Supabase vs Convex

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   A hands-on probe confirms Supabase serves a valid llms.txt at the root domain (HTTP 200) pointing to full documentation, and Supabase's own docs also document agent-oriented integration paths like MCP and CLI that an agent could follow. Missing for 10: independent/community corroboration of agents actually consuming llms.txt in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://supabase.com/llms.txt # Supabase Docs For the complete documentation in a single file, see [Full Docume…”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”

   proof ↗⚑ flag

   Convex✓fullprobed8/10

   Convex confirmed hosts a live llms.txt (HTTP 200) plus a dedicated agent-setup.md file explicitly aimed at making 'your agent a Convex expert,' directly satisfying the story. missing for 10: no independent/third-party confirmation of agents actually consuming these files successfully, and per-page .md docs return 404 so coverage is limited to the root llms.txt/agent-setup files rather than full doc-tree markdown mirrors.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.convex.dev/llms.txt # Convex Documentation > For general information about Convex, read [https://w…”
   • [claimed-docs] “Make your agent a Convex expert: Get Convex-ready by following https://www.convex.dev/agent-setup.md”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.convex.dev/home.md”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase's official CLI explicitly documents running the entire stack locally or in CI (supabase-docs-21), and hands-on probes confirm the CLI installs and runs headlessly via npx and can scaffold a project with no login/keys (supabase-probe-6, supabase-probe-8), which is exactly the CI/automation use case. Missing for 10: no explicit first-party CI pipeline example (e.g., GitHub Actions workflow) or independent third-party CI report beyond the probe evidence.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”

   proof ↗⚑ flag

   Convex~partialprobed6/10

   Convex ships a documented CLI (`npx convex run`, `npx convex import`, `npx convex deploy` implied, `npx convex logs`) and HTTP API for calling functions, both of which are automatable/scriptable in CI, plus self-hosting options for full non-interactive control. However, there is no explicit documentation of a headless/non-interactive CI mode, no CI recipe or GitHub Actions example, and the dev CLI is described as a filesystem-watching interactive workflow rather than an explicit CI-first mode. missing for 10: explicit CI/automation docs or examples (e.g., GitHub Actions integration, non-interactive deploy flags), confirmation that `npx convex deploy` runs fully headlessly without auth prompts.

   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “`npx convex import` — Import data from a file to your deployment”
   • [claimed-docs] “`npx convex logs` — Watch logs from your deployment”
   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”
   • [probe] “official CLI documented at https://docs.convex.dev/cli/overview”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase documents and ships an official MCP server (mcp.supabase.com) that lets AI assistants query/interact with Supabase projects, and a live hands-on probe confirms the remote MCP endpoint is reachable and auth-gated as expected. Community discussion also confirms real-world usage (e.g., Cursor assistant connecting via MCP) alongside security mitigations for prompt injection risks. Missing for 10: independent end-to-end hands-on demonstration of a successful authenticated agent session beyond the 401 handshake check.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Convex✓fullprobed8/10

   Convex ships an official documented MCP server (docs.convex.dev/ai/convex-mcp-server) that exposes tools for AI agents to interact with a Convex deployment, with a safety note that it restricts production access by default, and this is corroborated by a direct probe confirming the doc page exists. Convex is a backend/database product (not itself an agent), so serving an MCP server is squarely within its category. Missing for 10: independent/hands-on community confirmation of the MCP server working in practice, and more detail on the specific tool set exposed.

   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [probe] “official MCP server documented at https://docs.convex.dev/ai/convex-mcp-server”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase ships an official CLI with clear docs and hands-on verification: `npx supabase --version` runs headlessly and `supabase init` scaffolds a project without login or keys, making it directly usable by AI agents/scripts. Missing for 10: no explicit agent-oriented CLI subcommands or independent third-party report of an AI agent driving the CLI end-to-end.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. supabase init to create a new local project 2. supabase start to launch …”

   proof ↗⚑ flag

   Convex✓fullprobed8/10

   Convex ships an official CLI (npx convex ...) with documented commands for dev workflow, running functions, importing data, logs, and insights, and it explicitly integrates with AI-native workflows via agent setup docs and MCP tooling. missing for 10: independent/hands-on third-party corroboration of the CLI's AI-native ergonomics beyond first-party docs, and no explicit versioning/stability notes for CLI commands.

   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “`npx convex import` — Import data from a file to your deployment”
   • [claimed-docs] “`npx convex insights` — Show health insights for your deployment”
   • [claimed-docs] “`npx convex logs` — Watch logs from your deployment”
   • [claimed-docs] “Make your agent a Convex expert: Get Convex-ready by following https://www.convex.dev/agent-setup.md”
   • [probe] “official CLI documented at https://docs.convex.dev/cli/overview”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round drawn
   Supabase✓fullprobed8/10

   Supabase auto-generates REST and GraphQL APIs from the database schema and a live probe confirms a real spec-compliant OpenAPI document at supabase.com/openapi.json, giving AI agents a documented machine-readable API surface. This is reinforced by CLI and MCP tooling that lets an agent programmatically provision and query projects headlessly. Missing for 10: independent third-party validation of API completeness/stability, and explicit versioning/rate-limit docs for programmatic API consumers.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”

   proof ↗⚑ flag

   Convex✓fullprobed8/10

   Convex documents a public HTTP API that exposes deployment functions as callable endpoints, a full-featured CLI for scripting deployments, and an official MCP server specifically for AI agents to interact with the deployment — together giving an AI-native user multiple documented, programmatic ways to drive the product. Missing for 10: a formal OpenAPI/swagger spec (probes found only 404s) and independent hands-on corroboration of third-party API usage.

   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [probe] “official CLI documented at https://docs.convex.dev/cli/overview”
   • [probe] “official MCP server documented at https://docs.convex.dev/ai/convex-mcp-server”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.convex.dev/openapi.json, https://docs.convex.dev/swagger.json, https://docs.convex.dev/…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Convex
   Supabase!disputedcontradicted4/10

   Supabase offers RLS-based fine-grained authorization and says it encourages read-only access by default for its MCP integration (mitigating agent access scope), but a concrete hands-on community report shows the Cursor/Supabase MCP integration actually running with elevated service_role access that bypasses RLS entirely — the opposite of least-privilege scoping. This is a direct, concrete contradiction rather than general skepticism. Missing for 10: documented ability to mint scoped/least-privilege API keys or tokens specifically for agent use, and confirmation that MCP connections default to restricted roles rather than service_role.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”

   proof ↗⚑ flag

   Convex~partialclaimed3/10

   The only relevant evidence is that Convex's MCP server is restricted from production deployments by default as a safety measure, which is a coarse, binary dev/prod restriction rather than true scoped/least-privilege credential issuance for agents (e.g., granular API keys, role-based tokens, or fine-grained permission scopes). Missing for 10: documented ability to mint scoped API keys/tokens per agent, granular permission models, or per-function/table credential scoping.

   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Convex
   Supabase~partialprobed6/10

   Supabase provides auto-generated REST/GraphQL APIs, TypeScript type generation, and quickstart docs for connecting projects, which support building against official client libraries, and its CLI/MCP tooling make it usable by AI agents. However, the evidence pack never explicitly documents a suite of official SDKs (e.g., JS, Python, Flutter) or their API surfaces beyond generated types. Missing for 10: explicit official SDK/client-library documentation across languages, code samples showing SDK usage, and independent confirmation that AI agents build reliably against these SDKs.

   • [claimed-docs] “Generate types for your project to produce the `database.types.ts` file”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”

   proof ↗⚑ flag

   Convex✓fullprobed8/10

   Convex ships official SDKs/framework integrations for React, Next.js, Remix, TanStack Start, React Native, Vue, Nuxt, and Svelte, backed by typed client libraries, CLI tooling, and generated types, plus explicit AI-native tooling (MCP server, agent-setup guide) that lets AI-native developers build against these SDKs directly. Missing for 10: independent/hands-on third-party verification of SDK quality/completeness beyond vendor docs, and no OpenAPI/REST spec for non-JS ecosystems.

   • [claimed-docs] “Using your favorite frameworks: * React * Next.js * Remix * TanStack Start * React Native * Vue * Nuxt * Svelte”
   • [claimed-docs] “Start a new Convex project![...]`npm create convex@latest`”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “Make your agent a Convex expert: Get Convex-ready by following https://www.convex.dev/agent-setup.md”
   • [probe] “official MCP server documented at https://docs.convex.dev/ai/convex-mcp-server”
   • [probe] “official CLI documented at https://docs.convex.dev/cli/overview”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Supabase—none0/10

   The evidence describes Supabase Realtime (Broadcast, Presence, Postgres Changes via websockets) but never mentions a webhooks feature for subscribing to events over HTTP callbacks, which is what the story asks for; missing for 10: any documentation of Database Webhooks or HTTP callback subscription mechanism.

   ⚑ flag

   Convex—none0/10

   Convex exposes HTTP endpoints so external clients can call Convex functions (docs-9, docs-31), but there is no evidence of an outbound webhook mechanism where Convex notifies subscribers of database/event changes. This is a fair capability for a reactive backend to offer, but no such feature is documented.

   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”

   proof ↗⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round to Supabase
   Supabase~partialprobed5/10

   Supabase enables AI assistants (via MCP) to query and interact with a user's Supabase data, and provides a pgvector-based AI toolkit for building AI features into apps, but there is no evidence of a first-party in-dashboard 'insights and suggestions' feature that surfaces AI-generated analysis directly inside Supabase Studio. The MCP-based approach requires connecting an external AI assistant rather than the product itself generating insights natively. missing for 10: evidence of a built-in Studio AI insights/suggestions feature, evidence of automatic proactive suggestions (vs. user-initiated querying via external assistant), independent hands-on validation of insight quality.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “Supabase provides an open source toolkit for developing AI applications using Postgres and pgvector.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”

   proof ↗⚑ flag

   Convex—none0/10

   Convex provides infrastructure (vector search, MCP server) that lets developers build AI features on top of their data, and a CLI 'insights' command that surfaces deployment health metrics — but there is no evidence Convex itself surfaces AI-generated insights or suggestions about the user's actual application data inside the product.

   • [claimed-docs] “`npx convex insights` — Show health insights for your deployment”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector... enable you to provide useful context to LLMs for AI powere…”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”

   proof ↗⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack covers Edge Functions, Realtime, RLS, and MCP/CLI tooling, but contains no mention of scheduled jobs, cron triggers, database webhooks, or any mechanism for autonomous background automations that an AI-native user could set up and let run unattended. As a backend platform, this axis is plausible for Supabase, but no supporting evidence exists in the pack.

   ⚑ flag

   Convex—none0/10

   The evidence pack has no mention of Convex scheduled functions, cron jobs, or any mechanism for autonomous background automation; it only covers reactive queries, HTTP endpoints, and an MCP server for interactive agent access to a deployment. Missing for 10: any citation of cron/scheduled functions, background job triggers, or autonomous workflow execution.

   ⚑ flag

3. ai-native userDelegate tasks to a built-in AI assistant inside the product

   weight 3 · round drawn
   Supabase—none0/10

   All evidence describes Supabase's MCP server, which lets *external* AI assistants (Cursor, Claude, etc.) connect to and query a Supabase project — this is the client-connectivity story, not a built-in assistant living inside Supabase's own product/dashboard. No evidence pack item describes a first-party in-product AI assistant that users delegate tasks to within Supabase itself.

   ⚑ flag

   Convex—none0/10

   Convex ships an MCP server and CLI that let external AI agents interact with a Convex deployment, and docs mention it 'works great with coding agents,' but this is agent-to-Convex tooling, not a built-in assistant embedded inside Convex itself that a user can delegate tasks to. No evidence of an in-product chat/assistant feature exists in the pack.

   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “Convex works great with coding agents. Starting a new project is as easy as asking your agent to create a new app with Convex.”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”

   proof ↗⚑ flag

4. ai-native userOperate the product with natural-language commands

   weight 2 · round to Supabase
   Supabase✓fullprobed8/10

   Supabase ships an official, documented MCP server enabling AI assistants to query and operate projects via natural language, corroborated by a live hands-on handshake against the production MCP endpoint and documented prompt-injection mitigations from a Supabase engineer. Missing for 10: independent quality benchmarking of the NL interface itself and full resolution of security concerns (e.g., service_role bypassing RLS in some client configs).

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Convex~partialprobed6/10

   Convex offers an official MCP server so AI agents can inspect/query deployments in natural language, plus agent-setup guidance and messaging that it 'works great with coding agents' for scaffolding projects via natural-language requests. However, this relies entirely on external coding agents/MCP clients rather than a built-in NL interface, and production access is restricted by default. Missing for 10: a first-party conversational/NL interface within Convex itself, and independent hands-on evidence of natural-language operation succeeding end-to-end.

   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “Make your agent a Convex expert: Get Convex-ready by following https://www.convex.dev/agent-setup.md”
   • [claimed-docs] “Convex works great with coding agents. Starting a new project is as easy as asking your agent to create a new app with Convex.”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [probe] “official MCP server documented at https://docs.convex.dev/ai/convex-mcp-server”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Supabase
   Supabase~partialprobed4/10

   Evidence shows Supabase auto-generates REST/GraphQL APIs and exposes a public OpenAPI spec (openapi.json), implying some form of API reference exists, but there is no direct evidence of an interactive reference page with runnable/executable code examples for AI-native exploration. Missing for 10: explicit documentation or screenshot of an interactive API docs page, evidence of runnable/testable examples in the browser, and any AI-specific tooling around that reference beyond the generic OpenAPI file.

   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Instant ready-to-use **REST APIs**.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Convex—none0/10

   No evidence of an interactive API reference or runnable-example playground; probes explicitly show no OpenAPI/Swagger spec (404s) and only static docs pages plus an llms.txt for AI consumption. Convex offers CLI, MCP server, and HTTP API docs, but nothing indicating a browsable, runnable API explorer.

   • [probe] “PROBE docs-md: HTTP 404 at https://docs.convex.dev/home.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.convex.dev/openapi.json, https://docs.convex.dev/swagger.json, https://docs.convex.dev/…”
   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Probe evidence confirms a live, machine-readable OpenAPI spec at supabase.com/openapi.json returning a valid 'openapi' key, plus a documented REST API auto-generated from the database and generated TypeScript types. Missing for 10: no independent third-party confirmation of spec completeness or versioning stability.

   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Convex—none0/10

   A direct probe for OpenAPI/swagger spec files at all standard candidate paths returned 404, and no documentation mentions a downloadable API spec despite Convex exposing HTTP endpoints for functions.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.convex.dev/openapi.json, https://docs.convex.dev/swagger.json, https://docs.convex.dev/…”
   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round drawn
   Supabase✓fullprobed8/10

   Supabase offers both local development (via CLI 'supabase init/start', hands-on verified) and branching environments explicitly designed to test schema/config/feature changes without affecting production, directly matching the sandbox-without-touching-production story. Community evidence corroborates real usage of local dev/migrations, though some report local dev as a weak point (comm-7, comm-8). Missing for 10: independent hands-on confirmation of branching workflow specifically, and no direct evidence addressing data-seeding/isolation guarantees in the sandbox beyond docs claims.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex has separate dev/production deployments (npx convex dev pushes to dev deployment, not prod) and the official MCP server explicitly blocks access to production deployments by default as a safety measure to prevent accidental modifications to production data, directly enabling sandboxed testing for AI agents. missing for 10: independent/hands-on corroboration of this safety boundary actually holding in practice, and no explicit mention of a dedicated 'staging' environment distinct from dev/prod.

   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack has no mention of API versioning schemes or a documented deprecation policy for Supabase's REST/GraphQL/Auth/Storage APIs; there's an OpenAPI spec probe but nothing about version lifecycle or deprecation commitments. This is a fair axis for a backend platform with public APIs, so absence of evidence yields 'none'.

   ⚑ flag

   Convex—none0/10

   No evidence of API versioning scheme or a documented deprecation policy; OpenAPI spec probe returned 404s and no changelog/versioning docs are cited.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.convex.dev/openapi.json, https://docs.convex.dev/swagger.json, https://docs.convex.dev/…”

   proof ↗⚑ flag

Ai assist

1. ai-native userAsk an AI assistant in the dashboard to write queries, debug errors, and explain my backend

   weight 2 · round to Supabase
   Supabase~partialprobed5/10

   Evidence shows Supabase's MCP integration lets external AI assistants (e.g., Cursor) query and operate on Supabase projects, and community reports confirm real-world use of an AI assistant against the database (with RLS-bypass caveats). However, none of the evidence specifically documents a native AI assistant embedded inside the Supabase dashboard UI itself, nor its ability to explicitly debug errors or explain the backend within that context — the evidence centers on MCP-based external tool connections, not an in-dashboard chat assistant. Missing for 10: dedicated dashboard-embedded assistant UI documentation, explicit debug/explain feature descriptions, and independent hands-on confirmation of dashboard-based query writing.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”

   proof ↗⚑ flag

   Convex—none0/10

   Evidence shows an official MCP server that lets external AI agents (e.g., coding assistants in an IDE) query/mutate/debug a Convex deployment, but nothing describes an AI assistant embedded within the Convex dashboard UI itself for writing queries, debugging errors, or explaining the backend. The story specifically asks about an in-dashboard assistant, which is not evidenced.

   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [claimed-docs] “Make your agent a Convex expert: Get Convex-ready by following https://www.convex.dev/agent-setup.md”

   proof ↗⚑ flag

Vector

1. developerStore embeddings and run vector similarity search for AI features

   weight 3 · round drawn
   Supabase✓fullclaimed8/10

   Supabase explicitly ships pgvector-based AI toolkit and lists 'Vector embeddings' as a core product feature alongside its Postgres stack, directly enabling embedding storage and similarity search. missing for 10: no hands-on probe demonstrating actual vector search query execution, and no independent/community corroboration of vector search performance or usage.

   • [claimed-docs] “Supabase provides an open source toolkit for developing AI applications using Postgres and pgvector.”
   • [claimed-docs] “Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [claimed-docs] “Start your project with a Postgres database. Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex documents native vector search over stored documents specifically framed for embeddings and LLM context/recommendations use cases (convex-docs-7, convex-docs-14, convex-docs-29, convex-docs-35), integrated directly into its database without extra infrastructure. Missing for 10: independent hands-on benchmarks or community validation of vector search at scale, and details on index configuration/limits.

   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector... enable you to provide useful context to LLMs for AI powere…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector. Typically, vectors will be embeddings which are numerical re…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector... enable you to provide useful context to LLMs for AI powere…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector.”

   proof ↗⚑ flag

Authentication

1. developerAdd email/password and social OAuth sign-in with the platform SDK in minutes

   weight 3 · round to Supabase
   Supabase✓fullcommunity8/10

   Supabase Auth docs explicitly list password, magic link, OTP, social login, and SSO as supported methods, and community evidence confirms real developers implementing RLS + OAuth providers in production apps, indicating SDK-based setup works in practice. Missing for 10: no direct evidence of the specific SDK code snippets/quickstart timing claim ('minutes') or independent hands-on verification of OAuth setup speed.

   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”

   proof ↗⚑ flag

   Convex~partialclaimed6/10

   Convex docs confirm Convex Auth library supports password, social OAuth, OTP email/SMS sign-in, plus recommended third-party providers like Clerk/Auth0/WorkOS with SDK integration guidance for React/Next.js/React Native, but the evidence doesn't show a single unified 'minutes' quick-start flow or hands-on confirmation of setup speed. missing for 10: a concrete quick-start walkthrough/tutorial demonstrating minutes-level setup, independent developer testimony confirming ease/speed, and explicit code snippets for combined email/password + OAuth configuration.

   • [claimed-docs] “Clerk has great Next.js and React Native support”
   • [claimed-docs] “you can implement auth directly in Convex with the Convex Auth library... helps you build a custom sign-up/sign-in flow via social identity …”
   • [claimed-docs] “Clerk has great Next.js and React Native support ... WorkOS AuthKit is built for B2B apps ... Auth0 is more established with more bells and …”
   • [claimed-docs] “For client-side React and React Native mobile apps you can implement auth directly in Convex with the Convex Auth library.”

   proof ↗⚑ flag

2. platform-engineerRequire MFA and enterprise SSO (SAML/OIDC) for my application users

   weight 2 · round to Supabase
   Supabase~partialclaimed3/10

   Docs mention SSO as one of many supported auth methods, implying enterprise SSO (SAML/OIDC) support, but there is no evidence of MFA enforcement mechanisms or platform-level policy to require MFA/SSO for application users. missing for 10: explicit MFA requirement/enforcement docs, OIDC/SAML configuration details, admin controls to mandate SSO for all users, independent corroboration.

   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”

   proof ↗⚑ flag

   Convex—none0/10

   Convex docs describe auth via third-party providers (Clerk, WorkOS AuthKit, Auth0) or its own Convex Auth library for social/email/password sign-in, but there is no evidence of built-in enterprise SSO (SAML/OIDC) or MFA enforcement controls for a platform engineer to configure directly; these would depend entirely on the chosen third-party provider's capabilities, which aren't documented here.

   • [claimed-docs] “Clerk has great Next.js and React Native support”
   • [claimed-docs] “you can implement auth directly in Convex with the Convex Auth library... helps you build a custom sign-up/sign-in flow via social identity …”
   • [claimed-docs] “Clerk has great Next.js and React Native support ... WorkOS AuthKit is built for B2B apps ... Auth0 is more established with more bells and …”
   • [claimed-docs] “For client-side React and React Native mobile apps you can implement auth directly in Convex with the Convex Auth library.”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Convex
   Supabase—none0/10

   The evidence pack documents Supabase's REST API generation, RLS, realtime, storage, and CLI/MCP tooling, but nothing explicitly addresses bulk/batch operations (e.g., batch insert/update/delete across many rows or items) via the API, CLI, or MCP server. Postgres and PostgREST can technically support bulk SQL operations, but this capability is never documented or demonstrated in the evidence provided.

   ⚑ flag

   Convex~partialclaimed4/10

   Convex supports bulk data import via `npx convex import` and lets mutations/queries run arbitrary JS over many documents, and the MCP server lets AI agents call these functions on a deployment. However, there's no documented explicit bulk-write/update/delete API, batch size limits, or a concrete example of an AI agent performing a bulk operation end-to-end. missing for 10: explicit bulk mutation/update/delete API docs, batch operation guarantees/limits, hands-on evidence of an AI agent executing bulk operations via MCP or CLI.

   • [claimed-docs] “`npx convex import` — Import data from a file to your deployment”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Supabase
   Supabase~partialclaimed4/10

   Supabase's Realtime feature lets clients listen to Postgres changes and Edge Functions can act as serverless handlers, which together could be combined to react to database events, but the evidence pack contains no explicit rule-engine, database triggers/webhooks, or automation configuration UI for defining 'if event X then action Y' rules as an AI-native user would expect. missing for 10: explicit database triggers/webhooks documentation, a rules/automation configuration interface, and evidence of AI-native automatic action execution tied to events.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”

   proof ↗⚑ flag

   Convex—none0/10

   The evidence describes Convex's reactive query model (queries automatically re-run when underlying data changes) and HTTP endpoints for calling functions, but there is no mention of user-definable rules, triggers, cron jobs, or scheduled/event-driven actions that a user could configure to fire automatically on arbitrary events. Missing for 10: any documentation of scheduled functions, cron/triggers, or a rule-definition mechanism for automated actions on events.

   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”
   • [community] “Convex engineer (james_cowling) on query invalidation: 'We track the readset for any active subscription. When a new write transaction commi…”
   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”

   proof ↗⚑ flag

3. ai-native userSchedule recurring jobs or workflows

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack covers Supabase's database, auth, storage, realtime, edge functions, CLI, and MCP integration, but contains no mention of a scheduling feature (e.g., pg_cron, scheduled Edge Functions, or workflow orchestration) for recurring jobs. No documentation, community report, or probe references any cron-like or recurring-job capability.

   ⚑ flag

   Convex—none0/10

   The evidence pack covers Convex's reactive database, auth, CLI, MCP server, and self-hosting, but contains no mention of cron jobs, scheduled functions, or recurring workflow scheduling capabilities, which is a plausible and often-touted Convex feature but is absent from this evidence set.

   ⚑ flag

4. ai-native userVersion, review, and roll back my automations

   weight 1 · round to Supabase
   Supabase~partialclaimed3/10

   Supabase's branching feature lets users create separate environments to test schema/config/feature changes without affecting production, which is a git-like versioning mechanism, but this applies to database schema/config rather than 'automations' specifically, and there is no explicit rollback or review (PR-style) workflow documented for Edge Functions, triggers, or other automation-like constructs. Missing for 10: explicit automation objects (workflows/triggers/functions) with versioning, diff/review, and one-click rollback; independent/hands-on confirmation of rollback working.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”

   proof ↗⚑ flag

   Convex—none0/10

   Convex's docs describe deployments, CLI commands (deploy, logs, insights), and self-hosting, but there is no evidence of any built-in versioning, review, or rollback mechanism for functions/automations — deployments appear to be driven by git-based code pushes with no rollback tooling mentioned. missing for 10: deployment version history, rollback command, and any review/approval workflow for changes.

   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “`npx convex insights` — Show health insights for your deployment”
   • [claimed-docs] “`npx convex logs` — Watch logs from your deployment”

   proof ↗⚑ flag

Database

1. developerConnect to the underlying database with standard clients and ORMs via a connection string

   weight 2 · round to Supabase
   Supabase~partialcommunity5/10

   Supabase is built on Postgres and its docs confirm full self-hosting/local Postgres access and RLS-based auth (implying a standard Postgres connection string is available), but no evidence pack item explicitly documents the connection string format, ORM compatibility (e.g., Prisma, Drizzle), or connection pooling (pgbouncer/Supavisor) setup that developers typically need for direct client/ORM access. missing for 10: explicit docs on connection string/pooling, ORM-specific integration guides (Prisma/Drizzle/TypeORM), and independent hands-on confirmation of connecting via standard Postgres clients.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”

   proof ↗⚑ flag

   Convex—none0/10

   Convex is a TypeScript-native document database with its own query functions and explicitly states 'no need to write any SQL' (convex-docs-2), and self-hosting docs only mention using external stores like Postgres/Neon as backing infra, not exposing Convex data via standard connection strings or ORMs. No evidence of ODBC/JDBC/SQL client or ORM connection-string support is present anywhere in the pack.

   • [claimed-docs] “There is nothing to set up and no need to write any SQL. Just use JavaScript to express your app's needs.”
   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”

   proof ↗⚑ flag

2. developerProvision a managed database and read/write it from client and server SDKs

   weight 3 · round drawn
   Supabase✓fullprobed9/10

   Supabase provisions a managed Postgres database with instant REST/GraphQL APIs, auto-generated type-safe client SDKs, and server-side access via CLI/self-hosting, backed by docs, GitHub feature list, and hands-on probes confirming CLI/local provisioning works. Community evidence corroborates real-world usage building backends with RLS-secured reads/writes from clients (SvelteKit) and servers. Missing for 10: independent benchmark of production-scale read/write reliability and a fully hands-on client-SDK read/write test beyond CLI provisioning.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [claimed-docs] “Instant ready-to-use **REST APIs**.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”
   • [community] “Supabase is great and I've used it for a number of projects over the years... they are by far the cheapest hosted SQL offering I can find so…”

   proof ↗⚑ flag

   Convex✓fullcommunity9/10

   Convex is a managed reactive database with no-setup provisioning (npm create convex@latest), automatic table creation, and client/server SDKs across React, Next.js, Remix, Vue, Svelte, React Native etc., plus HTTP endpoints for server-side access; ACID transactions and real-time sync are documented, and community/HN commentary corroborates the reactivity model internals. missing for 10: no independent hands-on benchmark of read/write latency or large-scale production usage report beyond docs and one HN thread.

   • [claimed-docs] “Convex is the open source, reactive database where queries are TypeScript code running right in the database.”
   • [claimed-docs] “There is nothing to set up and no need to write any SQL. Just use JavaScript to express your app's needs.”
   • [claimed-docs] “Your Convex deployment contains tables that hold your app's data. Initially, your deployment contains no tables or documents. Each table spr…”
   • [claimed-docs] “Real-time sync so your users instantly see the latest data”
   • [claimed-docs] “ACID transactions so concurrent writes never corrupt your data”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”
   • [claimed-docs] “Using your favorite frameworks: * React * Next.js * Remix * TanStack Start * React Native * Vue * Nuxt * Svelte”
   • [claimed-docs] “Start a new Convex project![...]`npm create convex@latest`”
   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”

   proof ↗⚑ flag

3. developerExpress relational queries with joins, constraints, and transactions

   weight 2 · round to Supabase
   Supabase~partialcommunity6/10

   Supabase is built on Postgres, so full SQL relational capabilities (joins, constraints, transactions) are inherently available via direct Postgres connections, and evidence shows RLS policies and schema/migration support. However, the evidence pack focuses mainly on REST/PostgREST APIs, RLS, and CLI/branching rather than explicitly documenting joins, transactions, or foreign-key constraints, and community reports note PostgREST limitations pushing developers back to custom API servers. Missing for 10: explicit docs on PostgREST/join query syntax across relations, transaction support via API/client libraries, constraint definition examples, and independent confirmation these work smoothly at scale.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [claimed-docs] “Instant ready-to-use REST APIs.”

   proof ↗⚑ flag

   Convex~partialcommunity4/10

   Convex explicitly forgoes SQL and relational joins ('no need to write any SQL'), instead letting developers express multi-read/compute logic in TypeScript query functions (convex-comm-2) and enforcing ACID transactions (convex-docs-12) and optional schema shape validation (convex-docs-3). There is no documented declarative join operator or relational constraint system (foreign keys, uniqueness enforcement) — joins/constraints must be hand-coded in application logic rather than expressed as first-class relational queries. missing for 10: native join syntax/operator, declarative relational constraints (foreign keys/uniqueness), independent verification of complex multi-table query patterns.

   • [claimed-docs] “There is nothing to set up and no need to write any SQL. Just use JavaScript to express your app's needs.”
   • [claimed-docs] “Though optional, schemas ensure that your data looks exactly how you want.”
   • [claimed-docs] “ACID transactions so concurrent writes never corrupt your data”
   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”

   proof ↗⚑ flag

Realtime

1. developerBuild offline-capable clients whose local writes sync automatically on reconnect

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack covers Supabase's Realtime (Broadcast, Presence, Postgres Changes), Auth, Storage, and local dev CLI, but nothing addresses offline-first client SDKs, local write queuing, conflict resolution, or automatic sync-on-reconnect. Community threads even flag local development and migrations as weak points, with no mention of offline capability.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “Even though it looks like a great product initially, it has a lot of errors and bugs when you are trying to actually build something more ro…”

   proof ↗⚑ flag

   Convex—none0/10

   Convex's evidence pack focuses on real-time reactive sync, ACID transactions, and cloud/self-hosted deployment, but nothing describes offline support, local persistence, or conflict-resolution/sync-on-reconnect for offline writes. Convex's model is explicitly server-driven reactivity (queries re-run on server-side data changes), which is a different capability than offline-first local writes.

   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”
   • [claimed-docs] “Real-time sync so your users instantly see the latest data”
   • [claimed-docs] “It makes it easy to build and scale dynamic live-updating apps.”

   proof ↗⚑ flag

2. developerTrack user presence and broadcast ephemeral state between connected clients

   weight 1 · round to Supabase
   Supabase✓fullcommunity9/10

   Supabase Realtime explicitly documents Presence for tracking/synchronizing user state ('who's online') and Broadcast for sending low-latency ephemeral messages between clients, and a launch community post confirms real-world usage at scale (~2000 concurrent users). Missing for 10: independent hands-on verification of presence/broadcast APIs beyond docs and one launch anecdote.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [claimed-docs] “Chat applications - Real-time messaging with typing indicators and online presence”
   • [community] “Supabase CEO on Realtime Multiplayer launch: added Broadcast (ephemeral messages) and Presence (eventually-consistent state) to the Realtime…”

   proof ↗⚑ flag

   Convex~partialcommunity4/10

   Convex's reactive query/mutation model and real-time sync primitives (automatic re-run of queries on data change, ACID mutations) provide the underlying building blocks needed to implement presence and ephemeral broadcast patterns, but the evidence pack contains no explicit presence feature, example, or component demonstrating this use case. Missing for 10: a documented presence/broadcast component or example, guidance on ephemeral (non-persisted) state handling, and TTL/expiry mechanisms for stale presence data.

   • [claimed-docs] “Real-time sync so your users instantly see the latest data”
   • [claimed-docs] “It makes it easy to build and scale dynamic live-updating apps.”
   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”
   • [community] “Convex engineer (james_cowling) on query invalidation: 'We track the readset for any active subscription. When a new write transaction commi…”
   • [claimed-docs] “Convex Components are sandboxed, open-source building blocks for your app. They let you add complex functionality to your app without implem…”

   proof ↗⚑ flag

3. developerSubscribe to live data changes so my UI updates in real time without polling

   weight 3 · round drawn
   Supabase✓fullcommunity9/10

   Supabase Realtime explicitly supports Postgres Changes (listen to DB changes in real-time), plus Broadcast and Presence, enabling UI updates without polling, and community evidence confirms real-world usage (Realtime Multiplayer launch with concurrent users, developers building chat/typing apps on it). Missing for 10: independent hands-on benchmark of Postgres Changes latency/reliability at scale beyond the CEO's launch post.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [claimed-docs] “Chat applications - Real-time messaging with typing indicators and online presence”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [community] “Supabase CEO on Realtime Multiplayer launch: added Broadcast (ephemeral messages) and Presence (eventually-consistent state) to the Realtime…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”

   proof ↗⚑ flag

   Convex✓fullcommunity9/10

   Convex is built around reactive queries that automatically re-run and push updates to clients when underlying data changes, with first-party docs and detailed engineering explanations of the readset/writeset invalidation mechanism confirming no polling is used. Independent community corroboration from Convex engineers and outside commenters backs the reactivity model as real and functioning. Missing for 10: independent third-party benchmark or large-scale production case study explicitly measuring real-time update latency/reliability at scale.

   • [claimed-docs] “Real-time sync so your users instantly see the latest data”
   • [claimed-docs] “It makes it easy to build and scale dynamic live-updating apps.”
   • [community] “Convex explains reactivity model: 'there is no polling going on here - the query only reruns when the data dependencies change server-side d…”
   • [community] “Convex co-founder (sujayakar) explains internals: 'we entirely re-run the javascript function whenever we detect any of its inputs change...…”
   • [community] “Convex engineer (james_cowling) on query invalidation: 'We track the readset for any active subscription. When a new write transaction commi…”
   • [community] “Outside commenter praising the design: 'I like the model of the full function becomes the point of reactivity. It's very different than Fire…”

   proof ↗⚑ flag

Search

1. developerRun full-text search over my data without wiring up an external search service

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack covers Supabase's database, realtime, auth, storage, vector/AI, and CLI/MCP capabilities extensively, but nowhere mentions Postgres full-text search (tsvector, GIN indexes, or a dedicated search feature). Full-text search is a fair axis for a database-as-a-service product, so absence of evidence yields 'none' rather than 'na'.

   ⚑ flag

   Convex—none0/10

   The evidence pack repeatedly documents Convex's vector search for embeddings-based similarity, but contains no mention of a full-text/keyword search index feature or API for text search without external tooling. Missing for 10: any docs reference to a full-text search index, search() query API, or tokenization/ranking behavior.

   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector... enable you to provide useful context to LLMs for AI powere…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector. Typically, vectors will be embeddings which are numerical re…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector... enable you to provide useful context to LLMs for AI powere…”
   • [claimed-docs] “Vector search allows you to find Convex documents similar to a provided vector.”

   proof ↗⚑ flag

1. developerRun functions automatically in response to database or auth events

   weight 2 · round to Supabase
   Supabase~partialclaimed3/10

   Supabase does offer Edge Functions (supabase-docs-8) and real-time Postgres Changes streaming (supabase-docs-5/22/23), which are the building blocks for event-driven execution, but the evidence pack never documents the actual Database Webhooks / Auth Hooks mechanism that automatically invokes a function on insert/update/delete or auth events. Missing for 10: explicit docs or hands-on proof of Database Webhooks/Auth Hooks wiring DB/auth events directly to function invocation, and any developer confirmation that this works reliably in practice.

   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”

   proof ↗⚑ flag

   Convex—none0/10

   The evidence describes Convex's reactive query model (queries re-run when underlying data changes) and HTTP endpoints for calling functions, but there is no documentation of database/auth event triggers (e.g., 'on insert', 'on user created') that automatically invoke backend functions. Reactivity for client queries is a different mechanism than server-side function triggers implied by the story.

   ⚑ flag

2. developerDeploy server-side functions invoked by HTTP or SDK calls without managing servers

   weight 3 · round drawn
   Supabase✓fullclaimed8/10

   Supabase Edge Functions are explicitly documented as server-side TypeScript functions distributed globally, invocable via HTTP or client SDKs, without server management — matching the story directly. Community evidence corroborates broader platform reliability and real usage, though nothing specifically stress-tests Edge Functions at scale. missing for 10: independent hands-on validation of Edge Function invocation/scaling, and details on cold-start/latency limits.

   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [claimed-docs] “Start your project with a Postgres database. Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex functions (queries, mutations, actions) are deployed serverlessly and can be invoked via SDK calls or exposed as public HTTP endpoints, with no server management required — the platform handles deployment, scaling, and infrastructure. Docs confirm public HTTP endpoints for calling functions and SDK-based invocation is core to the product. missing for 10: independent hands-on benchmarking of production HTTP invocation latency/scaling behavior, and more detail on action-specific server-side execution guarantees beyond docs claims.

   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, a…”

   proof ↗⚑ flag

Ai provisioning

1. ai-native userHave an agent stand up a new backend — schema, auth, and policies — headlessly from the CLI in a script

   weight 3 · round to Supabase
   Supabase✓fullprobed7/10

   The CLI supports fully headless project scaffolding (`supabase init`/`start`) with no login or key required, confirmed by hands-on probes, and Postgres RLS policies (schema/auth authorization) are defined declaratively in SQL that can be run via the CLI/migrations, matching the 'headless from a script' requirement. missing for 10: explicit hands-on evidence of scripting auth-provider configuration and RLS policy deployment together via `supabase db push`/migrations in one automated flow, and independent (non-vendor) confirmation of a full agent-driven backend bootstrap.

   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. supabase init to create a new local project 2. supabase start to launch …”
   • [claimed-docs] “supabase init to create a new local project 2. supabase start to launch the Supabase services”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”

   proof ↗⚑ flag

   Convex~partialprobed5/10

   Convex's CLI (`npx convex dev/run/import/deploy`) and code-first schema/auth model mean an agent could script much of a backend setup, and the MCP server lets agents interact with a deployment programmatically. However, there is no documented example of a fully headless script that provisions auth (Clerk/WorkOS typically require external dashboard setup) and authorization policies end-to-end without manual/interactive steps. Missing for 10: a documented headless script or MCP flow that configures auth providers and authorization policies (not just schema/functions) without human interaction, and evidence this is done end-to-end in practice.

   • [claimed-docs] “Clerk has great Next.js and React Native support”
   • [claimed-docs] “you can implement auth directly in Convex with the Convex Auth library... helps you build a custom sign-up/sign-in flow via social identity …”
   • [claimed-docs] “Clerk has great Next.js and React Native support ... WorkOS AuthKit is built for B2B apps ... Auth0 is more established with more bells and …”
   • [claimed-docs] “Convex doesn't need an opinionated authorization framework like RLS, which is required in client oriented databases like Firebase or Supabas…”
   • [claimed-docs] “which is required in client oriented databases like Firebase or Supabase. This flexibility lets you build and use an authorization framework…”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “Start a new Convex project![...]`npm create convex@latest`”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [probe] “official MCP server documented at https://docs.convex.dev/ai/convex-mcp-server”

   proof ↗⚑ flag

Local

1. developerRun the whole backend stack locally with an emulator or CLI before deploying

   weight 3 · round to Convex
   Supabase!disputedcontradicted5/10

   Docs and a keyless hands-on probe confirm the Supabase CLI (`supabase init`/`supabase start`) can spin up the entire stack (DB, Auth, Storage, Realtime, Functions) locally before deploying, which is exactly what the story asks for. However, independent hands-on community reports directly contradict smooth delivery — one calls local dev/migration 'Supabase's biggest weakness' and another describes it as 'a massive pain with random bugs' making the whole platform feel 'like a hack'. Missing for 10: consistent independent corroboration that local stack runs reliably without the bugs/friction reported by hands-on users.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “Even though it looks like a great product initially, it has a lot of errors and bugs when you are trying to actually build something more ro…”

   proof ↗⚑ flag

   Convex~partialclaimed5/10

   Convex's standard CLI workflow (`npx convex dev`) watches your filesystem and pushes changes, but pushes to a cloud-hosted 'dev deployment' rather than a fully local emulator (convex-docs-6, convex-docs-17). Separately, Convex offers self-hosting where you 'run the Convex backend on your own servers' with 'the same fully up-to-date code the cloud service uses,' which could be used to run the whole stack locally before deploying to production (convex-docs-8, convex-docs-19, convex-gh-1), but the docs frame this as an alternative deployment target rather than an explicit local pre-deploy emulator/test loop. Missing for 10: explicit documentation of a local emulator mode built into the standard dev CLI workflow, and hands-on/community confirmation that self-hosted mode is commonly used as a local pre-deploy sandbox.

   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Supabase
   Supabase~partialprobed7/10

   Supabase auto-generates REST/GraphQL APIs directly from the Postgres schema, exposes an openapi.json spec (confirmed live via probe), and ships a CLI/MCP server that lets an AI agent provision, configure, and query projects headlessly (supabase-docs-13, supabase-gh-2, supabase-probe-3, supabase-probe-6, supabase-probe-8). This gives strong data/API-layer parity with the dashboard for CRUD, auth, storage, and realtime features. However, the evidence pack never confirms parity for dashboard-only administrative actions (billing, org/project creation, scaling settings) via a documented Management API, and community notes point to real friction (PostgREST/RLS limitations, CLI instability) that complicate full UI-equivalent control (supabase-comm-10, supabase-comm-12). Missing for 10: explicit Management API docs covering billing/org/project-lifecycle actions, and independent verification that all dashboard settings are scriptable.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [community] “The Supabase CLI is updated every single time I run `brew upgrade`. It makes me feel like I'm trying to swing a bat around, except it's made…”

   proof ↗⚑ flag

   Convex~partialprobed5/10

   Convex exposes deployment functions via HTTP API and offers a CLI (run, import, logs, insights) plus an MCP server for AI agents to interact with deployments, showing broad but not total API/CLI parity with the dashboard UI. There's no explicit documentation claiming full UI/API parity, and probes found no OpenAPI spec, suggesting some dashboard-only features (e.g., visual data browsing, deployment settings) may lack a documented API equivalent. missing for 10: explicit parity statement, full OpenAPI/reference coverage, evidence that all dashboard actions (schema editing, table browsing, settings) are scriptable via API/CLI.

   • [claimed-docs] “The public functions that define a deployment are exposed at public HTTP endpoints.”
   • [claimed-docs] “These HTTP endpoints allow you to call Convex functions and get the result as a value.”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”
   • [claimed-docs] “`npx convex import` — Import data from a file to your deployment”
   • [claimed-docs] “`npx convex insights` — Show health insights for your deployment”
   • [claimed-docs] “`npx convex logs` — Watch logs from your deployment”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.convex.dev/openapi.json, https://docs.convex.dev/swagger.json, https://docs.convex.dev/…”
   • [probe] “official CLI documented at https://docs.convex.dev/cli/overview”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round drawn
   Supabase~partialcommunity5/10

   Supabase is built on Postgres and offers self-hosting for 'full control over your data,' implying standard SQL/pg_dump portability and no lock-in, but the evidence pack contains no explicit documentation of a data-export feature, backup/download tooling, or migration-out guide. Missing for 10: explicit export/backup documentation (e.g., pg_dump instructions or a dashboard 'export project' feature), independent confirmation that self-hosted migration actually works cleanly, and any community report of successfully exporting/leaving.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [github] “We're building the features of Firebase using enterprise-grade open source tools.”
   • [community] “How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are do…”

   proof ↗⚑ flag

   Convex~partialclaimed5/10

   Convex documents open-source self-hosting (same backend as cloud) and an `npx convex import` CLI command, suggesting data portability and no vendor lock-in, but the evidence pack never documents an explicit data-export command or open export format (e.g., JSON/CSV dump) for leaving the platform. missing for 10: documented export command/tool, explicit open-format export (JSON/CSV), independent confirmation of a full data-export workflow.

   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [claimed-docs] “`npx convex import` — Import data from a file to your deployment”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Convex
   Supabase✓fullclaimed7/10

   The GitHub repo (supabase/supabase) is explicitly described as built with 'enterprise-grade open source tools' and aims to give a 'Firebase-like developer experience using open source tools,' and the docs describe self-hosting for full control over data, confirming the source is publicly available and open. Missing for 10: explicit citation of the license file/name (e.g., Apache 2.0) and independent confirmation of license terms beyond marketing language.

   • [github] “We're building the features of Firebase using enterprise-grade open source tools.”
   • [github] “Our aim is to give developers a Firebase-like developer experience using open source tools.”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex explicitly documents itself as open source, with a public GitHub repo (get-convex/convex-backend) for the self-hosted backend containing 'the same fully up-to-date code the cloud service uses,' and Convex Components are described as open-source building blocks — giving AI-native users direct access to readable source under an open license. missing for 10: explicit statement of the specific open-source license terms and independent confirmation of license permissiveness.

   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, a…”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”
   • [claimed-docs] “Convex Components are sandboxed, open-source building blocks for your app. They let you add complex functionality to your app without implem…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase explicitly documents self-hosting as a supported deployment model for full data control/compliance, with docs and CLI tooling (supabase init/start) to run the entire stack locally or in CI, corroborated by a hands-on probe confirming headless local provisioning. missing for 10: independent hands-on verification of a full production self-hosted deployment (beyond local dev) and community reports raise friction/rough edges in self-hosting experience.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are do…”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex explicitly supports self-hosting the open-source backend on your own servers, with documentation confirming it runs the same code as the cloud service and integrates with common infra (Neon, Fly.io, Postgres, RDS, Sqlite, etc.). Missing for 10: independent hands-on reports of self-hosting at scale in production and more detail on feature parity/limitations versus the cloud offering.

   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, a…”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to Supabase
   Supabase~partialclaimed5/10

   Supabase docs claim self-hosting as an option for users needing 'full control over your data' or compliance requirements, which implies data residency control by running your own infrastructure (supabase-docs-3/29). However, the evidence pack contains no explicit documentation of region selection for hosted/managed Supabase projects (e.g., a region picker at project creation), which is the more common AI-native use case. Missing for 10: explicit hosted-plan region selection docs, confirmation of available regions, and independent verification of residency guarantees.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”

   proof ↗⚑ flag

   Convex—none0/10

   No evidence of region/data-residency selection controls in Convex's cloud offering; self-hosting is mentioned but that requires managing your own infrastructure rather than choosing a region within Convex's service, and no docs describe region pinning or residency options. missing for 10: any documentation of region/residency selection, data locality controls, or compliance-driven region choice in the managed cloud product.

   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, a…”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend”
   • [github] “Self-hosted Convex works well with a variety of tools including Neon, Fly.io, Vercel, Netlify, RDS, Sqlite, Postgres, and more.”
   • [claimed-docs] “Log streaming * Exception reporting * HIPAA/SOC 2 reports * Daily backups * Custom domains”

   proof ↗⚑ flag

2. ai-native userControl data retention and deletion

   weight 2 · round to Convex
   Supabase—none0/10

   The evidence pack shows Supabase's self-hosting option ('full control over your data') and RLS/storage access controls, but nothing documents explicit data-retention policies, project/data deletion tooling, backup expiry controls, or user-data erasure workflows that would let an AI-native user manage retention/deletion. Missing for 10: documented deletion APIs (e.g., project/user data deletion), retention policy settings, backup lifecycle controls, and GDPR-style data erasure guarantees.

   ⚑ flag

   Convex~partialclaimed4/10

   Convex offers self-hosting (full control over your own data infrastructure) and lists HIPAA/SOC 2 reports plus daily backups as enterprise features, which implies some data governance controls, but there is no explicit documentation of user-facing data retention policies, deletion APIs, or right-to-erasure workflows. missing for 10: explicit data deletion/retention API or policy docs, GDPR/right-to-erasure support, retention configuration options.

   • [claimed-docs] “you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, and contains the same fully up-to-date …”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend...”
   • [claimed-docs] “If you're excited about self-hosting, you can run the Convex backend on your own servers. Self-hosted Convex runs the open-source backend, a…”
   • [claimed-docs] “Log streaming * Exception reporting * HIPAA/SOC 2 reports * Daily backups * Custom domains”

   proof ↗⚑ flag

3. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Supabase—none0/10

   No evidence pack item discusses telemetry, usage tracking, opt-out settings, or privacy controls for CLI/dashboard analytics; the pack covers unrelated product features (auth, storage, realtime, MCP, self-hosting). Missing for 10: any docs or settings referencing telemetry collection, an opt-out flag/env var, or privacy policy statement on usage data.

   ⚑ flag

   Convex—none0/10

   No evidence pack item discusses telemetry, usage analytics, or an opt-out mechanism in Convex CLI/backend/docs; self-hosting is offered but that's a deployment choice, not a documented telemetry toggle.

   ⚑ flag

Ai migrations

1. ai-native userLet an agent create and test schema changes in an isolated branch or preview environment before production

   weight 3 · round to Supabase
   Supabase~partialprobed7/10

   Supabase documents a first-class branching feature explicitly for testing schema changes in isolation before production (supabase-docs-10/17/24), and separately provides an MCP server plus CLI that let AI agents interact with and provision projects programmatically (supabase-docs-1/27, supabase-probe-4/6/7/8). However, there is no direct evidence tying agent/MCP workflows to the branching feature itself, and community feedback flags migration/local-dev tooling as a weak point ('local development & database migration story is Supabase's biggest weakness' — supabase-comm-7) and notes AI agents often run with elevated service_role access that bypasses RLS (supabase-comm-15), raising safety caveats for autonomous schema testing. Missing for 10: explicit documentation/example of an agent using MCP+CLI to create a branch, apply/test schema changes, and promote to production; independent hands-on validation of that full agent-branch loop.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”
   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Convex~partialclaimed5/10

   Convex's CLI/dev deployment model (docs-6/17) automatically syncs schema changes to a separate dev deployment when developing, and the official MCP server explicitly blocks access to production deployments by default as a safety measure (docs-28), which together let an agent iterate on schema changes in an isolated, non-production environment. However, there is no explicit mention of a distinct 'branch' or 'preview environment' feature, nor documentation of testing/promotion workflow from that isolated environment into production. missing for 10: explicit preview/branch deployment feature, agent-driven promotion workflow from dev to production, independent corroboration of this workflow.

   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “By default, the MCP server cannot access production deployments. This is a safety measure to prevent accidental modifications to production …”
   • [claimed-docs] “The Convex Model Context Protocol (MCP) server provides several tools that allow AI agents to interact with your Convex deployment.”

   proof ↗⚑ flag

Migrations

1. developerManage schema changes as version-controlled migrations applied via the CLI or CI

   weight 3 · round to Convex
   Supabase!disputedcontradicted4/10

   Docs confirm the Supabase CLI can run the full stack locally and in CI environments (supabase-docs-21) and branching lets you test schema changes outside production (supabase-docs-10/17), implying a migrations-in-CI workflow, but the evidence pack never shows an actual migration/diff/push command being used. A hands-on community report explicitly states 'The local development & database migration story is Supabase's biggest weakness... I hate having to do migrations live in prod' (supabase-comm-7), directly contradicting the implied smooth CLI/CI migration workflow. missing for 10: explicit evidence of `supabase migration new`/`db push`/`db diff` commands, a documented CI pipeline example, and independent corroboration that migrations work reliably in production.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”

   proof ↗⚑ flag

   Convex~partialclaimed4/10

   Convex schemas are defined in code (schema.ts) and the CLI automatically pushes schema changes to a deployment when files change (convex-docs-6/17), which gives an implicit, version-controllable schema workflow, but the evidence never describes a dedicated migrations system (versioned migration files, up/down scripts) or explicit CI/CD deployment pipeline usage. missing for 10: explicit migration versioning/history tooling, documented CI integration for applying schema changes, rollback support.

   • [claimed-docs] “Though optional, schemas ensure that your data looks exactly how you want.”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “npx convex run <functionName> [args] — Run a public or internal Convex query, mutation, or action on your development deployment.”

   proof ↗⚑ flag

Type safety

1. developerGenerate typed client code (e.g. TypeScript types) from my schema automatically

   weight 2 · round drawn
   Supabase✓fullclaimed8/10

   Supabase documents generating type-safe TypeScript definitions (database.types.ts) directly from database introspection via CLI/API tooling, a core first-party feature. Missing for 10: independent/hands-on confirmation of the generated types working in a real project and coverage of edge cases (e.g., custom types, enums) beyond docs.

   • [claimed-docs] “Generate types for your project to produce the `database.types.ts` file”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”

   proof ↗⚑ flag

   Convex✓fullclaimed8/10

   Convex's CLI dev process watches schema/function changes and automatically updates generated TypeScript types in convex/_generated, giving end-to-end type safety from schema to client code without manual codegen commands. This is well documented in official docs and reinforced by the 'end-to-end type safety' marketing claim. Missing for 10: independent/hands-on developer confirmation of the generated types workflow beyond first-party docs.

   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment and the generated…”
   • [claimed-docs] “Watches the local filesystem. When you change a function or the schema, the new versions are pushed to your dev deployment”
   • [claimed-docs] “End-to-end type safety so agent hallucinations are caught before they ship”

   proof ↗⚑ flag

Access control

1. developerRestrict data access per user with row-level security policies or security rules

   weight 3 · round to Supabase
   Supabase~partialcommunity7/10

   Supabase's docs clearly document RLS policy syntax (e.g. per-user select policies using auth.uid()) and extend fine-grained access control to Storage, directly matching the story. However, community evidence shows real-world friction: RLS limitations forcing workarounds (multiple user tables), an MCP integration that bypasses RLS via service_role, and reports of RLS being tricky to get right initially. missing for 10: independent hands-on verification that policies enforce correctly across all Supabase products, clearer documentation on avoiding service_role bypass pitfalls, and resolution of cited RLS/auth issues left open for over a year.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [community] “I hadn't touched SQL for almost 7 years, but dipped my toes back in to build a PoC using Supabase. Despite some initial pains around RLS, I'…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”

   proof ↗⚑ flag

   Convex~partialclaimed4/10

   Convex explicitly rejects an RLS-style authorization framework, instead relying on developers to write access checks manually inside each query/mutation function ('Convex doesn't need an opinionated authorization framework like RLS... This flexibility lets you build and use an authorization framework for your needs'). This means per-user data restriction is possible but must be hand-coded per function rather than declared as reusable security rules/policies, unlike a dedicated RLS feature. missing for 10: no built-in declarative row-level security policy syntax, no documentation of a reusable rules layer, no independent/hands-on evidence of implementing or testing such access control.

   • [claimed-docs] “Convex doesn't need an opinionated authorization framework like RLS, which is required in client oriented databases like Firebase or Supabas…”
   • [claimed-docs] “which is required in client oriented databases like Firebase or Supabase. This flexibility lets you build and use an authorization framework…”

   proof ↗⚑ flag

Data protection

1. platform-engineerRely on automated backups and point-in-time recovery for my data

   weight 2 · round to Convex
   Supabase—none0/10

   The evidence pack contains no vendor-tier documentation describing automated backups or point-in-time recovery (PITR) features; the only related evidence is a community report (supabase-comm-9) describing nightly pg_dump backups causing write-contention problems and the team merely 'investigating' moving customers to PITR. Since a disputed verdict requires a vendor claim tier plus a contradicting tier, and no first-party docs claim exists here, there is insufficient evidence the capability is delivered at all.

   • [community] “Supabase CEO responding to Val Town's migration postmortem: nightly pg_dump backups caused write-contention issues at midnight on a write-he…”

   proof ↗⚑ flag

   Convex~partialclaimed3/10

   The pricing page lists 'Daily backups' as an included feature on paid plans, confirming some automated backup capability, but there is no mention of point-in-time recovery, backup retention windows, restore process, or how backups work for self-hosted deployments. Missing for 10: point-in-time recovery details, backup restore/testing docs, retention policy specifics, and independent verification of backup reliability.

   • [claimed-docs] “Log streaming * Exception reporting * HIPAA/SOC 2 reports * Daily backups * Custom domains”

   proof ↗⚑ flag

Files

1. developerUpload and serve user files with access rules and CDN-backed delivery

   weight 3 · round to Supabase
   Supabase✓fullcommunity7/10

   Supabase Storage docs explicitly describe fine-grained access controls via RLS policies and 'optimized delivery' for files of any size, directly matching the story's core ask (upload, access rules, CDN-like delivery). Community feedback confirms real-world usage of RLS with storage but notes storage still lacks direct metadata support, a secondary limitation rather than a failure of access control or delivery. Missing for 10: explicit mention of CDN infrastructure/edge caching details and independent hands-on confirmation of CDN-backed delivery performance.

   • [claimed-docs] “Supabase Storage is a robust, scalable solution for managing files of any size with fine-grained access controls and optimized delivery.”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [community] “I have been developing with Supabase past two months... there are still some rough corners in general and some basic features missing. Examp…”

   proof ↗⚑ flag

   Convex—none0/10

   The evidence pack contains no mention of file upload, file storage APIs, access-controlled file serving, or CDN-backed delivery anywhere in the Convex docs, CLI, or community citations provided. While file storage is a plausible axis for a backend platform, nothing in this evidence pack substantiates it.

   ⚑ flag

2. developerServe resized or transformed images from storage without running my own image pipeline

   weight 1 · round drawn
   Supabase—none0/10

   The evidence only describes Supabase Storage generally as offering 'fine-grained access controls and optimized delivery' (supabase-docs-7, supabase-docs-30) but never mentions image resizing, transformation parameters, or a CDN-based image pipeline feature. Missing for 10: any documentation of an image transformation/resizing API or CDN, hands-on proof of resized image delivery.

   • [claimed-docs] “Supabase Storage is a robust, scalable solution for managing files of any size with fine-grained access controls and optimized delivery.”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”

   proof ↗⚑ flag

   Convex—none0/10

   No evidence in the pack mentions Convex file storage supporting image resizing/transformation or any built-in image pipeline; storage-related evidence is entirely absent. This is a fair axis for a backend/storage platform, so lack of evidence yields 'none' rather than 'na'.

   ⚑ flag