identity reaches your Supabase data.
Agent workflowA coding agent with the right context builds the right MCP. ↗
Install project-local Chumbo guidance, preview setup changes and give a coding agent a bounded application task it can verify.
Tool designName the task your user means. Build that tool. ↗
Turn an existing product operation into a narrow MCP tool with clear inputs, caller-owned access and a result the agent can use.
Connect users
Choose a connection that fits your users and preserves your application’s permissions.
Let users connect their accounts. Keep your app’s sign-in. ↗
Give users a sign-in and consent path to your Supabase MCP, then verify the account and permissions behind a real tool call.
Authentication & accessLet agents into your app. Keep your permissions. ↗
Let your users’ agents work with their projects. Chumbo connects the MCP layer to Supabase Auth, so your existing row-level security stays in charge.
Scoped capabilitiesShow callers what they can use. Reject what they cannot. ↗
Serve different capability sets from one MCP using application-resolved scopes, with authorization on discovery and direct calls.
Product URLsPut your MCP at your app’s URL. Keep Supabase behind it. ↗
Expose your existing MCP at a product-facing URL while preserving the function route, OAuth metadata and request behavior.
Design capabilities
Give agents useful tools, readable results, Resources and clear next steps.
Design each result as the next step’s input. ↗
Design readable MCP answers and typed result contracts without dumping database rows or duplicating JSON into text.
Result designTen rows and a cursor beat a thousand rows and a timeout. ↗
Return compact project pages from your Supabase MCP, with bounded results, stable cursors, and a clear next call for agents and typed clients.
Resources and guidanceTeach agents how your app works without pasting the manual into every result. ↗
Add discoverable usage guidance, a readable Resource and a workflow prompt to your MCP without putting a full document in every tool result.
Application actionsOne narrow write, and a receipt for what changed. ↗
Wrap an existing application write in a narrow MCP tool and return a compact receipt with the resulting state and next step.
Test and ship
Check your advertised capabilities, real access behavior and deployment before inviting users.
Test the boundary your callers will hit, not just the code behind it. ↗
Exercise the Chumbo MCP boundary with controlled dependencies, then keep real Supabase authentication and RLS checks as a separate integration layer.
Deployment and debuggingDoes the deployed endpoint answer the call your users will make? ↗
Move from local checks to an actual MCP call, diagnose the failing boundary and verify the deployed endpoint your users will connect to.
Go further
Add interactive Apps, multiple servers, observability or durable state when your application needs them.
Serve several MCPs. Deploy one Edge Function. ↗
Resolve a named MCP from the request path, give each surface its own instructions and capabilities, and keep one deployable Supabase Edge Function.
Durable stateRemember what a caller observed. Fail closed when it changes. ↗
Use Chumbo's bounded credential-partitioned state for read-before-write receipts while application RLS and resource versions remain authoritative.
ObservabilityWhat did the MCP just do? Now you can answer. ↗
Record redacted capability lifecycle facts, capture the advertised tool surface, and join selected calls into an explicit application run.
MCP AppsOpen a useful interface. Keep the action inside MCP. ↗
Serve a bundled interactive MCP App through one Supabase Edge Function while host-mediated tools preserve the caller's auth, scopes, and RLS boundary.
Read it. Try it. Make it yours.
Every recipe includes the example, its prerequisites, expected checks, and source links. Open the Markdown or copy the instructions for your coding agent. Your application remains the authority on its users and data.
Start with the Chumbo guide ↗