AI Agents Know About Supabase. They Don't Always Use It Right.

Summary

Supabase is releasing Supabase Agent Skills, an open-source instruction set for AI coding agents working with Supabase through Claude Code, Codex, GitHub Copilot, Cursor, and compatible Agent Skills implementations. The skill addresses recurring errors such as omitted RLS policies, hallucinated CLI commands, views missing security_invoker = true, and reliance on outdated training data by requiring documentation checks and embedding critical security guidance in SKILL.md. It also guides CLI and MCP workflows and recommends direct schema changes on local or staging databases, followed by database advisors and a migration after the schema stabilizes. Early evaluations across six scenarios found MCP + Skill scores of 67% for Claude Opus 4.6, 71% for Claude Sonnet 4.6, 88% for Codex GPT-5.4, and 71% for GPT-5.4 Mini, though the sample was small.

Takeaways

1. 1

   The skill requires agents to check current Supabase documentation through MCP search_docs, markdown documentation fetches, or web search, rather than relying on potentially outdated training data.

2. 2

   Its inline security checklist covers user_metadata authorization, service_role exposure, security_invoker for views, SELECT policies for UPDATE, Storage upsert permissions, and JWT revocation when deleting users.

3. 3

   In early tests, MCP + Skill outperformed both the baseline and MCP-only conditions for every listed model, reaching 88% for Codex GPT-5.4; the results came from a small sample.