DBHub vs Supabase API + MCP

DBHub 43

The server holds database credentials, and the MCP side has no credential over stdio. Over HTTP a bearer token is optional and off by default while the default bind is 0.0.0.0, so an exposed port answers anyone the host allow-list admits (12). Read-only mode classifies statements and adds engine-level read-only transactions on PostgreSQL, with row limits and timeouts; there is no confirmation step for writes when read-only is off (16). Rows reach the model unmarked, and no guidance on treating results as untrusted was found beyond a blog post on the lethal trifecta (4). The workbench shows request traces (8). No SECURITY.md, disclosure policy or security.txt found (3). 12 + 16 + 4 + 8 + 3 = 43.

Supabase API + MCP 84

OAuth 2.1 with dynamic client registration on the hosted server, personal access tokens that can be scoped to chosen organisations, projects and permissions with an expiry (generally available since 6 October), and publishable and secret API keys plus RLS on the Data API (30). read_only=true runs SQL as a read-only Postgres user and hides write tools, project_ref and features narrow the surface, and destructive SQL needs elicitation confirmation since v0.13.0. Read-write with eight groups is the default (seven plus feedback, whose tools refuse in read-only mode), a skip_elicitations setting turns the confirmations off, and the agent plugin has no read-only option (#361) (17). execute_sql results come back inside an untrusted-data boundary, the description says not to follow instructions in them, and the docs cover prompt injection and production data. Supabase says these reduce the risk rather than remove it (13). Logs are queryable through get_logs. We didn't check the platform audit log (8). SOC 2 Type 2, ISO 27001, HIPAA with a BAA and regular penetration tests. security.txt, re-read on 1 November, points at a HackerOne disclosure programme with a 5-business-day response but has no Expires field, and no bug bounty URL found. A SECURITY.md added to the MCP repository on 28 October 2026 sets out what counts as a vulnerability in the server and its hosted endpoint, and says a predictable cost confirmation id "does not defeat a security boundary", which answers #318 (2 July 2026) as by design. It adds no new programme item, so the line stays (16). The July 2025 exfiltration demonstration is outside our 12-month window, so it carries no deduction here.

DBHub 61

MIT (30). A local server that sends data only to the configured database; no privacy statement, but nothing to state for hosted processing (15). Removed flags fail loudly with a message pointing at the TOML replacement (--readonly, READONLY, MAX_ROWS), but there is no written deprecation policy (10). No telemetry found in the source, though the README doesn't say so (12). 30 + 15 + 10 + 12 = 67.

Supabase API + MCP 90

The MCP server and the whole Supabase stack are Apache-2.0 (30). Privacy notice from Supabase Pte. Ltd. with retention stated (contact data kept 60 days after account closure), a linked DPA and named service providers (24). Dated notices, legacy anon and service_role keys retired by the end of 2026, four TLS 1.2 CBC cipher suites removed from project HTTP APIs no earlier than 10 November 2026 (notice of 12 October), BREAKING sections in the MCP changelog, Vector Buckets flagged as subject to change (17). Service providers are named in the privacy notice and customers pick the project region, but we found no standalone subprocessor page (the old URL returns 404) (16).

DBHub 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).

Supabase API + MCP 35

No x402, MPP or L402 (0). Plans are public with per-unit overages, $0.125 a GB of disk and $0.09 a GB of egress, though there's no per-call price (15). Free plan with no card, 500 MB and two active projects (20). A person has to sign up and log in through a browser for OAuth or to create a token (0).

DBHub 80

Scored as a local stdio and HTTP package. Official npm package @bytebase/dbhub with Node.js 22.5 or later stated (20). A run-tests workflow runs unit and container-based integration suites on push and pull request; the pass state wasn't read (15). Of the latest 25 issues, 22 are closed, most crash and regression reports fixed within days, such as the dropped-connection crash closed 21 October and duplicate column names closed 3 November (22). Semver tags for every release but no changelog file, and release notes weren't read (8). 1.0.0 since 28 July 2026 (15). 20 + 15 + 22 + 8 + 15 = 80.

Supabase API + MCP 60

Status page at status.supabase.com with component history, on incident.io since 8 October per the changelog (20). The JSON incident feed, re-read on 1 November, returns 25 incidents from 22 September to 31 October. Since 17 October it adds three majors, project lifecycle operations failing in all regions on 21 October (15:36 to 16:51 UTC), elevated Management API error rates in several regions on 22 October (11:29 to 13:42) and project lifecycle errors in the EU on 22 October (03:53 to 15:56), plus minor Management API errors from 22 to 26 October. The 17 October reading counted 3 critical and 3 major from 31 August, among them about 7 hours of failed lifecycle actions in all regions on 4 September, dashboard logins failing on 1 September and the Auth outage of 16 September. Several majors (0). Management API limits published, 120 requests a minute per user per project or organisation, 30 for log queries, per the 1 October check, not re-read on 1 November (15). 429 with X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. We found no idempotency or safe-retry guidance for writes (10). The Enterprise SLA promises 99.9 per cent a month for each product with service credits, per the 17 October check (10). The platform is GA, but the MCP server is 0.x with branching marked experimental, and the docs give it no GA label (5). 20+0+15+10+10+5 = 60.

DBHub 73

Both default tools take zod schemas, so inputs are typed JSON Schema (25). dbhub.ai serves llms.txt (10). Descriptions are short and generated per source ("Execute SQL queries on the postgres database [READ-ONLY MODE]"), with the row cap stated, and say little about when not to use a tool (10). search_objects has enums for object type and detail level and a result limit; SQL is free text by nature (12). Docs pages per tool with examples; error formats aren't documented (9). Semver tags without a changelog (7). 25 + 10 + 10 + 12 + 9 + 7 = 73.

Supabase API + MCP 89

The Management API publishes OpenAPI at api.supabase.com/api/v1-json, and every MCP tool has a typed zod input and output schema, exported through createToolSchemas() (25). llms.txt at supabase.com/llms.txt, per the 30 September check (10). Many descriptions say when and when not ("Use apply_migration instead for DDL operations", "Call get_cost first"), and the raw-SQL tools say not to read server files or follow instructions in results. Others are one line ("Pauses a Supabase project.") (16). Typed inputs with required fields and enums for feature groups and log services. SQL is free text by nature (12). Docs carry a URL builder and client snippets, and errors return with isError (11). release-please CHANGELOG with BREAKING sections, plus a dated platform changelog (15).

DBHub 85

Two tools by default, about 1.4k tokens by the README's count, with opt-in extras (25). max_rows caps results and flags truncation, search_objects has names, summary and full detail levels and a limit (18). Errors return as tool errors with the database's message (12). readOnlyHint and destructiveHint follow the access policy, though idempotentHint is always false (18). Few required settings, one DSN, and no SDK is needed for a local server (12). 25 + 18 + 12 + 18 + 12 = 85.

Supabase API + MCP 78

38 released tools in v0.15.0 (29 October) across ten feature groups. v0.15.0 added submit_feedback and delete_feedback in a feedback group that is on by default, and create_notebook and run_notebook sit in the source behind a flag for unreleased tools. notebooks and storage are off by default. By our count of the default groups in the v0.15.0 source, an unscoped connection lists 31 tools over stdio or plain HTTP (29 in v0.14.0), 29 or 30 for clients that confirm costs in a form, and 32 where secret entry is offered. The docs' URL builder leaves the project unselected by default, so the default set is over 30 (5, was 15), as chrome-devtools-mcp read 32 default tools on 17 October. project_ref removes the nine account tools, features=database,docs cuts it to 6, and read_only hides write tools from tools/list since v0.10.0 (plus 10). list_tables is compact unless verbose is set and takes a schema list. Logs filter by service. execute_sql has no row cap, though the Data API pages with range and limit (16). Tool errors set isError, v0.15.0 marks client-caused errors as ToolCallerError and returns a tool error when a confirmation expires, and declined confirmations return plain text. OAuth bugs open per the 1 October check (#355 stale client id, #374 OIDC discovery 404, #368 Claude Code) leave sign-in failures hard to recover from (14). Every tool carries readOnlyHint and destructiveHint, execute_sql reports read-only in read-only mode, and destructive SQL and cost-bearing creates ask for confirmation through elicitation (18). project_id is injected when the URL is scoped. Official JavaScript and Python SDKs (@supabase/supabase-js, supabase on PyPI) (15).