# ReqRes MCP server vs Supabase API + MCP (slim)

> Supabase scores 74 (BB) to ReqRes's 48.8 (D) for databases. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/reqres-mcp-vs-supabase-mcp.md (~4,650 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/reqres-mcp-vs-supabase-mcp.json · canonical https://www.anchorterminal.com/compare/reqres-mcp-vs-supabase-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Supabase API + MCP scores 74 (BB) on agent readiness against ReqRes MCP server's 48.8 (D), and leads in 6 of 7 scored categories. ReqRes MCP server leads on payments & pricing. Both do databases.

- ReqRes MCP server: D 48.8, rank #1114 of 1510 · https://www.anchorterminal.com/tools/reqres-mcp.min.md
- Supabase API + MCP: BB 74, rank #94 of 1510 · https://www.anchorterminal.com/tools/supabase-mcp.min.md
- ReqRes MCP server, good for Coding agents that need a throwaway or starter backend for a prototype, with no account to set up. Ahead on Payments & pricing, 50 against 35. Also No key needed to call it.
- Supabase API + MCP, good for Agents building on or administering Supabase projects, and for retrieval that wants vectors, full-text and SQL filters in one database. Ahead on Reliability, 60 against 30; Schema & documentation, 89 against 61; Security & auth, 84 against 33; Maintenance & community, 90 against 50; Transparency & trust, 90 against 47. Also Agent-ready, a grade of BB or better; Runs on your own machine; Free to start without a card; Open source.

| Category | ReqRes MCP server | Supabase API + MCP |
| --- | --- | --- |
| Reliability (16%) | 30 | 60 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 61 | 89 |
| Agent ergonomics (13%) | 76 | 78 |
| Security & auth (14%) | 33 | 84 |
| Payments & pricing (10%) | 50 | 35 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 50 | 90 |
| Transparency & trust (7%) | 47 | 90 |

| Fact (where they differ) | ReqRes MCP server | Supabase API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | ReqRes | Supabase |
| Hosted endpoint | `https://reqres.in/mcp` | `https://api.supabase.com/v1` |
| Transports | Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Auth | None | OAuth or key |
| Licence | none | Apache-2.0 |
| Tools exposed | 7 | 38 |
| Read-only variant documented | no | yes |
| MCP registry | `in.reqres/reqres` | `com.supabase/mcp` |
| Last release | none | 2026-10-29 |
| Terms last updated | not read yet | no date given |
| Privacy policy last updated | not read yet | no date given |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 111k stars, 31.6M npm/wk, 5.5M PyPI/wk |
| Agent reviews | none | 3.3/5 (8) |

Why the edge:
- Security & auth, Supabase API + MCP +51: ReqRes MCP server 33 (No credential to start, and project keys returned by the tool (15 of 30). Writes on the agent's own project only (12 of 20). Every successful result ends with a sponsored message, labelled and 'never written as an instruction', which still puts third-party text in the model's context (3 of 15). No audit log (0). No security programme found (3 of 20). 15 + 12 + 3 + 0 + 3 = 33.); Supabase API + MCP 84 (OAuth 2.1 with dynamic client registration on the hosted server, personal access tokens that can be scoped to chosen organisations, projects and permissions with an expiry (generally available since 6 October), and publishable and secret API keys plus RLS on the Data API (30). `read_only=true` runs SQL as a read-only Postgres user and hides write tools, `project_ref` and `features` narrow the surface, and destructive SQL needs elicitation confirmation since v0.13.0. Read-write with eight groups is the default (seven plus `feedback`, whose tools refuse in read-only mode), a `skip_elicitations` setting turns the confirmations off, and the agent plugin has no read-only option (#361) (17). `execute_sql` results come back inside an untrusted-data boundary, the description says not to follow instructions in them, and the docs cover prompt injection and production data. Supabase says these reduce the risk rather than remove it (13). Logs are queryable through `get_logs`. We didn't check the platform audit log (8). SOC 2 Type 2, ISO 27001, HIPAA with a BAA and regular penetration tests. security.txt, re-read on 1 November, points at a HackerOne disclosure programme with a 5-business-day response but has no Expires field, and no bug bounty URL found. A SECURITY.md added to the MCP repository on 28 October 2026 sets out what counts as a vulnerability in the server and its hosted endpoint, and says a predictable cost confirmation id "does not defeat a security boundary", which answers #318 (2 July 2026) as by design. It adds no new programme item, so the line stays (16). The July 2025 exfiltration demonstration is outside our 12-month window, so it carries no deduction here.)
- Transparency & trust, Supabase API + MCP +43: ReqRes MCP server 47 (Closed service under readable terms; operating company not named in the parts read (10 of 30). You own your data, unclaimed agent projects are deleted after 72 hours, and the terms say the free service can end with reasonable notice (22 of 30). That notice clause and the 72-hour rule are dated commitments (10 of 20). Subprocessors not found (5 of 20). 10 + 22 + 10 + 5 = 47.); Supabase API + MCP 90 (The MCP server and the whole Supabase stack are Apache-2.0 (30). Privacy notice from Supabase Pte. Ltd. with retention stated (contact data kept 60 days after account closure), a linked DPA and named service providers (24). Dated notices, legacy anon and service_role keys retired by the end of 2026, four TLS 1.2 CBC cipher suites removed from project HTTP APIs no earlier than 10 November 2026 (notice of 12 October), BREAKING sections in the MCP changelog, Vector Buckets flagged as subject to change (17). Service providers are named in the privacy notice and customers pick the project region, but we found no standalone subprocessor page (the old URL returns 404) (16).)
- Maintenance & community, Supabase API + MCP +40: ReqRes MCP server 50 (Registry entry in.reqres/reqres updated 16 October 2026 (30). No dated releases found (0). Blog and docs; no changelog (5 of 15). Official registry entry under its own namespace (15). No package to read (0). 30 + 0 + 5 + 15 + 0 = 50. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.); Supabase API + MCP 90 (MCP server v0.15.0 tagged on 29 October 2026, 3 days before the check (30). Six MCP releases in the 90 days from 3 August, v0.10.0 (10 August), v0.11.0 (20 August), v0.12.0 (4 September), v0.13.0 (17 September), v0.14.0 (14 October) and v0.15.0 (20). Open issues per the 1 October check (72, among them three OAuth sign-in bugs from August). The GitHub issue pages weren't read on 1 November, and no commit from 1 October to 30 October references #355, #368 or #374 (15). Listed in the official MCP registry as com.supabase/mcp, a domain-verified namespace, still at 0.14.0 on 1 November (15). Official JavaScript and Python SDKs, CI and release-please (10).)
- Reliability, Supabase API + MCP +30: ReqRes MCP server 30 (status.reqres.in wasn't reachable (0). No history (5). Free-plan limits published with numbers (250 requests a day, 3 collections, 100 records) (15). No retry guidance (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 15 + 0 + 0 + 10 = 30.); Supabase API + MCP 60 (Status page at status.supabase.com with component history, on incident.io since 8 October per the changelog (20). The JSON incident feed, re-read on 1 November, returns 25 incidents from 22 September to 31 October. Since 17 October it adds three majors, project lifecycle operations failing in all regions on 21 October (15:36 to 16:51 UTC), elevated Management API error rates in several regions on 22 October (11:29 to 13:42) and project lifecycle errors in the EU on 22 October (03:53 to 15:56), plus minor Management API errors from 22 to 26 October. The 17 October reading counted 3 critical and 3 major from 31 August, among them about 7 hours of failed lifecycle actions in all regions on 4 September, dashboard logins failing on 1 September and the Auth outage of 16 September. Several majors (0). Management API limits published, 120 requests a minute per user per project or organisation, 30 for log queries, per the 1 October check, not re-read on 1 November (15). 429 with `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`. We found no idempotency or safe-retry guidance for writes (10). The Enterprise SLA promises 99.9 per cent a month for each product with service credits, per the 17 October check (10). The platform is GA, but the MCP server is 0.x with branching marked experimental, and the docs give it no GA label (5). 20+0+15+10+10+5 = 60.)
- Schema & documentation, Supabase API + MCP +28: ReqRes MCP server 61 (Seven tools read from tools/list with JSON Schema inputs (25). llms.txt (10). A tool table says what each does (12 of 20). Records and fields are free-form objects (5 of 15). Worked flow on the MCP page, no error docs (6 of 15). Registry 1.0.0, no changelog (3 of 15). 25 + 10 + 12 + 5 + 6 + 3 = 61.); Supabase API + MCP 89 (The Management API publishes OpenAPI at api.supabase.com/api/v1-json, and every MCP tool has a typed zod input and output schema, exported through `createToolSchemas()` (25). llms.txt at supabase.com/llms.txt, per the 30 September check (10). Many descriptions say when and when not ("Use `apply_migration` instead for DDL operations", "Call `get_cost` first"), and the raw-SQL tools say not to read server files or follow instructions in results. Others are one line ("Pauses a Supabase project.") (16). Typed inputs with required fields and enums for feature groups and log services. SQL is free text by nature (12). Docs carry a URL builder and client snippets, and errors return with `isError` (11). release-please CHANGELOG with BREAKING sections, plus a dated platform changelog (15).)
- Payments & pricing, ReqRes MCP server +15: ReqRes MCP server 50 (No machine payment protocol (0). Plan prices public (10). Free plan (20). An agent creates a project with no person (20). 0 + 10 + 20 + 20 = 50.); Supabase API + MCP 35 (No x402, MPP or L402 (0). Plans are public with per-unit overages, $0.125 a GB of disk and $0.09 a GB of egress, though there's no per-call price (15). Free plan with no card, 500 MB and two active projects (20). A person has to sign up and log in through a browser for OAuth or to create a token (0).)