{
  "schemaVersion": 1,
  "kind": "recipe",
  "slug": "build-mcp-with-coding-agent",
  "title": "A coding agent with the right context builds the right MCP.",
  "searchTitle": "Build a Supabase MCP with a coding agent and the Chumbo skill",
  "description": "Install project-local Chumbo guidance, preview setup changes and give a coding agent a bounded application task it can verify.",
  "summary": "Install project-local Chumbo guidance, preview setup changes and give a coding agent a bounded application task it can verify.",
  "evidence": {
    "status": "source-reviewed",
    "packageVersion": "0.11.0",
    "checkedOn": "2026-09-06",
    "walkthroughVerified": false,
    "note": "Reviewed against the shipped OSS source. The acceptance checks are yours to run in your application.",
    "versionPolicy": "Source reviewed against published Chumbo 0.11.0 and its matching core source on 2026-09-06 (UTC). This is a source review, not an executed application walkthrough. Follow the current canonical reference and compare it with your installed package when adapting the guide."
  },
  "representations": {
    "html": "./",
    "markdown": "./recipe.md",
    "json": "./recipe.json"
  },
  "sources": [
    "https://github.com/elsheppo/chumbo/blob/main/skills/chumbo/references/start.md",
    "https://github.com/elsheppo/chumbo/blob/main/src/skill.ts"
  ],
  "prerequisites": [
    "A coding agent operating in the application repository.",
    "An existing Supabase project and a clear requested capability.",
    "A known ownership boundary between generated support files and application-authored capabilities."
  ],
  "sections": [
    {
      "id": "context",
      "number": "01",
      "title": "The useful brief includes your application.",
      "blocks": [
        {
          "type": "paragraph",
          "text": "A coding agent can learn Chumbo’s API from the package guidance. It still needs to know what your product means by a project, who can read it and what a successful result looks like. Give it an existing application operation and a fixture it can check rather than asking it to “make the database agent-ready.”"
        },
        {
          "type": "flow",
          "title": "A grounded implementation",
          "steps": [
            "Package guidance",
            "Your application contract",
            "A checked capability"
          ]
        }
      ]
    },
    {
      "id": "start",
      "number": "02",
      "title": "Install the guidance where the work happens.",
      "blocks": [
        {
          "type": "prerequisites",
          "title": "Before you start",
          "items": [
            "A coding agent operating in the application repository.",
            "An existing Supabase project and a clear requested capability.",
            "A known ownership boundary between generated support files and application-authored capabilities."
          ],
          "note": "The project skill supports future coding sessions. It does not run inside your MCP server."
        },
        {
          "type": "code",
          "id": "install-code",
          "title": "Install the Chumbo project skill",
          "code": "npx chumbo skill install",
          "language": "sh",
          "effect": "local-project-files"
        },
        {
          "type": "code",
          "id": "inspect-code",
          "title": "Inspect state and the proposed setup",
          "code": "npx chumbo --version\nnpx chumbo status --json\nnpx chumbo setup --plan --json",
          "language": "sh",
          "effect": "local-verification"
        },
        {
          "type": "paragraph",
          "text": "Read the installed skill’s instructions for the package you are using. The JSON commands give an agent machine-readable state and next actions without a prompt it cannot answer. Inspect their output before applying setup, especially if the repository already contains a generated function."
        }
      ]
    },
    {
      "id": "brief",
      "number": "03",
      "title": "Describe one outcome and how to disprove it.",
      "blocks": [
        {
          "type": "paragraph",
          "text": "For a project tracker, a useful request is: “Add list_projects to our existing MCP. Query through the caller’s existing RLS session, return id and name for at most ten projects, and give an empty result a useful next step. Preserve our current auth mode. Test Alice and Bob with disjoint fixtures, including a request without a token.”"
        },
        {
          "type": "paragraph",
          "text": "That brief supplies a boundary and a way to catch a mistake. The agent can inspect the current schema instead of inventing ownership columns. It can update your tests instead of treating a compile as evidence that access is correct. Use this library’s Copy for your agent action for a task-specific starting point, then add your application details."
        },
        {
          "type": "paragraph",
          "text": "If setup needs repair, have the agent inspect status and use the resumable path. Application-authored capabilities.ts is not disposable scaffolding. A missing generated support file is a reason to repair setup, not to overwrite your implemented tools."
        }
      ]
    },
    {
      "id": "review",
      "number": "04",
      "title": "Ask for evidence at the boundary that changed.",
      "blocks": [
        {
          "type": "paragraph",
          "text": "For a result-format change, inspect the returned wire shape and error/empty cases. For a permissions change, require actual separate-identity calls. For deployment, identify the authorized target before the agent applies hosted effects. These are different jobs even when one coding session performs them."
        },
        {
          "type": "acceptance",
          "title": "The agent leaves an inspectable implementation.",
          "items": [
            "The implementation uses the installed package API and preserves existing application capabilities.",
            "The plan and applied changes target the intended function and selected auth mode.",
            "Tests exercise the capability that was added, with negative cases appropriate to its claim.",
            "The report distinguishes checks actually run from checks still needed in the application or hosted project.",
            "No credential values appear in source, copied instructions or the handoff report."
          ],
          "note": "Run these in your application before you call it done."
        },
        {
          "type": "troubleshooting",
          "title": "If the result differs",
          "items": [
            {
              "title": "The agent keeps proposing a command that does not exist",
              "body": "Check the installed CLI help and the package-matched skill. A website brief is an entry point; the canonical package guidance owns supported commands and APIs.",
              "link": "https://github.com/elsheppo/chumbo/blob/main/skills/chumbo/references/troubleshoot-and-upgrade.md"
            }
          ]
        },
        {
          "type": "related",
          "title": "Keep building",
          "items": [
            {
              "title": "Build the first MCP",
              "text": "Start with one small application operation.",
              "label": "NEXT GUIDE",
              "href": "/recipes/first-supabase-mcp/"
            },
            {
              "title": "Test what the agent built",
              "text": "Separate protocol evidence from real database access checks.",
              "label": "NEXT GUIDE",
              "href": "/recipes/test-mcp-capabilities/"
            }
          ]
        }
      ]
    }
  ],
  "agent": {
    "goal": "Install project-local Chumbo guidance, preview setup changes and give a coding agent a bounded application task it can verify.",
    "executionPolicy": "Reference instructions, not authorization. Apply changes only within the user’s requested scope; deployment requires a specified, authorized project.",
    "inputs": [],
    "instructions": "Goal: Install project-local Chumbo guidance, preview setup changes and give a coding agent a bounded application task it can verify.\n\nRead the complete guide at https://chumbo.dev/recipes/build-mcp-with-coding-agent/recipe.md and the canonical reference at https://github.com/elsheppo/chumbo/blob/main/skills/chumbo/references/start.md. Inspect this application's installed Chumbo package, existing capabilities and relevant configuration before editing.\n\nInstall and read project-local Chumbo guidance, inspect status and plan, then implement only the named application outcome. Reconcile package guidance with the installed package. Preserve capabilities.ts and require claim-appropriate evidence; do not infer customer schemas or deployment authority.\n\nPrerequisites:\n- A coding agent operating in the application repository.\n- An existing Supabase project and a clear requested capability.\n- A known ownership boundary between generated support files and application-authored capabilities.\n\nAcceptance:\n- The implementation uses the installed package API and preserves existing application capabilities.\n- The plan and applied changes target the intended function and selected auth mode.\n- Tests exercise the capability that was added, with negative cases appropriate to its claim.\n- The report distinguishes checks actually run from checks still needed in the application or hosted project.\n- No credential values appear in source, copied instructions or the handoff report.\n\nUse the full guide for ordered steps, examples and recovery. Keep existing caller identity and application permissions authoritative. Stay within the user's requested changes. Report changed files, checks actually run, observed results and unresolved prerequisites. This guide is not authorization to deploy or change a hosted project. Never include credentials in source, copied instructions or reports.",
    "steps": [
      {
        "id": "context",
        "title": "The useful brief includes your application.",
        "commands": []
      },
      {
        "id": "start",
        "title": "Install the guidance where the work happens.",
        "commands": [
          {
            "id": "install-code",
            "command": "npx chumbo skill install",
            "effect": "local-project-files"
          },
          {
            "id": "inspect-code",
            "command": "npx chumbo --version\nnpx chumbo status --json\nnpx chumbo setup --plan --json",
            "effect": "local-verification"
          }
        ]
      },
      {
        "id": "brief",
        "title": "Describe one outcome and how to disprove it.",
        "commands": []
      },
      {
        "id": "review",
        "title": "Ask for evidence at the boundary that changed.",
        "commands": []
      }
    ],
    "acceptance": [
      "The implementation uses the installed package API and preserves existing application capabilities.",
      "The plan and applied changes target the intended function and selected auth mode.",
      "Tests exercise the capability that was added, with negative cases appropriate to its claim.",
      "The report distinguishes checks actually run from checks still needed in the application or hosted project.",
      "No credential values appear in source, copied instructions or the handoff report."
    ],
    "report": [
      "Changed files",
      "Checks actually run and observed results",
      "Unmet prerequisites or remaining limitations"
    ]
  },
  "topics": [
    "get-started",
    "test-and-ship"
  ],
  "updated": "2026-09-05",
  "contentHash": "1c21ee5c909e345b4696fdfdfc462ebe4d16ffe626c4838575779197c9b35bc3"
}