sourcey
Submit

research:SKILL.mdmcp.jsonopenapi.yml

← Supabase

Can an agent create a database deployment with Supabase Management API?

The agent needs you to sign it up or register a client and provide a key or token. You also handle changes to its access.

observedProbed revision sha256:a3fb946eb393…

Who does each step

how grades work →

Whether the agent handles it alone or a person has to step in.

  1. 01

    Discover

    Machine

    The vendor's machine-readable docs show the agent where and how to call this job.

  2. 02

    Access

    Workaround · setup

    You give the agent a key or token.

  3. 03

    Onboard

    Workaround · setup

    You sign up or register a client for the agent.

  4. 04

    Pay

    Not applicable

    Nothing to pay for the job.

  5. 05

    Confirm

    Machine

    The response or specification defines errors the agent can distinguish from success.

  6. 06

    Sustain

    Workaround · setup

    You replace or revoke the agent's access when it needs to change.

  • Access: handing over a key or token.
  • Onboard: signing up or registering a client for the agent.
  • Sustain: renewing, replacing or revoking its access.

To remove these handoffs: support OAuth client registration so the agent can register its own client and ask for consent; provide an agent registration route, such as auth.md, a sign-up API or OAuth client registration; provide key management or OAuth refresh and revocation so the agent can maintain its own access.

Agent surfaces

5 kinds · 15 entries
For agents
api.supabase.com3 more
mcp.supabase.comsupabase.com/auth.mdsupabase.com/llms.txt
Names the job's endpoint
API
api.supabase.com
Names the job's endpoint
OAuth
api.supabase.com1 more
mcp.supabase.com/mcp
Names the job's endpoint
ARD
mcp.supabase.com/mcp4 more
supabase.com/llms.txtapi.supabase.com/api/v1-jsonsupabase.com/.well-known/agent-skills/index.jsonapi.supabase.com/.well-known/oauth-protected-resource/mcp
ARD
API catalog
api.supabase.com/v12 more
mcp.supabase.com/mcpsupabase.com/.well-known/api-catalog
api-catalog

The probe

14 Oct 2026 · 03:11 UTC · 92.22 s

Each request it sent and what came back; the descriptors it read, counted, with what they named.

Discover47 descriptor reads24 facts
Found
API catalogmcp.supabase.com/mcpARDapi.supabase.com/.well-known/oauth-protected-resource/mcpARDapi.supabase.com/api/v1-jsonARDsupabase.com/llms.txtARDsupabase.com/.well-known/agent-skills/index.jsonAPI catalogsupabase.com/.well-known/api-catalogAPI catalogapi.supabase.com/v1API catalogmcp.supabase.com/mcpAPI catalogmcp.supabase.com/mcpARDapi.supabase.com/.well-known/oauth-protected-resource/mcpARDapi.supabase.com/api/v1-jsonARDsupabase.com/llms.txtARDsupabase.com/.well-known/agent-skills/index.jsonFor agentssupabase.com/auth.mdARDsupabase.com/llms.txtOAuthapi.supabase.comAPI catalogmcp.supabase.com/mcpOAuthapi.supabase.comOAuthapi.supabase.comOAuthapi.supabase.comOAuthapi.supabase.comOAuthapi.supabase.comFor agentsmcp.supabase.comOAuthapi.supabase.com
From
supabase.com/.well-known/ai-catalog.json · supabase.com/.well-known/api-catalog · supabase.com/.well-known/ard.json · supabase.com/auth.md · supabase.com/llms.txt · supabase.com/openapi.json · mcp.supabase.com/.well-known/oauth-protected-resource/mcp · api.supabase.com/.well-known/oauth-authorization-server · api.supabase.com/.well-known/oauth-protected-resource · supabase.com/docs/guides/ai/vector-columns · api.supabase.com/api/v1-json
This endpoint
api.supabase.com is named by a descriptor it read
Job requestPOST api.supabase.com/v1/projects40173 ms
Request
POST https://api.supabase.com/v1/projects
Response
401 · application/json · 38 bytes
Body
sha256:a27228f7625938011d12896866ccc3c3e6c5c98ddda849705fd0eddd0cf79f68
Exchange
sha256:7309479888612b80db9c61006b7de0bbaeb4fa73c3c2b2e6a5b9d9d731f5e84b
Resource metadataGET api.supabase.com/.well-known/oauth-protected-resource/v1/projects40451 ms
Request
GET https://api.supabase.com/.well-known/oauth-protected-resource/v1/projects
Response
404 · application/json · 74 bytes
Body
sha256:99bb6e65f456ac23e7f2183ee59a2fae2135f26e7eaace91eac333ae6c13c815
Exchange
sha256:acae115e032f40002b7420583ebe38b03b3246c4e349acd7394a44f295527615
Resource metadataGET api.supabase.com/.well-known/oauth-protected-resource20053 ms
Request
GET https://api.supabase.com/.well-known/oauth-protected-resource
Response
200 · application/json · 693 bytes
Body
sha256:fd8626a2d5bb809cc1f94feb4fc031191f48b348fe0ef2ff87886993b2386e01
Exchange
sha256:88037653ef8a25729f4a5190fd73b6373877a5a5e1fd5f0aad5bcf3288b5ba19
Authorization serverGET api.supabase.com/.well-known/oauth-authorization-server20047 ms
Request
GET https://api.supabase.com/.well-known/oauth-authorization-server
Response
200 · application/json · 963 bytes
Body
sha256:6a3ab5a76fc1a05afc53a2a7f09654c2fcac845d5ba24964eff451e82f9f2fce
Exchange
sha256:06414e3d6fc40896510d8077d9204a892f3d9b49e17a9d4ab715b58bbac2b5cd
Client registrationPOST api.supabase.com/platform/oauth/apps/register2011197 ms
Request
POST https://api.supabase.com/platform/oauth/apps/register
Response
201 · application/json · 269 bytes
Body
sha256:886b2fa306d0de9737e994c7fc368334b9709f1eb882b9ea402a6be17bd4cc8c
Exchange
sha256:b69885a3146d2afd97a0016a166f351e82ab3998760922d618696401d2fa9451
AuthorizationGET api.supabase.com/v1/oauth/authorize?response_type=code&client_id=8c72c822-10c1-49a1-b0de-5d802ebb9829&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=581f7d88ca46ee10250272f7c882e35a&code_challenge=kvFPHIB45kgWcz3jjpYy0DEqygSw9eKEPazm1Zaokr0&code_challenge_method=S256&resource=https%3A%2F%2Fapi.supabase.com%2Fv1%2Fprojects&scope=analytics%3Aread+analytics%3Awrite+analytics_config%3Aread+analytics_config%3Awrite+auth%3Aread+auth%3Awrite+database%3Aread+database%3Awrite+domains%3Aread+domains%3Awrite+edge_functions%3Aread+edge_functions%3Awrite+environment%3Aread+environment%3Awrite+organizations%3Aread+organizations%3Awrite+projects%3Aread+projects%3Awrite+rest%3Aread+rest%3Awrite+secrets%3Aread+secrets%3Awrite+storage%3Aread+storage%3Awrite40043 ms
Request
GET https://api.supabase.com/v1/oauth/authorize?response_type=code&client_id=8c72c822-10c1-49a1-b0de-5d802ebb9829&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=581f7d88ca46ee10250272f7c882e35a&code_challenge=kvFPHIB45kgWcz3jjpYy0DEqygSw9eKEPazm1Zaokr0&code_challenge_method=S256&resource=https%3A%2F%2Fapi.supabase.com%2Fv1%2Fprojects&scope=analytics%3Aread+analytics%3Awrite+analytics_config%3Aread+analytics_config%3Awrite+auth%3Aread+auth%3Awrite+database%3Aread+database%3Awrite+domains%3Aread+domains%3Awrite+edge_functions%3Aread+edge_functions%3Awrite+environment%3Aread+environment%3Awrite+organizations%3Aread+organizations%3Awrite+projects%3Aread+projects%3Awrite+rest%3Aread+rest%3Awrite+secrets%3Aread+secrets%3Awrite+storage%3Aread+storage%3Awrite
Response
400 · application/json · 61 bytes
Body
sha256:a9090a05bdfaad7f7e3000918edf2f02a8876662d17cd7f8f3cd7c08d8333100
Exchange
sha256:f23706377bbee9188ce382379e636b28245360771d17cf97dda5b38920ec0c0e
Job requestsession openedPOST mcp.supabase.com/mcp40184 ms
Request
POST https://mcp.supabase.com/mcp
Response
401 · application/json · 38 bytes
Body
sha256:a27228f7625938011d12896866ccc3c3e6c5c98ddda849705fd0eddd0cf79f68
Exchange
sha256:e3d07edbcfc65ae0883bf204fc6bd64e653a7a1095940203946475e13152be72
Resource metadataGET mcp.supabase.com/.well-known/oauth-protected-resource/mcp20038 ms
Request
GET https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp
Response
200 · application/json · 487 bytes
Body
sha256:8af236d8e6652ae5c8df672a7ba9379f1ee259587961a31c3ef3d7c0520737be
Exchange
sha256:dcb61a0120c1a088f481ac6fa4a86e8b60e4752079d69d9587e2c1feaadfe6c4
Authorization serverGET api.supabase.com/.well-known/oauth-authorization-server20061 ms
Request
GET https://api.supabase.com/.well-known/oauth-authorization-server
Response
200 · application/json · 963 bytes
Body
sha256:6a3ab5a76fc1a05afc53a2a7f09654c2fcac845d5ba24964eff451e82f9f2fce
Exchange
sha256:969de09738d3fe0b2e3804ca6f77a91ad33ca07c7a1906c95bf71b5182f65572
AuthorizationGET api.supabase.com/v1/oauth/authorize?response_type=code&client_id=8c72c822-10c1-49a1-b0de-5d802ebb9829&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=581f7d88ca46ee10250272f7c882e35a&code_challenge=kvFPHIB45kgWcz3jjpYy0DEqygSw9eKEPazm1Zaokr0&code_challenge_method=S256&resource=https%3A%2F%2Fmcp.supabase.com%2Fmcp&scope=organizations%3Aread+projects%3Aread+projects%3Awrite+database%3Awrite+database%3Aread+analytics%3Aread+secrets%3Aread+edge_functions%3Aread+edge_functions%3Awrite+environment%3Aread+environment%3Awrite+storage%3Aread+storage%3Awrite3032308 ms
Request
GET https://api.supabase.com/v1/oauth/authorize?response_type=code&client_id=8c72c822-10c1-49a1-b0de-5d802ebb9829&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=581f7d88ca46ee10250272f7c882e35a&code_challenge=kvFPHIB45kgWcz3jjpYy0DEqygSw9eKEPazm1Zaokr0&code_challenge_method=S256&resource=https%3A%2F%2Fmcp.supabase.com%2Fmcp&scope=organizations%3Aread+projects%3Aread+projects%3Awrite+database%3Awrite+database%3Aread+analytics%3Aread+secrets%3Aread+edge_functions%3Aread+edge_functions%3Awrite+environment%3Aread+environment%3Awrite+storage%3Aread+storage%3Awrite
Response
303 · text/html · 0 bytes
Body
sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Exchange
sha256:1346e0ad0cf243430e1a6ff155bd00c9b81a70ec95f67a833c3ec9dcd3332a69
Declared pageGET supabase.com/dashboard/sign-up20078 ms
Request
GET https://supabase.com/dashboard/sign-up
Response
200 · text/html · 25257 bytes
Body
sha256:35dcdb4e5ce8d38afe4a90dab641a3f5e76b972e13ee35c1b513ff95c034794c
Exchange
sha256:acb0fefd1a606aa82b1e831f9c892668ec0f679636fdd65858db491534a8fa63

The grade’s badge

One image that keeps itself current, linking here.

Live badge for Supabase Management API, agent grade: B+[![agent grade](https://sourcey.com/badges/agent-readiness/arp_01m4w6a4d3satz8aap6pq85wry.svg)](https://sourcey.com/c/supabase/agent-readiness/supabase-management-api/database-create)

Improve the report

Correct it, probe it again, or improve the path.

Report outdated evidenceRequest reassessmentClaim this record
Profile
arp_01m4w6a4d3satz8aap6pq85wry
Projection
sha256:c9c5d16f04c41f2339cc30507dd00031eb86ffbee144667c91ea824d41b352bb
Policy
kind-2026-10-12.2 · sha256:b612172aad277b54461de84e006815126f2df566563954b02f4432a39cad89ac

A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration