How Supabase’s scores are calculated

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

• [probe] https://supabase.com/llms.txt“PROBE llms.txt: HTTP 200 at https://supabase.com/llms.txt # Supabase Docs For the complete documentation in a single file, see [Full Documentation](https://supabase.com/llms-ful”
• [claimed-docs] https://supabase.com/docs“Start with a quickstart guide to connect your project in minutes.”
• [probe] https://supabase.com/docs/guides/ai-tools/mcp“official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to launch the Supabase services”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Connect an agent via an official MCP serverweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

• [claimed-docs] https://supabase.com/docs/guides/ai-tools/mcp“Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
• [probe] https://supabase.com/docs/guides/ai-tools/mcp“official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
• [probe] https://mcp.supabase.com/mcp“PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server, auth-gated (hands-on, keyless)”
• [community] https://news.ycombinator.com/item?id=44502318“Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses with prompting that discourages following injected instructions, and E2E tests... this significantly lowered the chances of LLMs falling for attacks.'”
• [community] https://news.ycombinator.com/item?id=44502318“The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) protections. This is too bad.”

Use an official CLIweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“With two commands, you can set up and start a new local project: 1. supabase init to create a new local project 2. supabase start to launch the Supabase services”

Drive the product through a documented public APIweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

• [claimed-docs] https://supabase.com“Instant ready-to-use REST APIs.”
• [github] https://github.com/supabase/supabase“Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
• [probe] https://supabase.com/openapi.json“PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
• [claimed-docs] https://supabase.com/docs/guides/api/rest/generating-types“Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [claimed-docs] https://supabase.com/docs/guides/ai-tools/mcp“your AI assistants can interact with and query your Supabase projects on your behalf.”

Issue scoped/least-privilege API credentials for an agentweight 2

2 (weight) × 4 (quality) × 0.3 (disputed) = 2.4 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/database/postgres/row-level-security“Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
• [claimed-docs] https://supabase.com/docs/guides/database/postgres/row-level-security“create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
• [community] https://news.ycombinator.com/item?id=44502318“Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses with prompting that discourages following injected instructions, and E2E tests... this significantly lowered the chances of LLMs falling for attacks.'”
• [community] https://news.ycombinator.com/item?id=44502318“The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) protections. This is too bad.”
• [probe] https://mcp.supabase.com/mcp“PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server, auth-gated (hands-on, keyless)”

Build against official SDKsweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/api/rest/generating-types“Generate types for your project to produce the `database.types.ts` file”
• [claimed-docs] https://supabase.com/docs/guides/api/rest/generating-types“Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
• [github] https://github.com/supabase/supabase“Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
• [claimed-docs] https://supabase.com/docs“Start with a quickstart guide to connect your project in minutes.”
• [claimed-docs] https://supabase.com“Instant ready-to-use REST APIs.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”

Subscribe to events via webhooksweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

• [probe] https://supabase.com/openapi.json“PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
• [claimed-docs] https://supabase.com“Instant ready-to-use REST APIs.”
• [claimed-docs] https://supabase.com“Instant ready-to-use **REST APIs**.”
• [github] https://github.com/supabase/supabase“Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

• [probe] https://supabase.com/openapi.json“PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
• [claimed-docs] https://supabase.com“Instant ready-to-use REST APIs.”
• [claimed-docs] https://supabase.com/docs/guides/api/rest/generating-types“Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
• [github] https://github.com/supabase/supabase“Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 8 (quality) × 1.0 (full) = 8.0 of 10 max

• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting your production setup.”
• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting your production setup.”
• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“Supabase branches create separate environments that spin off from your main project.”
• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [community] https://news.ycombinator.com/item?id=36004925“The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dashboard is just so much better than any alternative Postgres tooling that it's been worth using despite that.”

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Do everything through the API that I can do in the UIweight 2

2 (weight) × 7 (quality) × 0.6 (partial) = 8.4 of 20 max

• [claimed-docs] https://supabase.com“Instant ready-to-use REST APIs.”
• [github] https://github.com/supabase/supabase“Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
• [probe] https://supabase.com/openapi.json“PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [community] https://news.ycombinator.com/item?id=36004925“I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limitations also had me going back to an API server architecture.”
• [community] https://news.ycombinator.com/item?id=36004925“The Supabase CLI is updated every single time I run `brew upgrade`. It makes me feel like I'm trying to swing a bat around, except it's made of water.”

Export all of my data in open formats and leaveweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed services, or want to run Supabase in an isolated environment.”
• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
• [github] https://github.com/supabase/supabase“We're building the features of Firebase using enterprise-grade open source tools.”
• [community] https://news.ycombinator.com/item?id=40083807“How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are doing that.”

Read the product's source under an open licenseweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

• [github] https://github.com/supabase/supabase“We're building the features of Firebase using enterprise-grade open source tools.”
• [github] https://github.com/supabase/supabase“Our aim is to give developers a Firebase-like developer experience using open source tools.”
• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed services, or want to run Supabase in an isolated environment.”
• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements...”

Self-host the core productweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed services, or want to run Supabase in an isolated environment.”
• [claimed-docs] https://supabase.com/docs/guides/self-hosting“Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
• [claimed-docs] https://supabase.com/docs/guides/local-development/cli/getting-started“The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
• [probe] https://supabase.com/docs/guides/local-development/cli/getting-started“PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a local project entirely from a script (hands-on)”
• [community] https://news.ycombinator.com/item?id=40083807“How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are doing that.”

Get AI-generated insights and suggestions from my data inside the productweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/ai-tools/mcp“Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
• [claimed-docs] https://supabase.com/docs/guides/ai“Supabase provides an open source toolkit for developing AI applications using Postgres and pgvector.”
• [probe] https://supabase.com/docs/guides/ai-tools/mcp“official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
• [probe] https://mcp.supabase.com/mcp“PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server, auth-gated (hands-on, keyless)”

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Operate the product with natural-language commandsweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

• [claimed-docs] https://supabase.com/docs/guides/ai-tools/mcp“Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
• [claimed-docs] https://supabase.com/docs/guides/ai-tools/mcp“your AI assistants can interact with and query your Supabase projects on your behalf.”
• [probe] https://supabase.com/docs/guides/ai-tools/mcp“official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
• [probe] https://mcp.supabase.com/mcp“PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server, auth-gated (hands-on, keyless)”
• [community] https://news.ycombinator.com/item?id=44502318“Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses with prompting that discourages following injected instructions, and E2E tests... this significantly lowered the chances of LLMs falling for attacks.'”
• [community] https://news.ycombinator.com/item?id=44502318“The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) protections. This is too bad.”

Perform bulk operations across many items at onceweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 4 (quality) × 0.6 (partial) = 7.2 of 30 max

• [claimed-docs] https://supabase.com/docs/guides/realtime“Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Listen to database changes in real-time.”
• [claimed-docs] https://supabase.com/docs/guides/functions“Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
• [claimed-docs] https://supabase.com/docs/guides/realtime“Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and custom notifications.”
• [claimed-docs] https://supabase.com/docs/guides/realtime“Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”

Schedule recurring jobs or workflowsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

1 (weight) × 3 (quality) × 0.6 (partial) = 1.8 of 10 max

• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting your production setup.”
• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting your production setup.”
• [claimed-docs] https://supabase.com/docs/guides/deployment/branching“Supabase branches create separate environments that spin off from your main project.”