Supabase vs Firebase

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   A hands-on probe confirms Supabase serves a valid llms.txt at the root domain (HTTP 200) pointing to full documentation, and Supabase's own docs also document agent-oriented integration paths like MCP and CLI that an agent could follow. Missing for 10: independent/community corroboration of agents actually consuming llms.txt in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://supabase.com/llms.txt # Supabase Docs For the complete documentation in a single file, see [Full Docume…”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”

   proof ↗⚑ flag

   Firebase—none0/10

   A direct probe shows firebase.google.com/llms.txt returns 404, and no evidence pack item shows any agent-oriented docs bundle or llms.txt equivalent; the MCP server (firebase-docs-12) is a separate tool-integration axis, not an agent-readable docs file.

   • [probe] “PROBE llms.txt: HTTP 404 at https://firebase.google.com/llms.txt”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase's official CLI explicitly documents running the entire stack locally or in CI (supabase-docs-21), and hands-on probes confirm the CLI installs and runs headlessly via npx and can scaffold a project with no login/keys (supabase-probe-6, supabase-probe-8), which is exactly the CI/automation use case. Missing for 10: no explicit first-party CI pipeline example (e.g., GitHub Actions workflow) or independent third-party CI report beyond the probe evidence.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”

   proof ↗⚑ flag

   Firebase~partialprobed6/10

   Firebase ships a scriptable CLI (firebase-tools) that can deploy code, manage hosting, import/export auth data, and run a Local Emulator Suite for offline integration testing/QA and mocha-based unit tests — all of which are usable in a headless/CI context (firebase-docs-8, firebase-docs-9, firebase-docs-24, firebase-docs-31, firebase-gh-1/2/3). However, there is no explicit CI/CD pipeline documentation (e.g., GitHub Actions integration, service-account auth for non-interactive CLI use) or independent confirmation of CI usage. Missing for 10: explicit CI/CD integration docs (e.g., GitHub Actions workflow), non-interactive auth guidance for automated environments, and independent/hands-on evidence of running the emulator suite or CLI in a CI pipeline.

   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “This means you can connect your app directly to these emulators to perform integration testing or QA without touching production data.”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [claimed-docs] “Unit Tests: using the Firebase Test SDK, you can write unit tests in Node.js using the mocha test runner.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site”
   • [github] “Import/Export users into/from Firebase Auth”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   Supabase✓fullprobed9/10

   Supabase documents and ships an official MCP server (mcp.supabase.com) that lets AI assistants query/interact with Supabase projects, and a live hands-on probe confirms the remote MCP endpoint is reachable and auth-gated as expected. Community discussion also confirms real-world usage (e.g., Cursor assistant connecting via MCP) alongside security mitigations for prompt injection risks. Missing for 10: independent end-to-end hands-on demonstration of a successful authenticated agent session beyond the 401 handshake check.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Firebase✓fullprobed9/10

   Firebase ships an official documented MCP server that works with any MCP client tool (Antigravity, Claude Code/Desktop, Cline, Cursor, VS Code Copilot, Windsurf, etc.), enabling agents to manage Firebase projects, Auth, Firestore, and more. This is corroborated by both docs and a dedicated probe confirming the official page. Missing for 10: independent hands-on community report validating the MCP server's real-world reliability.

   • [claimed-docs] “The Firebase MCP server works with any tool that can act as an MCP client, including: Antigravity, Claude Code and Claude Desktop, Cline, Cu…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase ships an official CLI with clear docs and hands-on verification: `npx supabase --version` runs headlessly and `supabase init` scaffolds a project without login or keys, making it directly usable by AI agents/scripts. Missing for 10: no explicit agent-oriented CLI subcommands or independent third-party report of an AI agent driving the CLI end-to-end.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. supabase init to create a new local project 2. supabase start to launch …”

   proof ↗⚑ flag

   Firebase✓fullprobed8/10

   Firebase ships an official CLI (firebase-tools) documented both in GitHub and Firebase docs, covering deploy, hosting, auth, and Firestore data management, and is corroborated by a dedicated CLI docs page (firebase-probe-4). This CLI is the standard tool for automating Firebase workflows, which AI-native/agentic users would drive programmatically or via the complementary MCP server for AI agents. missing for 10: explicit documentation of AI-native features built into the CLI itself (e.g., natural-language command generation) beyond its use as an MCP-server backend.

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site”
   • [github] “Import/Export users into/from Firebase Auth”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”
   • [claimed-docs] “The Firebase MCP server works with any tool that can act as an MCP client, including: Antigravity, Claude Code and Claude Desktop, Cline, Cu…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round drawn
   Supabase✓fullprobed8/10

   Supabase auto-generates REST and GraphQL APIs from the database schema and a live probe confirms a real spec-compliant OpenAPI document at supabase.com/openapi.json, giving AI agents a documented machine-readable API surface. This is reinforced by CLI and MCP tooling that lets an agent programmatically provision and query projects headlessly. Missing for 10: independent third-party validation of API completeness/stability, and explicit versioning/rate-limit docs for programmatic API consumers.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”

   proof ↗⚑ flag

   Firebase✓fullprobed8/10

   Firebase exposes a well-documented public surface for programmatic/agentic use: the official CLI (firebase-tools) for deploying, managing data, and auth; Admin/REST SDKs for Firestore, Auth, and Functions; and a dedicated first-party MCP server that lets AI agents (Claude, Cursor, VS Code Copilot, etc.) manage Firebase projects, auth, and Firestore data directly. missing for 10: a discoverable machine-readable spec (openapi.json/llms.txt both 404), and independent hands-on confirmation of the MCP server working reliably in production agent workflows

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [claimed-docs] “The Firebase MCP server works with any tool that can act as an MCP client, including: Antigravity, Claude Code and Claude Desktop, Cline, Cu…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Supabase
   Supabase!disputedcontradicted4/10

   Supabase offers RLS-based fine-grained authorization and says it encourages read-only access by default for its MCP integration (mitigating agent access scope), but a concrete hands-on community report shows the Cursor/Supabase MCP integration actually running with elevated service_role access that bypasses RLS entirely — the opposite of least-privilege scoping. This is a direct, concrete contradiction rather than general skepticism. Missing for 10: documented ability to mint scoped/least-privilege API keys or tokens specifically for agent use, and confirmation that MCP connections default to restricted roles rather than service_role.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”

   proof ↗⚑ flag

   Firebase—none0/10

   Firebase has Security Rules and Identity Platform for general access control, but no evidence describes issuing scoped or least-privilege API credentials specifically for an AI agent (e.g., a restricted service-account/API-key flow tied to MCP or agent use). The MCP server docs only describe what an agent-connected editor can do, not how to scope its permissions. missing for 10: documentation of agent-specific scoped credentials/service accounts, least-privilege API key issuance workflow, any first-party or community confirmation of this capability.

   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [claimed-docs] “Firebase Security Rules leverage extensible, flexible configuration languages to define what data your users can access for Realtime Databas…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Firebase
   Supabase~partialprobed6/10

   Supabase provides auto-generated REST/GraphQL APIs, TypeScript type generation, and quickstart docs for connecting projects, which support building against official client libraries, and its CLI/MCP tooling make it usable by AI agents. However, the evidence pack never explicitly documents a suite of official SDKs (e.g., JS, Python, Flutter) or their API surfaces beyond generated types. Missing for 10: explicit official SDK/client-library documentation across languages, code samples showing SDK usage, and independent confirmation that AI agents build reliably against these SDKs.

   • [claimed-docs] “Generate types for your project to produce the `database.types.ts` file”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”

   proof ↗⚑ flag

   Firebase✓fullprobed8/10

   Firebase provides official SDKs across Firestore, Auth, Functions, Storage, and Rules, well documented with first-party docs and CLI (firebase-tools), plus emulator suite for local dev and testing. Community evidence corroborates real-world usage of these SDKs for building apps. missing for 10: independent hands-on validation specifically of SDK quality/versioning for AI-native workflows, and no explicit llms.txt/openapi spec found (probe results show 404s) which would strengthen AI-native discoverability.

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “FirebaseUI provides a drop-in auth solution that handles the UI flows for signing in users with email addresses and passwords, phone numbers…”
   • [claimed-docs] “The Firebase Authentication SDK provides methods that allow users to sign in with their Google, Facebook, Twitter, and GitHub accounts.”
   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”
   • [community] “I'm a big fan of firebase and use it whenever I can. The reason it's appealing is the suite of tools and how well they work together for boo…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Supabase—none0/10

   The evidence describes Supabase Realtime (Broadcast, Presence, Postgres Changes via websockets) but never mentions a webhooks feature for subscribing to events over HTTP callbacks, which is what the story asks for; missing for 10: any documentation of Database Webhooks or HTTP callback subscription mechanism.

   ⚑ flag

   Firebase—none0/10

   Firebase evidence shows event-driven Cloud Functions triggers and real-time listeners (Firestore/RTDB), but no documented webhook subscription mechanism for external endpoints to receive events; no first-party or community evidence of a webhooks feature.

   ⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round to Firebase
   Supabase~partialprobed5/10

   Supabase enables AI assistants (via MCP) to query and interact with a user's Supabase data, and provides a pgvector-based AI toolkit for building AI features into apps, but there is no evidence of a first-party in-dashboard 'insights and suggestions' feature that surfaces AI-generated analysis directly inside Supabase Studio. The MCP-based approach requires connecting an external AI assistant rather than the product itself generating insights natively. missing for 10: evidence of a built-in Studio AI insights/suggestions feature, evidence of automatic proactive suggestions (vs. user-initiated querying via external assistant), independent hands-on validation of insight quality.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “Supabase provides an open source toolkit for developing AI applications using Postgres and pgvector.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”

   proof ↗⚑ flag

   Firebase~partialclaimed6/10

   Firebase documents Gemini in Firebase providing AI-generated insights and suggestions from app data — e.g., actionable crash root-cause analysis and fix suggestions (Crashlytics) and summarization/recommendations for messaging campaign performance — directly matching the story's intent. However, this is scoped to specific data types (crash reports, messaging analytics) rather than general insights across all stored data (e.g., Firestore documents), and no independent/hands-on evidence corroborates the quality of these AI suggestions. Missing for 10: broader data-insight coverage (e.g., Firestore/database content analysis), independent user validation of insight quality.

   • [claimed-docs] “AI assistance provides actionable insights into your app's crashes, including a full description of the issue, information about possible ro…”
   • [claimed-docs] “Gemini in Firebase can summarize and analyze your messaging campaigns, providing actionable recommendations to improve performance.”
   • [claimed-docs] “If you use Crashlytics and enable Gemini in Firebase, you can get AI assistance for debugging and troubleshooting issues in your Apple and A…”
   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”

   proof ↗⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Firebase
   Supabase—none0/10

   The evidence pack covers Edge Functions, Realtime, RLS, and MCP/CLI tooling, but contains no mention of scheduled jobs, cron triggers, database webhooks, or any mechanism for autonomous background automations that an AI-native user could set up and let run unattended. As a backend platform, this axis is plausible for Supabase, but no supporting evidence exists in the pack.

   ⚑ flag

   Firebase✓fullclaimed8/10

   Firebase Cloud Functions explicitly support autonomous, event-driven background execution, including triggers from Firebase/Cloud events, HTTPS requests, and Cloud Scheduler jobs, letting users run scheduled or event-triggered automations without manual intervention. Docs also show one-command deployment and auto-scaling for these functions. Missing for 10: independent/hands-on corroboration of scheduler reliability and any dispute resolution for the older community complaint about lacking scheduled tasks (which predates Cloud Scheduler support).

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “The functions you write can respond to events generated by various Firebase and Google Cloud features, from Firebase Authentication triggers…”

   proof ↗⚑ flag

3. ai-native userDelegate tasks to a built-in AI assistant inside the product

   weight 3 · round to Firebase
   Supabase—none0/10

   All evidence describes Supabase's MCP server, which lets *external* AI assistants (Cursor, Claude, etc.) connect to and query a Supabase project — this is the client-connectivity story, not a built-in assistant living inside Supabase's own product/dashboard. No evidence pack item describes a first-party in-product AI assistant that users delegate tasks to within Supabase itself.

   ⚑ flag

   Firebase✓fullclaimed8/10

   Firebase ships Gemini in Firebase, a built-in natural-language AI assistant embedded in the console that answers product questions, generates code, and provides crash/debugging insights and messaging analytics — directly fulfilling task delegation to a built-in AI assistant. missing for 10: independent/hands-on verification of Gemini in Firebase's task-execution quality beyond first-party docs, and clearer detail on the scope of tasks it can autonomously complete versus just advise on.

   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”
   • [claimed-docs] “AI assistance provides actionable insights into your app's crashes, including a full description of the issue, information about possible ro…”
   • [claimed-docs] “Gemini in Firebase can summarize and analyze your messaging campaigns, providing actionable recommendations to improve performance.”
   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”
   • [claimed-docs] “If you use Crashlytics and enable Gemini in Firebase, you can get AI assistance for debugging and troubleshooting issues in your Apple and A…”

   proof ↗⚑ flag

4. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   Supabase✓fullprobed8/10

   Supabase ships an official, documented MCP server enabling AI assistants to query and operate projects via natural language, corroborated by a live hands-on handshake against the production MCP endpoint and documented prompt-injection mitigations from a Supabase engineer. Missing for 10: independent quality benchmarking of the NL interface itself and full resolution of security concerns (e.g., service_role bypassing RLS in some client configs).

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Firebase✓fullprobed8/10

   Firebase documents both a natural-language chat interface (Gemini in Firebase) for getting answers, generating code, and troubleshooting, and an official MCP server that lets AI editors/agents create and manage Firebase projects, Auth users, and Firestore data via natural-language commands routed through MCP clients like Claude Code, Cursor, VS Code Copilot, etc. Missing for 10: independent/hands-on validation that MCP-driven natural-language operations reliably perform complex actions, and confirmation Gemini in Firebase supports action-taking beyond Q&A/insights.

   • [claimed-docs] “The Firebase MCP server works with any tool that can act as an MCP client, including: Antigravity, Claude Code and Claude Desktop, Cline, Cu…”
   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Supabase
   Supabase~partialprobed4/10

   Evidence shows Supabase auto-generates REST/GraphQL APIs and exposes a public OpenAPI spec (openapi.json), implying some form of API reference exists, but there is no direct evidence of an interactive reference page with runnable/executable code examples for AI-native exploration. Missing for 10: explicit documentation or screenshot of an interactive API docs page, evidence of runnable/testable examples in the browser, and any AI-specific tooling around that reference beyond the generic OpenAPI file.

   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Instant ready-to-use **REST APIs**.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Firebase—none0/10

   No evidence of an interactive API reference with runnable examples; probes confirm llms.txt and openapi endpoints return 404, and docs pack contains no mention of a live/interactive reference or embedded runnable code samples.

   • [probe] “PROBE llms.txt: HTTP 404 at https://firebase.google.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://firebase.google.com/openapi.json, https://firebase.google.com/swagger.json, https://firebase…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Supabase
   Supabase✓fullprobed9/10

   Probe evidence confirms a live, machine-readable OpenAPI spec at supabase.com/openapi.json returning a valid 'openapi' key, plus a documented REST API auto-generated from the database and generated TypeScript types. Missing for 10: no independent third-party confirmation of spec completeness or versioning stability.

   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Firebase—none0/10

   Probes for llms.txt and common OpenAPI/swagger spec paths all returned 404, and no documentation in the evidence pack references a downloadable OpenAPI/Swagger spec for Firebase APIs.

   • [probe] “PROBE llms.txt: HTTP 404 at https://firebase.google.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://firebase.google.com/openapi.json, https://firebase.google.com/swagger.json, https://firebase…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round drawn
   Supabase✓fullprobed8/10

   Supabase offers both local development (via CLI 'supabase init/start', hands-on verified) and branching environments explicitly designed to test schema/config/feature changes without affecting production, directly matching the sandbox-without-touching-production story. Community evidence corroborates real usage of local dev/migrations, though some report local dev as a weak point (comm-7, comm-8). Missing for 10: independent hands-on confirmation of branching workflow specifically, and no direct evidence addressing data-seeding/isolation guarantees in the sandbox beyond docs claims.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”

   proof ↗⚑ flag

   Firebase✓fullclaimed8/10

   Firebase's Local Emulator Suite explicitly lets developers connect apps to emulators for integration testing or QA 'without touching production data,' covering Firestore, Auth, Functions, Storage, Hosting, and more, with unit test support via mocha. missing for 10: independent/hands-on corroboration of emulator fidelity and AI-native/agent-specific usage examples beyond generic dev testing.

   • [claimed-docs] “This means you can connect your app directly to these emulators to perform integration testing or QA without touching production data.”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [claimed-docs] “Unit Tests: using the Firebase Test SDK, you can write unit tests in Node.js using the mocha test runner.”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack has no mention of API versioning schemes or a documented deprecation policy for Supabase's REST/GraphQL/Auth/Storage APIs; there's an OpenAPI spec probe but nothing about version lifecycle or deprecation commitments. This is a fair axis for a backend platform with public APIs, so absence of evidence yields 'none'.

   ⚑ flag

   Firebase—none0/10

   No evidence pack item documents API versioning schemes or a deprecation policy for Firebase's APIs/SDKs; probes for openapi.json/llms.txt both 404, and no docs reference version support windows or deprecation timelines.

   • [probe] “PROBE llms.txt: HTTP 404 at https://firebase.google.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://firebase.google.com/openapi.json, https://firebase.google.com/swagger.json, https://firebase…”

   proof ↗⚑ flag

Ai assist

1. ai-native userAsk an AI assistant in the dashboard to write queries, debug errors, and explain my backend

   weight 2 · round to Firebase
   Supabase~partialprobed5/10

   Evidence shows Supabase's MCP integration lets external AI assistants (e.g., Cursor) query and operate on Supabase projects, and community reports confirm real-world use of an AI assistant against the database (with RLS-bypass caveats). However, none of the evidence specifically documents a native AI assistant embedded inside the Supabase dashboard UI itself, nor its ability to explicitly debug errors or explain the backend within that context — the evidence centers on MCP-based external tool connections, not an in-dashboard chat assistant. Missing for 10: dedicated dashboard-embedded assistant UI documentation, explicit debug/explain feature descriptions, and independent hands-on confirmation of dashboard-based query writing.

   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [community] “Supabase engineer: 'A few weeks ago we added mitigations to help with prompt injections - encourage read-only by default, wrap SQL responses…”

   proof ↗⚑ flag

   Firebase✓fullclaimed8/10

   Firebase ships Gemini in Firebase, a natural-language chat interface in the dashboard that answers product questions, generates code, and provides AI-driven crash/debugging insights, directly matching the story of asking an AI assistant to write queries, debug, and explain the backend. missing for 10: independent hands-on user reports validating query-writing/debugging accuracy in Gemini in Firebase specifically (only vendor docs cited).

   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”
   • [claimed-docs] “AI assistance provides actionable insights into your app's crashes, including a full description of the issue, information about possible ro…”
   • [claimed-docs] “Get instant answers to questions about Firebase products and features, generate code for faster development, and shorten your troubleshootin…”
   • [claimed-docs] “If you use Crashlytics and enable Gemini in Firebase, you can get AI assistance for debugging and troubleshooting issues in your Apple and A…”

   proof ↗⚑ flag

Vector

1. developerStore embeddings and run vector similarity search for AI features

   weight 3 · round drawn
   Supabase✓fullclaimed8/10

   Supabase explicitly ships pgvector-based AI toolkit and lists 'Vector embeddings' as a core product feature alongside its Postgres stack, directly enabling embedding storage and similarity search. missing for 10: no hands-on probe demonstrating actual vector search query execution, and no independent/community corroboration of vector search performance or usage.

   • [claimed-docs] “Supabase provides an open source toolkit for developing AI applications using Postgres and pgvector.”
   • [claimed-docs] “Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [claimed-docs] “Start your project with a Postgres database. Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”

   proof ↗⚑ flag

   Firebase✓fullclaimed8/10

   Firebase documents dedicated Cloud Firestore vector search functionality with KNN vector search, including storing vector values and creating/managing KNN vector indexes, directly matching the story. Missing for 10: independent/hands-on developer corroboration of vector search in production and details on scale/performance limits.

   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches”
   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches using the following techniques”
   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches using the following techniques: Store vec…”

   proof ↗⚑ flag

Authentication

1. developerAdd email/password and social OAuth sign-in with the platform SDK in minutes

   weight 3 · round drawn
   Supabase✓fullcommunity8/10

   Supabase Auth docs explicitly list password, magic link, OTP, social login, and SSO as supported methods, and community evidence confirms real developers implementing RLS + OAuth providers in production apps, indicating SDK-based setup works in practice. Missing for 10: no direct evidence of the specific SDK code snippets/quickstart timing claim ('minutes') or independent hands-on verification of OAuth setup speed.

   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”

   proof ↗⚑ flag

   Firebase✓fullcommunity8/10

   Firebase Authentication SDK explicitly supports email/password plus Google, Facebook, Twitter, and GitHub OAuth sign-in, and FirebaseUI offers a drop-in solution handling these sign-in flows out of the box, matching the 'minutes' setup claim; community feedback also corroborates Firebase's ease of bootstrapping auth alongside other services. missing for 10: independent hands-on account of specifically timing/adding OAuth sign-in setup, and no mention of other providers like Apple/Microsoft.

   • [claimed-docs] “FirebaseUI provides a drop-in auth solution that handles the UI flows for signing in users with email addresses and passwords, phone numbers…”
   • [claimed-docs] “The Firebase Authentication SDK provides methods that allow users to sign in with their Google, Facebook, Twitter, and GitHub accounts.”
   • [claimed-docs] “FirebaseUI provides a drop-in auth solution that handles the UI flows for signing in users with email addresses and passwords, phone numbers…”
   • [community] “I'm a big fan of firebase and use it whenever I can. The reason it's appealing is the suite of tools and how well they work together for boo…”
   • [community] “One of the things I find quite nice about firebase is the powerful separation between data retrieval/update logic and the enforcement of acc…”

   proof ↗⚑ flag

2. platform-engineerRequire MFA and enterprise SSO (SAML/OIDC) for my application users

   weight 2 · round to Firebase
   Supabase~partialclaimed3/10

   Docs mention SSO as one of many supported auth methods, implying enterprise SSO (SAML/OIDC) support, but there is no evidence of MFA enforcement mechanisms or platform-level policy to require MFA/SSO for application users. missing for 10: explicit MFA requirement/enforcement docs, OIDC/SAML configuration details, admin controls to mandate SSO for all users, independent corroboration.

   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”

   proof ↗⚑ flag

   Firebase~partialclaimed6/10

   Firebase's own docs state that native Firebase Authentication does not include MFA or enterprise SSO by default — these require upgrading to 'Firebase Authentication with Identity Platform,' which unlocks multi-factor authentication, SAML and generic OpenID Connect support, and enterprise-level support (firebase-docs-28). This confirms the capability exists but only via a paid upgrade path, not as a standard included feature — a significant caveat for a platform engineer evaluating baseline auth. Missing for 10: first-party documentation detailing MFA/SSO configuration steps, enforcement policies, and independent/hands-on validation of enterprise SSO setup.

   • [claimed-docs] “When you upgrade to Firebase Authentication with Identity Platform, you unlock additional features, such as multi-factor authentication, blo…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Firebase
   Supabase—none0/10

   The evidence pack documents Supabase's REST API generation, RLS, realtime, storage, and CLI/MCP tooling, but nothing explicitly addresses bulk/batch operations (e.g., batch insert/update/delete across many rows or items) via the API, CLI, or MCP server. Postgres and PostgREST can technically support bulk SQL operations, but this capability is never documented or demonstrated in the evidence provided.

   ⚑ flag

   Firebase~partialcommunity5/10

   Firebase provides some bulk-oriented capabilities—bulk import/export of Auth users via the CLI (firebase-gh-1, firebase-gh-3), multi-filter/sort queries in Firestore (firebase-docs-2), and MongoDB-compatible API access that could support bulk driver operations (firebase-docs-4/16/27)—but there's no direct documentation of a native batch-write/bulk-update API for arbitrary large-scale item operations, and community feedback notes limitations like lacking count queries without full downloads (firebase-comm-16). missing for 10: explicit batch-write/bulk-update API documentation, evidence of scale/performance for bulk operations, and independent hands-on confirmation of bulk data manipulation beyond auth import/export.

   • [claimed-docs] “Your queries can include multiple, chained filters and combine filtering and sorting.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Import/Export users into/from Firebase Auth”
   • [claimed-docs] “Cloud Firestore offers a MongoDB-compatible API. You can use existing MongoDB application code, drivers, tools, and the open-source ecosyste…”
   • [community] “When will it support a count query? Now to be able to count number of children I have to download all the data. Count is such an important f…”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Firebase
   Supabase~partialclaimed4/10

   Supabase's Realtime feature lets clients listen to Postgres changes and Edge Functions can act as serverless handlers, which together could be combined to react to database events, but the evidence pack contains no explicit rule-engine, database triggers/webhooks, or automation configuration UI for defining 'if event X then action Y' rules as an AI-native user would expect. missing for 10: explicit database triggers/webhooks documentation, a rules/automation configuration interface, and evidence of AI-native automatic action execution tied to events.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”

   proof ↗⚑ flag

   Firebase✓fullclaimed8/10

   Firebase's Cloud Functions is explicitly a serverless event-trigger system: it runs backend code automatically in response to background events, HTTPS requests, Admin SDK, Auth triggers, Storage triggers, or Cloud Scheduler jobs, directly matching the 'rules that trigger actions on events' story. This is well documented across multiple first-party pages with concrete trigger types listed. Missing for 10: independent/hands-on corroboration of trigger reliability at scale, and clarification of any AI-native-specific tooling for defining these rules beyond standard docs.

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “The functions you write can respond to events generated by various Firebase and Google Cloud features, from Firebase Authentication triggers…”
   • [claimed-docs] “Cloud Functions now has experimental support for Dart. Flutter developers can now write both their frontend and backend in a single language…”
   • [claimed-docs] “Experimental: Cloud Functions now has experimental support for Dart. Flutter developers can now write both their frontend and backend in a s…”

   proof ↗⚑ flag

3. ai-native userSchedule recurring jobs or workflows

   weight 2 · round to Firebase
   Supabase—none0/10

   The evidence pack covers Supabase's database, auth, storage, realtime, edge functions, CLI, and MCP integration, but contains no mention of a scheduling feature (e.g., pg_cron, scheduled Edge Functions, or workflow orchestration) for recurring jobs. No documentation, community report, or probe references any cron-like or recurring-job capability.

   ⚑ flag

   Firebase~partialcommunity6/10

   Firebase docs confirm Cloud Functions can be triggered by Cloud Scheduler jobs, enabling recurring/scheduled workflows (firebase-docs-7, firebase-docs-29), but this relies on the external Cloud Scheduler service rather than a native, first-class 'scheduled job' primitive within Firebase itself, and there is only one high-level doc mention with no setup detail or independent validation of current experience. An older community comment even flagged the historical absence of scheduled-task support as a pain point, suggesting this capability was a later addition rather than a mature core feature. missing for 10: dedicated documentation/tutorial on defining a scheduled function end-to-end, independent/hands-on confirmation that scheduling works reliably today, and any AI-native/agent-specific workflow scheduling support.

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “The functions you write can respond to events generated by various Firebase and Google Cloud features, from Firebase Authentication triggers…”
   • [community] “I have built apps with firebase in the past and the feature I missed the most was performing scheduled tasks on the database... AWS Lambda w…”

   proof ↗⚑ flag

4. ai-native userVersion, review, and roll back my automations

   weight 1 · round to Supabase
   Supabase~partialclaimed3/10

   Supabase's branching feature lets users create separate environments to test schema/config/feature changes without affecting production, which is a git-like versioning mechanism, but this applies to database schema/config rather than 'automations' specifically, and there is no explicit rollback or review (PR-style) workflow documented for Edge Functions, triggers, or other automation-like constructs. Missing for 10: explicit automation objects (workflows/triggers/functions) with versioning, diff/review, and one-click rollback; independent/hands-on confirmation of rollback working.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”

   proof ↗⚑ flag

   Firebase—none0/10

   Firebase's evidence describes Cloud Functions, Security Rules, and CLI deployment, but nothing documents version history, review workflows, or rollback specifically for these 'automations' (functions/rules/triggers). Missing for 10: documented versioning/rollback of Cloud Functions or Security Rules, review/approval workflow, and any audit trail for automation changes.

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”

   proof ↗⚑ flag

Database

1. developerConnect to the underlying database with standard clients and ORMs via a connection string

   weight 2 · round to Supabase
   Supabase~partialcommunity5/10

   Supabase is built on Postgres and its docs confirm full self-hosting/local Postgres access and RLS-based auth (implying a standard Postgres connection string is available), but no evidence pack item explicitly documents the connection string format, ORM compatibility (e.g., Prisma, Drizzle), or connection pooling (pgbouncer/Supavisor) setup that developers typically need for direct client/ORM access. missing for 10: explicit docs on connection string/pooling, ORM-specific integration guides (Prisma/Drizzle/TypeORM), and independent hands-on confirmation of connecting via standard Postgres clients.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”

   proof ↗⚑ flag

   Firebase~partialclaimed4/10

   Firebase's Firestore Enterprise edition offers a MongoDB-compatible API, letting developers reuse existing MongoDB drivers/tools/ORM ecosystem, which partially satisfies 'standard clients and ORMs' — but this applies only to the Enterprise edition, not the default Firestore or Realtime Database, and no connection-string mechanism is documented anywhere in the evidence pack. Missing for 10: explicit connection-string documentation, ORM support for the standard (non-Enterprise) Firestore/Realtime DB products, and independent/hands-on confirmation that MongoDB drivers actually connect successfully.

   • [claimed-docs] “Cloud Firestore offers a MongoDB-compatible API. You can use existing MongoDB application code, drivers, tools, and the open-source ecosyste…”
   • [claimed-docs] “You can use existing MongoDB application code, drivers, tools, and the open-source ecosystem of MongoDB integrations with Cloud Firestore in…”
   • [claimed-docs] “Cloud Firestore offers a MongoDB-compatible API. You can use existing MongoDB application code, drivers, tools, and the open-source ecosyste…”

   proof ↗⚑ flag

2. developerProvision a managed database and read/write it from client and server SDKs

   weight 3 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase provisions a managed Postgres database with instant REST/GraphQL APIs, auto-generated type-safe client SDKs, and server-side access via CLI/self-hosting, backed by docs, GitHub feature list, and hands-on probes confirming CLI/local provisioning works. Community evidence corroborates real-world usage building backends with RLS-secured reads/writes from clients (SvelteKit) and servers. Missing for 10: independent benchmark of production-scale read/write reliability and a fully hands-on client-SDK read/write test beyond CLI provisioning.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [claimed-docs] “Instant ready-to-use **REST APIs**.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [claimed-docs] “Start with a quickstart guide to connect your project in minutes.”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”
   • [community] “Supabase is great and I've used it for a number of projects over the years... they are by far the cheapest hosted SQL offering I can find so…”

   proof ↗⚑ flag

   Firebase✓fullcommunity8/10

   Firebase offers managed NoSQL databases (Cloud Firestore, Realtime Database) with official client SDKs for web/mobile and Admin SDK for server-side access, backed by docs on data sync, offline caching, and security rules, plus CLI/GitHub tooling for data interaction; community hands-on reports confirm fast, real-time read/write from clients and servers. Missing for 10: independent benchmark on server SDK write/read latency, and community notes cite real limitations (query features, count queries, historical offline-persistence gaps) that keep it from a perfect score.

   • [claimed-docs] “Store and sync app data at global scale without managing servers.”
   • [claimed-docs] “Your queries can include multiple, chained filters and combine filtering and sorting.”
   • [claimed-docs] “Cloud Firestore caches data that your app is actively using, so the app can write, read, listen to, and query data even if the device is off…”
   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [claimed-docs] “Firebase Security Rules leverage extensible, flexible configuration languages to define what data your users can access for Realtime Databas…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [community] “We were one of the first hundred users to join Firebase (ID:68) and I remember how easy it was to add real time notifications to one of my p…”
   • [community] “We used the original Firebase database product to build socrates.io 3.5 years ago, and I remember getting it running in a few hours.”
   • [community] “I've had only good experiences with firebase. They added an HTTP api, web hosting, multiple security rule preprocessors (pain point), and go…”
   • [community] “How do the querying features compare to Firebase? Firebase is notorious for having an unintuitive lack of server-side query options when you…”
   • [community] “When will it support a count query? Now to be able to count number of children I have to download all the data. Count is such an important f…”
   • [community] “So, still no offline persistence for JS. What a huge disappointment.”

   proof ↗⚑ flag

3. developerExpress relational queries with joins, constraints, and transactions

   weight 2 · round to Supabase
   Supabase~partialcommunity6/10

   Supabase is built on Postgres, so full SQL relational capabilities (joins, constraints, transactions) are inherently available via direct Postgres connections, and evidence shows RLS policies and schema/migration support. However, the evidence pack focuses mainly on REST/PostgREST APIs, RLS, and CLI/branching rather than explicitly documenting joins, transactions, or foreign-key constraints, and community reports note PostgREST limitations pushing developers back to custom API servers. Missing for 10: explicit docs on PostgREST/join query syntax across relations, transaction support via API/client libraries, constraint definition examples, and independent confirmation these work smoothly at scale.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [claimed-docs] “Instant ready-to-use REST APIs.”

   proof ↗⚑ flag

   Firebase—none0/10

   Firebase's Firestore/Realtime Database are NoSQL document stores; evidence shows only chained filter/sort queries (firebase-docs-2) and a MongoDB-compatible API option (firebase-docs-4), with no mention of relational joins or multi-document transactions, and community evidence explicitly calls out the lack of server-side query capability (firebase-comm-4) and missing features like count queries (firebase-comm-16). No documentation of join support or transaction semantics appears in the pack.

   • [claimed-docs] “Your queries can include multiple, chained filters and combine filtering and sorting.”
   • [claimed-docs] “Cloud Firestore offers a MongoDB-compatible API. You can use existing MongoDB application code, drivers, tools, and the open-source ecosyste…”
   • [community] “How do the querying features compare to Firebase? Firebase is notorious for having an unintuitive lack of server-side query options when you…”
   • [community] “When will it support a count query? Now to be able to count number of children I have to download all the data. Count is such an important f…”

   proof ↗⚑ flag

Realtime

1. developerBuild offline-capable clients whose local writes sync automatically on reconnect

   weight 2 · round to Firebase
   Supabase—none0/10

   The evidence pack covers Supabase's Realtime (Broadcast, Presence, Postgres Changes), Auth, Storage, and local dev CLI, but nothing addresses offline-first client SDKs, local write queuing, conflict resolution, or automatic sync-on-reconnect. Community threads even flag local development and migrations as weak points, with no mention of offline capability.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “Even though it looks like a great product initially, it has a lot of errors and bugs when you are trying to actually build something more ro…”

   proof ↗⚑ flag

   Firebase✓fullcommunity7/10

   Firestore docs explicitly describe local caching and offline write/read/sync capability that reconciles when connectivity returns, directly matching the story (firebase-docs-3). Confidence is tempered by an older community report claiming lack of JS offline persistence and by the absence of independent, recent hands-on corroboration of sync behavior. missing for 10: independent/hands-on confirmation of reconnect-sync behavior, and clarification on which SDKs currently support offline persistence.

   • [claimed-docs] “Cloud Firestore caches data that your app is actively using, so the app can write, read, listen to, and query data even if the device is off…”
   • [community] “So, still no offline persistence for JS. What a huge disappointment.”

   proof ↗⚑ flag

2. developerTrack user presence and broadcast ephemeral state between connected clients

   weight 1 · round to Supabase
   Supabase✓fullcommunity9/10

   Supabase Realtime explicitly documents Presence for tracking/synchronizing user state ('who's online') and Broadcast for sending low-latency ephemeral messages between clients, and a launch community post confirms real-world usage at scale (~2000 concurrent users). Missing for 10: independent hands-on verification of presence/broadcast APIs beyond docs and one launch anecdote.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [claimed-docs] “Chat applications - Real-time messaging with typing indicators and online presence”
   • [community] “Supabase CEO on Realtime Multiplayer launch: added Broadcast (ephemeral messages) and Presence (eventually-consistent state) to the Realtime…”

   proof ↗⚑ flag

   Firebase~partialcommunity4/10

   Firebase's Realtime Database is built for syncing live data across connected clients, and community evidence describes real-time multi-client state sync (whiteboarding with synced positions, real-time notifications), which supports ephemeral broadcast use cases. However, the evidence pack never explicitly documents Firebase's presence-detection features (onDisconnect, .info/connected) which are the canonical mechanism for this story. Missing for 10: explicit docs on presence detection/onDisconnect API, independent verification of presence tracking specifically (not just generic realtime sync).

   • [claimed-docs] “Store and sync app data at global scale without managing servers.”
   • [community] “I built a real time whiteboarding app for teachers over 10 years ago on the backbone of the original Firebase service. It was so fast I was …”
   • [community] “We were one of the first hundred users to join Firebase (ID:68) and I remember how easy it was to add real time notifications to one of my p…”

   proof ↗⚑ flag

3. developerSubscribe to live data changes so my UI updates in real time without polling

   weight 3 · round to Supabase
   Supabase✓fullcommunity9/10

   Supabase Realtime explicitly supports Postgres Changes (listen to DB changes in real-time), plus Broadcast and Presence, enabling UI updates without polling, and community evidence confirms real-world usage (Realtime Multiplayer launch with concurrent users, developers building chat/typing apps on it). Missing for 10: independent hands-on benchmark of Postgres Changes latency/reliability at scale beyond the CEO's launch post.

   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”
   • [claimed-docs] “Chat applications - Real-time messaging with typing indicators and online presence”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [community] “Supabase CEO on Realtime Multiplayer launch: added Broadcast (ephemeral messages) and Presence (eventually-consistent state) to the Realtime…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”

   proof ↗⚑ flag

   Firebase✓fullcommunity7/10

   Firebase's core value proposition includes real-time data sync — docs confirm apps can 'write, read, listen to, and query data' even offline, and multiple independent developers describe building live-updating apps (real-time whiteboard, real-time notifications, live sync across clients) confirming push-based updates rather than polling. missing for 10: explicit documentation of the onSnapshot/listener API surface and any first-party performance benchmarks for real-time delivery.

   • [claimed-docs] “Cloud Firestore caches data that your app is actively using, so the app can write, read, listen to, and query data even if the device is off…”
   • [community] “I built a real time whiteboarding app for teachers over 10 years ago on the backbone of the original Firebase service. It was so fast I was …”
   • [community] “We were one of the first hundred users to join Firebase (ID:68) and I remember how easy it was to add real time notifications to one of my p…”
   • [community] “We used the original Firebase database product to build socrates.io 3.5 years ago, and I remember getting it running in a few hours.”

   proof ↗⚑ flag

Search

1. developerRun full-text search over my data without wiring up an external search service

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack covers Supabase's database, realtime, auth, storage, vector/AI, and CLI/MCP capabilities extensively, but nowhere mentions Postgres full-text search (tsvector, GIN indexes, or a dedicated search feature). Full-text search is a fair axis for a database-as-a-service product, so absence of evidence yields 'none' rather than 'na'.

   ⚑ flag

   Firebase—none0/10

   The evidence shows Cloud Firestore supports filtering/sorting queries and vector (KNN) similarity search for embeddings, but nothing indicates native full-text search over string fields; Firestore is well known for requiring an external service (e.g., Algolia/Elasticsearch) for text search, and community comments even complain about limited query capabilities. No documentation or hands-on evidence shows a built-in full-text search feature.

   • [claimed-docs] “Your queries can include multiple, chained filters and combine filtering and sorting.”
   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches”
   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches using the following techniques”
   • [claimed-docs] “This page shows you how to use Cloud Firestore to perform K-nearest neighbor (KNN) vector searches using the following techniques: Store vec…”
   • [community] “How do the querying features compare to Firebase? Firebase is notorious for having an unintuitive lack of server-side query options when you…”

   proof ↗⚑ flag

1. developerRun functions automatically in response to database or auth events

   weight 2 · round to Firebase
   Supabase~partialclaimed3/10

   Supabase does offer Edge Functions (supabase-docs-8) and real-time Postgres Changes streaming (supabase-docs-5/22/23), which are the building blocks for event-driven execution, but the evidence pack never documents the actual Database Webhooks / Auth Hooks mechanism that automatically invokes a function on insert/update/delete or auth events. Missing for 10: explicit docs or hands-on proof of Database Webhooks/Auth Hooks wiring DB/auth events directly to function invocation, and any developer confirmation that this works reliably in practice.

   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients... Presence: Track and synchronize user state across clients... Postgres Changes: Liste…”
   • [claimed-docs] “Broadcast: Send low-latency messages between clients. Perfect for real-time messaging, database changes, cursor tracking, game events, and c…”
   • [claimed-docs] “Presence: Track and synchronize user state across clients. Ideal for showing who's online, or active participants.”

   proof ↗⚑ flag

   Firebase✓fullclaimed9/10

   Cloud Functions for Firebase is explicitly documented as a serverless framework that runs backend code automatically in response to background events, HTTPS requests, Admin SDK actions, or scheduler jobs, including Firebase Authentication triggers and Cloud Storage/Firestore triggers. This directly matches the story of running functions in response to database/auth events. missing for 10: independent hands-on report specifically confirming database/auth trigger reliability (community evidence focuses on other pain points, not this specific capability).

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “The functions you write can respond to events generated by various Firebase and Google Cloud features, from Firebase Authentication triggers…”

   proof ↗⚑ flag

2. developerDeploy server-side functions invoked by HTTP or SDK calls without managing servers

   weight 3 · round to Firebase
   Supabase✓fullclaimed8/10

   Supabase Edge Functions are explicitly documented as server-side TypeScript functions distributed globally, invocable via HTTP or client SDKs, without server management — matching the story directly. Community evidence corroborates broader platform reliability and real usage, though nothing specifically stress-tests Edge Functions at scale. missing for 10: independent hands-on validation of Edge Function invocation/scaling, and details on cold-start/latency limits.

   • [claimed-docs] “Edge Functions are server-side TypeScript functions, distributed globally at the edge—close to your users.”
   • [claimed-docs] “Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [claimed-docs] “Start your project with a Postgres database. Add Authentication, Data APIs, Edge Functions, Realtime Data, Storage, and Vector embeddings.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”

   proof ↗⚑ flag

   Firebase✓fullclaimed9/10

   Cloud Functions for Firebase is explicitly documented as a serverless framework to run backend code triggered by HTTPS requests, Admin SDK/client SDK calls, or background events, with one-command CLI deployment and automatic scaling. Missing for 10: independent hands-on corroboration of production-scale reliability of Functions specifically (community evidence mostly discusses Firestore/Auth/pricing rather than Functions usage).

   • [claimed-docs] “Cloud Functions for Firebase is a serverless framework that lets you automatically run backend code in response to events triggered by backg…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [claimed-docs] “The functions you write can respond to events generated by various Firebase and Google Cloud features, from Firebase Authentication triggers…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”

   proof ↗⚑ flag

Ai provisioning

1. ai-native userHave an agent stand up a new backend — schema, auth, and policies — headlessly from the CLI in a script

   weight 3 · round to Supabase
   Supabase✓fullprobed7/10

   The CLI supports fully headless project scaffolding (`supabase init`/`start`) with no login or key required, confirmed by hands-on probes, and Postgres RLS policies (schema/auth authorization) are defined declaratively in SQL that can be run via the CLI/migrations, matching the 'headless from a script' requirement. missing for 10: explicit hands-on evidence of scripting auth-provider configuration and RLS policy deployment together via `supabase db push`/migrations in one automated flow, and independent (non-vendor) confirmation of a full agent-driven backend bootstrap.

   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. supabase init to create a new local project 2. supabase start to launch …”
   • [claimed-docs] “supabase init to create a new local project 2. supabase start to launch the Supabase services”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social login, and single sign-on (SSO…”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”

   proof ↗⚑ flag

   Firebase~partialprobed6/10

   Firebase CLI (firebase-tools) supports scripted, headless deployment of Firestore/Realtime Database security rules, Cloud Functions, and Auth user import/export, and the MCP server also exposes project/auth/data management to agents, covering schema+auth+policies largely from the command line. However, there's no single documented 'init a full backend' one-shot command evidenced, and evidence doesn't show a non-interactive schema-creation flow (Firestore is schemaless, so 'schema' setup maps to rules/indexes only). missing for 10: a documented fully non-interactive scripted bootstrap command chaining project creation, schema/indexes, auth, and rules; independent hands-on confirmation of headless end-to-end setup.

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Import/Export users into/from Firebase Auth”
   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [claimed-docs] “Firebase Security Rules leverage extensible, flexible configuration languages to define what data your users can access for Realtime Databas…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”

   proof ↗⚑ flag

Local

1. developerRun the whole backend stack locally with an emulator or CLI before deploying

   weight 3 · round to Firebase
   Supabase!disputedcontradicted5/10

   Docs and a keyless hands-on probe confirm the Supabase CLI (`supabase init`/`supabase start`) can spin up the entire stack (DB, Auth, Storage, Realtime, Functions) locally before deploying, which is exactly what the story asks for. However, independent hands-on community reports directly contradict smooth delivery — one calls local dev/migration 'Supabase's biggest weakness' and another describes it as 'a massive pain with random bugs' making the whole platform feel 'like a hack'. Missing for 10: consistent independent corroboration that local stack runs reliably without the bugs/friction reported by hands-on users.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [claimed-docs] “With two commands, you can set up and start a new local project: 1. `supabase init` to create a new local project 2. `supabase start` to lau…”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “Even though it looks like a great product initially, it has a lot of errors and bugs when you are trying to actually build something more ro…”

   proof ↗⚑ flag

   Firebase✓fullprobed8/10

   Firebase's Local Emulator Suite explicitly supports running Firestore, Realtime Database, Storage, Auth, Hosting, Functions, Pub/Sub, and Extensions locally for integration testing without touching production, and the firebase-tools CLI supports running a local hosting server and interacting with data/deploying. This directly matches the story of running the whole backend stack locally before deploying, with unit-test support via mocha also documented. Missing for 10: independent/hands-on verification of full-suite parity beyond docs, and no community corroboration specifically praising the emulator suite's completeness.

   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [claimed-docs] “This means you can connect your app directly to these emulators to perform integration testing or QA without touching production data.”
   • [claimed-docs] “Unit Tests: using the Firebase Test SDK, you can write unit tests in Node.js using the mocha test runner.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Supabase
   Supabase~partialprobed7/10

   Supabase auto-generates REST/GraphQL APIs directly from the Postgres schema, exposes an openapi.json spec (confirmed live via probe), and ships a CLI/MCP server that lets an AI agent provision, configure, and query projects headlessly (supabase-docs-13, supabase-gh-2, supabase-probe-3, supabase-probe-6, supabase-probe-8). This gives strong data/API-layer parity with the dashboard for CRUD, auth, storage, and realtime features. However, the evidence pack never confirms parity for dashboard-only administrative actions (billing, org/project creation, scaling settings) via a documented Management API, and community notes point to real friction (PostgREST/RLS limitations, CLI instability) that complicate full UI-equivalent control (supabase-comm-10, supabase-comm-12). Missing for 10: explicit Management API docs covering billing/org/project-lifecycle actions, and independent verification that all dashboard settings are scriptable.

   • [claimed-docs] “Instant ready-to-use REST APIs.”
   • [github] “Auto-generated APIs. - [x] REST. [Docs] - [x] GraphQL. [Docs] - [x] Realtime subscriptions.”
   • [probe] “PROBE openapi: HTTP 200 at https://supabase.com/openapi.json — contains "openapi" key”
   • [probe] “official CLI documented at https://supabase.com/docs/guides/local-development/cli/getting-started”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [community] “The Supabase CLI is updated every single time I run `brew upgrade`. It makes me feel like I'm trying to swing a bat around, except it's made…”

   proof ↗⚑ flag

   Firebase~partialprobed6/10

   Firebase ships extensive first-party APIs/SDKs (Firestore, Auth, Functions, Rules) plus a CLI (firebase-tools) that can deploy, manage hosting, interact with database data, and import/export Auth users, and an official MCP server that lets AI tools create/manage projects, manage Auth users, and work with Firestore data — strong evidence of broad API/CLI parity with console actions. However, there is no explicit documentation or independent confirmation that *every* console capability (e.g., analytics/Gemini insights, billing, project-level admin settings) is exposed via API/CLI, and probes show no OpenAPI spec or llms.txt is published, weakening claims of full programmatic parity. Missing for 10: explicit full-parity documentation, independent hands-on confirmation that all UI actions map to API/CLI, and a published OpenAPI/machine-readable spec.

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site”
   • [github] “Import/Export users into/from Firebase Auth”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “Deploy your JavaScript, TypeScript, or Python code to our servers with one command from the command line. After that, Firebase automatically…”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”
   • [probe] “official CLI documented at https://firebase.google.com/docs/cli?hl=en”
   • [probe] “PROBE llms.txt: HTTP 404 at https://firebase.google.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://firebase.google.com/openapi.json, https://firebase.google.com/swagger.json, https://firebase…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Supabase
   Supabase~partialcommunity5/10

   Supabase is built on Postgres and offers self-hosting for 'full control over your data,' implying standard SQL/pg_dump portability and no lock-in, but the evidence pack contains no explicit documentation of a data-export feature, backup/download tooling, or migration-out guide. Missing for 10: explicit export/backup documentation (e.g., pg_dump instructions or a dashboard 'export project' feature), independent confirmation that self-hosted migration actually works cleanly, and any community report of successfully exporting/leaving.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [github] “We're building the features of Firebase using enterprise-grade open source tools.”
   • [community] “How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are do…”

   proof ↗⚑ flag

   Firebase!disputedcontradicted3/10

   Firebase CLI documents import/export of Auth users (open JSON) and one user notes deliberately keeping Firestore as a plain JSON store for portability, but there is no documented open-format export path for Firestore, Storage, or Security Rules, and multiple community accounts explicitly describe painful lock-in ('keenly aware of the cost of lock-in', 'need to reimplement storage rules — an absolute pain', 'the lock-in effect is super bad') when trying to migrate away. Missing for 10: comprehensive documented export of Firestore/Storage/Rules in open formats, first-party migration tooling, and independent confirmation that leaving is frictionless.

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Import/Export users into/from Firebase Auth”
   • [community] “I use Firebase Database but keep it arms length by avoiding any of the proprietary features it offers. I use it exclusively as a JSON store …”
   • [community] “My app is currently built on top of Firebase but I'm keenly aware of the cost of lock-in as traffic escalates.”
   • [community] “Besides the pricing, the other painful thing about Firebase are the storage rules. If I switch serverless I need to reimplement them — an ab…”
   • [community] “After being both delighted and frustrated about Firebase I decided that something must be done. The developer experience on Firebase is awes…”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Supabase
   Supabase✓fullclaimed7/10

   The GitHub repo (supabase/supabase) is explicitly described as built with 'enterprise-grade open source tools' and aims to give a 'Firebase-like developer experience using open source tools,' and the docs describe self-hosting for full control over data, confirming the source is publicly available and open. Missing for 10: explicit citation of the license file/name (e.g., Apache 2.0) and independent confirmation of license terms beyond marketing language.

   • [github] “We're building the features of Firebase using enterprise-grade open source tools.”
   • [github] “Our aim is to give developers a Firebase-like developer experience using open source tools.”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”

   proof ↗⚑ flag

   Firebase~partialclaimed3/10

   Evidence shows firebase-tools (the CLI) is hosted on a public GitHub repo, implying it is open source, but the core Firebase backend/service (Firestore, Auth, Functions runtime) is proprietary and no license or full source is documented for the platform itself. missing for 10: explicit open-source license statement, source availability for the core backend/service, independent confirmation of license terms for firebase-tools.

   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site”
   • [github] “Import/Export users into/from Firebase Auth”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Supabase
   Supabase✓fullprobed9/10

   Supabase explicitly documents self-hosting as a supported deployment model for full data control/compliance, with docs and CLI tooling (supabase init/start) to run the entire stack locally or in CI, corroborated by a hands-on probe confirming headless local provisioning. missing for 10: independent hands-on verification of a full production self-hosted deployment (beyond local dev) and community reports raise friction/rough edges in self-hosting experience.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”
   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “How easy is it to self host Supabase? Is it more like 'we're open-source, but good luck getting this deployed!'... I wonder if people are do…”

   proof ↗⚑ flag

   Firebase—none0/10

   Firebase is a fully-managed, closed Google Cloud service with no self-hosted/on-premise deployment option documented anywhere in the evidence; the emulator suite is explicitly for local testing/QA, not production self-hosting, and community comments highlight lock-in concerns rather than any self-hosting path.

   • [claimed-docs] “This means you can connect your app directly to these emulators to perform integration testing or QA without touching production data.”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [community] “My app is currently built on top of Firebase but I'm keenly aware of the cost of lock-in as traffic escalates.”
   • [community] “After being both delighted and frustrated about Firebase I decided that something must be done. The developer experience on Firebase is awes…”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to Supabase
   Supabase~partialclaimed5/10

   Supabase docs claim self-hosting as an option for users needing 'full control over your data' or compliance requirements, which implies data residency control by running your own infrastructure (supabase-docs-3/29). However, the evidence pack contains no explicit documentation of region selection for hosted/managed Supabase projects (e.g., a region picker at project creation), which is the more common AI-native use case. Missing for 10: explicit hosted-plan region selection docs, confirmation of available regions, and independent verification of residency guarantees.

   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements that prevent you from using managed service…”
   • [claimed-docs] “Self-hosting is a good fit if you need full control over your data, have compliance requirements...”

   proof ↗⚑ flag

   Firebase—none0/10

   No evidence in the pack mentions data residency, region selection, or location settings for Firebase services (Firestore, Storage, Functions, etc.), even though Firebase/GCP products do typically allow region selection in reality. Absence of evidence for this applicable capability yields 'none'.

   ⚑ flag

2. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack shows Supabase's self-hosting option ('full control over your data') and RLS/storage access controls, but nothing documents explicit data-retention policies, project/data deletion tooling, backup expiry controls, or user-data erasure workflows that would let an AI-native user manage retention/deletion. Missing for 10: documented deletion APIs (e.g., project/user data deletion), retention policy settings, backup lifecycle controls, and GDPR-style data erasure guarantees.

   ⚑ flag

   Firebase—none0/10

   The evidence pack covers Firestore querying, security rules, auth, functions, and emulators, but contains no documentation of data retention policies, TTL/expiration settings, or deletion/export APIs for privacy compliance (e.g., GDPR-style user data deletion). No citations address controlling how long data is kept or how it can be purged.

   ⚑ flag

3. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Supabase—none0/10

   No evidence pack item discusses telemetry, usage tracking, opt-out settings, or privacy controls for CLI/dashboard analytics; the pack covers unrelated product features (auth, storage, realtime, MCP, self-hosting). Missing for 10: any docs or settings referencing telemetry collection, an opt-out flag/env var, or privacy policy statement on usage data.

   ⚑ flag

   Firebase—none0/10

   No evidence pack items mention telemetry, usage tracking, or an opt-out mechanism for Firebase's own tooling/services; only unrelated docs on Firestore, Auth, Functions, and pricing are present.

   ⚑ flag

Ai migrations

1. ai-native userLet an agent create and test schema changes in an isolated branch or preview environment before production

   weight 3 · round to Supabase
   Supabase~partialprobed7/10

   Supabase documents a first-class branching feature explicitly for testing schema changes in isolation before production (supabase-docs-10/17/24), and separately provides an MCP server plus CLI that let AI agents interact with and provision projects programmatically (supabase-docs-1/27, supabase-probe-4/6/7/8). However, there is no direct evidence tying agent/MCP workflows to the branching feature itself, and community feedback flags migration/local-dev tooling as a weak point ('local development & database migration story is Supabase's biggest weakness' — supabase-comm-7) and notes AI agents often run with elevated service_role access that bypasses RLS (supabase-comm-15), raising safety caveats for autonomous schema testing. Missing for 10: explicit documentation/example of an agent using MCP+CLI to create a branch, apply/test schema changes, and promote to production; independent hands-on validation of that full agent-branch loop.

   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project.”
   • [claimed-docs] “Once connected, your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [claimed-docs] “your AI assistants can interact with and query your Supabase projects on your behalf.”
   • [probe] “official MCP server documented at https://supabase.com/docs/guides/ai-tools/mcp”
   • [probe] “PROBE cli-runtime: npx -y supabase --version → "2.116.0" — official Supabase CLI installs from npm and runs headlessly (hands-on, keyless)”
   • [probe] “PROBE mcp-handshake: POST JSON-RPC initialize to https://mcp.supabase.com/mcp → HTTP 401 {"message":"Unauthorized"} — live remote MCP server…”
   • [probe] “PROBE headless-init: npx supabase init in an empty directory scaffolds supabase/config.toml with no login or key — an agent can provision a …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”

   proof ↗⚑ flag

   Firebase~partialprobed4/10

   Firebase's Local Emulator Suite lets developers (or an agent driving the CLI) test Firestore/Security Rules changes locally without touching production data, and the MCP server exposes Firestore project/data management to AI agents — together giving a rough isolated-testing story. However, Firestore is schemaless (no formal schema-migration concept) and there is no documented branch/preview-environment feature (e.g., a project 'branch' with automatic promotion) analogous to database branching tools. Missing for 10: explicit schema/migration versioning, a true branch/preview-environment workflow, and evidence of an agent autonomously provisioning/testing such a branch before production.

   • [claimed-docs] “This means you can connect your app directly to these emulators to perform integration testing or QA without touching production data.”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [claimed-docs] “An editor configured to use the Firebase MCP server can use its AI capabilities to help you: Create and manage Firebase projects, Manage you…”
   • [probe] “official MCP server documented at https://firebase.google.com/docs/ai-assistance/mcp-server?hl=en”

   proof ↗⚑ flag

Migrations

1. developerManage schema changes as version-controlled migrations applied via the CLI or CI

   weight 3 · round to Supabase
   Supabase!disputedcontradicted4/10

   Docs confirm the Supabase CLI can run the full stack locally and in CI environments (supabase-docs-21) and branching lets you test schema changes outside production (supabase-docs-10/17), implying a migrations-in-CI workflow, but the evidence pack never shows an actual migration/diff/push command being used. A hands-on community report explicitly states 'The local development & database migration story is Supabase's biggest weakness... I hate having to do migrations live in prod' (supabase-comm-7), directly contradicting the implied smooth CLI/CI migration workflow. missing for 10: explicit evidence of `supabase migration new`/`db push`/`db diff` commands, a documented CI pipeline example, and independent corroboration that migrations work reliably in production.

   • [claimed-docs] “The Supabase CLI enables you to run the entire Supabase stack locally, on your machine or in a CI environment.”
   • [claimed-docs] “You can use these branching environments to create and test changes like new configurations, database schemas, or features without affecting…”
   • [claimed-docs] “Supabase branches create separate environments that spin off from your main project. You can use these branching environments to create and …”
   • [community] “The local development & database migration story is Supabase's biggest weakness. I hate having to do migrations live in prod. The admin dash…”

   proof ↗⚑ flag

   Firebase—none0/10

   Firebase's CLI can deploy static config like Firestore security rules and indexes, but there is no evidence of a schema-migration framework (versioned, incremental migrations with up/down scripts) applied via CLI/CI; in fact a community report explicitly notes the lack of a business-logic layer makes schema changes 'extremely challenging' for deployed clients, underscoring the absence of this capability.

   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [github] “Deploy code and assets to your Firebase projects - Run a local web server for your Firebase Hosting site - Interact with data in your Fireba…”
   • [community] “The concern I've always had with Firebase is the lack of a business logic layer between clients and the database. This tends to force the bu…”

   proof ↗⚑ flag

Type safety

1. developerGenerate typed client code (e.g. TypeScript types) from my schema automatically

   weight 2 · round to Supabase
   Supabase✓fullclaimed8/10

   Supabase documents generating type-safe TypeScript definitions (database.types.ts) directly from database introspection via CLI/API tooling, a core first-party feature. Missing for 10: independent/hands-on confirmation of the generated types working in a real project and coverage of edge cases (e.g., custom types, enums) beyond docs.

   • [claimed-docs] “Generate types for your project to produce the `database.types.ts` file”
   • [claimed-docs] “Supabase APIs are generated from your database, which means that we can use database introspection to generate type-safe API definitions.”

   proof ↗⚑ flag

   Firebase—none0/10

   No evidence of Firebase generating typed client code/TypeScript types from a schema; docs cover Firestore, Auth, Functions, emulators, security rules, and MCP/Gemini AI features but nothing about automatic type generation from schema.

   ⚑ flag

Access control

1. developerRestrict data access per user with row-level security policies or security rules

   weight 3 · round to Firebase
   Supabase~partialcommunity7/10

   Supabase's docs clearly document RLS policy syntax (e.g. per-user select policies using auth.uid()) and extend fine-grained access control to Storage, directly matching the story. However, community evidence shows real-world friction: RLS limitations forcing workarounds (multiple user tables), an MCP integration that bypasses RLS via service_role, and reports of RLS being tricky to get right initially. missing for 10: independent hands-on verification that policies enforce correctly across all Supabase products, clearer documentation on avoiding service_role bypass pitfalls, and resolution of cited RLS/auth issues left open for over a year.

   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [claimed-docs] “create policy "Individuals can view their own todos." on todos for select to authenticated using ( (select auth.uid()) = user_id );”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”
   • [community] “I also ended up with 3 user tables due to RLS limitations: auth users, public user profile info, and private user info... PostgREST's limita…”
   • [community] “I hadn't touched SQL for almost 7 years, but dipped my toes back in to build a PoC using Supabase. Despite some initial pains around RLS, I'…”
   • [community] “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) p…”
   • [community] “I built backend for my typing app using supabase with row level security(RLS) and OAuth providers to track... Supabase + SvelteKit + Cloudfl…”

   proof ↗⚑ flag

   Firebase✓fullcommunity8/10

   Firebase Security Rules are extensively documented as the mechanism to restrict data access per user across Firestore, Realtime Database, and Cloud Storage, with granular, expression-based rule languages, and community evidence corroborates real-world use (e.g., failed attempts blocked by rules, separation of auth logic from data access). missing for 10: no independent hands-on audit of rule robustness/edge cases, and community notes rules can be painful to maintain/reimplement, slightly denting polish.

   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [claimed-docs] “Firebase Security Rules leverage extensible, flexible configuration languages to define what data your users can access for Realtime Databas…”
   • [claimed-docs] “You can write simple or complex rules that protect your app's data to the level of granularity that your specific app requires.”
   • [community] “One of the things I find quite nice about firebase is the powerful separation between data retrieval/update logic and the enforcement of acc…”
   • [community] “"This includes failed attempts which are blocked by their security rules." Ouch!”
   • [community] “Besides the pricing, the other painful thing about Firebase are the storage rules. If I switch serverless I need to reimplement them — an ab…”

   proof ↗⚑ flag

Data protection

1. platform-engineerRely on automated backups and point-in-time recovery for my data

   weight 2 · round drawn
   Supabase—none0/10

   The evidence pack contains no vendor-tier documentation describing automated backups or point-in-time recovery (PITR) features; the only related evidence is a community report (supabase-comm-9) describing nightly pg_dump backups causing write-contention problems and the team merely 'investigating' moving customers to PITR. Since a disputed verdict requires a vendor claim tier plus a contradicting tier, and no first-party docs claim exists here, there is insufficient evidence the capability is delivered at all.

   • [community] “Supabase CEO responding to Val Town's migration postmortem: nightly pg_dump backups caused write-contention issues at midnight on a write-he…”

   proof ↗⚑ flag

   Firebase—none0/10

   No evidence in the pack mentions automated backups or point-in-time recovery for Firestore/Realtime Database; only security rules, querying, offline caching, and emulator suite are documented. This is a plausible axis for a database/backend platform, so absence of evidence yields 'none'.

   ⚑ flag

Files

1. developerUpload and serve user files with access rules and CDN-backed delivery

   weight 3 · round to Supabase
   Supabase✓fullcommunity7/10

   Supabase Storage docs explicitly describe fine-grained access controls via RLS policies and 'optimized delivery' for files of any size, directly matching the story's core ask (upload, access rules, CDN-like delivery). Community feedback confirms real-world usage of RLS with storage but notes storage still lacks direct metadata support, a secondary limitation rather than a failure of access control or delivery. Missing for 10: explicit mention of CDN infrastructure/edge caching details and independent hands-on confirmation of CDN-backed delivery performance.

   • [claimed-docs] “Supabase Storage is a robust, scalable solution for managing files of any size with fine-grained access controls and optimized delivery.”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”
   • [claimed-docs] “Postgres Row Level Security (RLS) gives you granular authorization rules that run inside the database.”
   • [community] “I have been developing with Supabase past two months... there are still some rough corners in general and some basic features missing. Examp…”

   proof ↗⚑ flag

   Firebase~partialcommunity3/10

   Evidence only mentions 'Cloud Storage' in passing as one of the products covered by Firebase Security Rules and the Emulator Suite (firebase-docs-10, firebase-docs-18, firebase-docs-24), with community mentions of 'storage rules' as a pain point (firebase-comm-5, firebase-comm-8). There is no documentation in the pack describing file upload/download APIs, access-rule granularity for files, or CDN-backed delivery specifics. missing for 10: docs on Cloud Storage upload/download SDK, CDN delivery details, access-rule examples for file objects, independent corroboration of CDN performance.

   • [claimed-docs] “Use our flexible, extensible Firebase Security Rules to secure your data in Cloud Firestore, Firebase Realtime Database, and Cloud Storage.”
   • [claimed-docs] “Firebase Security Rules leverage extensible, flexible configuration languages to define what data your users can access for Realtime Databas…”
   • [claimed-docs] “The Firebase Local Emulator Suite is a set of advanced tools for developers looking to build and test apps locally using Cloud Firestore, Re…”
   • [community] “Besides the pricing, the other painful thing about Firebase are the storage rules. If I switch serverless I need to reimplement them — an ab…”
   • [community] “I'm a big fan of firebase and use it whenever I can. The reason it's appealing is the suite of tools and how well they work together for boo…”

   proof ↗⚑ flag

2. developerServe resized or transformed images from storage without running my own image pipeline

   weight 1 · round drawn
   Supabase—none0/10

   The evidence only describes Supabase Storage generally as offering 'fine-grained access controls and optimized delivery' (supabase-docs-7, supabase-docs-30) but never mentions image resizing, transformation parameters, or a CDN-based image pipeline feature. Missing for 10: any documentation of an image transformation/resizing API or CDN, hands-on proof of resized image delivery.

   • [claimed-docs] “Supabase Storage is a robust, scalable solution for managing files of any size with fine-grained access controls and optimized delivery.”
   • [claimed-docs] “Fine-grained Access Control - Manage file permissions with row-level security and custom policies”

   proof ↗⚑ flag

   Firebase—none0/10

   No evidence pack items mention Firebase Extensions for image resizing, Cloud Storage image transformation, or any built-in image pipeline capability; the pack covers Firestore, Auth, Functions, Rules, and MCP but nothing about serving resized/transformed images.

   ⚑ flag