Let agents into your app. Keep your permissions.

Your users already have projects in your app. Give their agents a way to find them, using the same identity and access rules. Choose a caller below to see the intended behavior.

Chumbo creates a fresh Supabase client for each caller. In bearer and OAuth modes, that client carries the connected user’s access token. Your database grants and RLS policies govern the query.

From your app’s repository, generate one Edge Function. This recipe uses bearer auth to make a local user-token test explicit. The installed skill gives your coding agent the matching Chumbo instructions.

npx chumbo setup --auth bearer
npx chumbo skill install

Replace the generated whoami starter with list_projects. This example assumes your existing projects table and its owner-based policies. Adapt the query to the operation your app already exposes.

import {
  errorResult, textResult,
  type SupabaseMcpContext,
  type SupabaseMcpServer,
} from "chumbo";
import { z } from "zod";

export function registerCapabilities(
  server: SupabaseMcpServer,
  ctx: SupabaseMcpContext,
) {
  server.registerTool("list_projects", {
    description: "Show up to 10 of your projects in ID order.",
    inputSchema: z.object({}),
    annotations: { readOnlyHint: true },
  }, async () => {
    const { data, error } = await ctx.supabase
      .from("projects")
      .select("id, name")
      .order("id")
      .limit(10)
      .overrideTypes<{ id: string; name: string }[], { merge: false }>();

    if (error) return errorResult(
      "Could not load your projects.",
      "Retry; if this continues, contact your app's support."
    );

    return textResult(data?.length
      ? data.map(p => `- ${p.name} (${p.id})`).join("\n")
      : "No projects are visible to you. Create one in the app, then try again.");
  });
}

This is a small overview of up to ten projects. For a complete browsing workflow, add bounded pagination and detail tools.

Start the local Supabase stack and keep the function running in one terminal. Use your application’s normal fixture setup to create two local users with separate projects.

supabase start
npx chumbo dev --function mcp

In another terminal, check the generated function. Its starter auth test is useful, but your application’s rows need their own isolation check.

deno task --config supabase/functions/mcp/deno.json check
deno task --config supabase/functions/mcp/deno.json test

Set LOCAL_MCP_URL to the exact URL printed by chumbo dev. Set ALICE_LOCAL_JWT and BOB_LOCAL_JWT to those users’ local access tokens in your shell. Keep tokens out of committed files and shared output.

npx chumbo doctor --function mcp \
  --url "$LOCAL_MCP_URL" \
  --token "$ALICE_LOCAL_JWT" \
  --call-tool list_projects

npx chumbo doctor --function mcp \
  --url "$LOCAL_MCP_URL" \
  --token "$BOB_LOCAL_JWT" \
  --call-tool list_projects

Doctor checks call success, not the returned rows. To inspect those rows, open MCP Inspector, select Streamable HTTP, enter the local MCP URL, and configure the Authorization header with Alice’s bearer token. Call list_projects, record the returned fixture IDs, then reconnect as Bob and repeat. Also confirm a fresh connection without a token is rejected.

npx @modelcontextprotocol/inspector

When the local checks pass, confirm the intended linked Supabase project and deploy the function. Repeat the probe with that project’s URL and a hosted test user. Set HOSTED_MCP_URL to the deployed MCP endpoint and HOSTED_USER_JWT to an access token from that same hosted project; local tokens do not apply.

supabase functions deploy mcp --no-verify-jwt

npx chumbo doctor \
  --url "$HOSTED_MCP_URL" \
  --token "$HOSTED_USER_JWT" \
  --call-tool list_projects

Bearer mode works with clients that send an Authorization header. For a user-facing “connect your account” flow, follow the OAuth setup guide and configure your application’s login and consent experience.

Find your client’s connection instructions.

You now have the shape of a useful application capability: a clear operation, the caller’s existing authority, and a result an agent can use. Apply it to the work your users already do.