Paired with
[supabase/platform#37175](https://github.com/supabase/platform/pull/37175).
Deletes the hand-maintained `MCPToolScopeMappings.ts` (the map is
currently 'manually extracted from the mcp controller' and drifts) and
fetches the `tool → FGA permission` map from the new mgmt-api `GET
/mcp-tools-permissions` endpoint, the same way it already fetches the
v1/v2 OpenAPI specs.
Closes AI-1016
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MCP tool permissions are now fetched dynamically from the management
API and included in API permission mappings.
* Permission data is validated before being applied.
* **Bug Fixes**
* Improved handling of invalid responses and request failures from the
MCP permissions service.
* Removed outdated bundled permission mappings, keeping access controls
aligned with current configuration.
* Updated permission mapping coverage to include both current API
specifications and MCP tools.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
## Summary
- Update `apps/studio` to `@supabase/mcp-server-supabase` `^0.11.0` and
add its required `@modelcontextprotocol/server` `^2.0.0` peer.
- Keep `@modelcontextprotocol/sdk` `^1.29.0` for Studio's existing
transports. `@supabase/mcp-utils` resolves transitively to `0.7.0`, so
it remains indirect.
[AI-1107](https://linear.app/supabase/issue/AI-1107/2b-update-self-hosted-remote-mcp-server)
## Testing
- Five focused MCP test files passed, 47 tests total.
- Studio production build passed with `SKIP_ASSET_UPLOAD=1`.
- A real `POST` initialize request to the built self-hosted `/api/mcp`
endpoint returned HTTP 200 with `serverInfo.version` `0.11.0`.
- Studio typecheck still reports one pre-existing error in unchanged
`packages/ui-patterns/src/McpUrlBuilder/components/InstructionBlocks.tsx:20`:
`string` is not assignable to `StaticImageData`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Improvements**
- Improved compatibility with the latest MCP server capabilities.
- Refreshed the Supabase MCP integration for a more up-to-date
experience.
- Verified that the available MCP tools remain consistent after the
update.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Breaking down #48635
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Scoped access tokens now support alternative permission requirements,
enabling more precise access for APIs and tools.
- Added clearer role and resource access evaluation, including
project-specific permissions and partial read access.
- Access reviews now identify unavailable or excessive permissions and
group inaccessible resources for easier resolution.
- **Bug Fixes**
- Improved handling of legacy, incomplete, or invalid permission data
with safer fallback behavior.
- Corrected access filtering for MCP tools and API capabilities.
- **Documentation**
- Updated access-review wording to clarify the relationship between
scopes and related MCP tools.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Description
This is the Scoped PAT stacked PRs root branch
## How to test
### With the `scopedPAT` enabled (default on staging)
Go to
https://studio-staging-git-scopedpat-merge-token-lists-supabase.vercel.app/dashboard/account/tokens.
- You shouldn't see two tabs anymore
- If you had classic tokens, they should have the _Legacy_ badge
- You can create scoped tokens
- You have a way to copy newly created tokens before closing the form
side panel
### With the `scopedPAT` disabled (use the devtool to override)
- You shouldn't see two tabs anymore
- If you had classic tokens, they should **not** have the _Legacy_ badge
- You can create classic tokens
- You have a way to copy newly created tokens above the list upon form
submission
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Show classic and scoped access tokens together in one list, with
classic tokens labeled “Legacy” when the scoped experience is enabled.
* Add scoped access token creation with a two-step configure → review →
success flow (when enabled).
* Add a dismissible migration notice about scoped tokens with a link to
API docs.
* Show “View permissions” only for scoped tokens.
* **Bug Fixes**
* Token deletion now supports both classic and scoped tokens with the
correct confirmation and success handling.
* The scoped tokens page now redirects to the unified access tokens
page.
* **Accessibility**
* Improved accessibility by adding a label to the token “more options”
action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
The `/incident-banner` endpoint is implemented using the Pages Router.
## What is the new behavior?
The `/incident-banner` endpoint is moved to the App Router, enabling
caching of the upstream fetch. This does not turn on the querying from
the frontend yet, making that a separate PR so we can revert easily if
needed.
## Additional context
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
`/incident-status` is handled via Pages Router.
## What is the new behavior?
`/incident-status` is handled via App Router, enabling use of Vercel
Data Cache to cache the upstream fetch.
## Additional context
Adding the first App Router route handler triggered `next typegen` (run
as `pretypecheck`) to generate `.next/dev/types/validator.ts`, which
imports all route files and expanded the type-checked graph. This
surfaced pre-existing `null`-safety errors in:
- `components/grid/SupabaseGrid.utils.ts` — `useSearchParams()` result
- `components/layouts/ProjectLayout/UpgradingState/index.tsx` —
`useSearchParams()` result
- `pages/project/[ref]/sql/quickstarts.tsx` — `useParams()` result
- `pages/project/[ref]/sql/templates.tsx` — `useParams()` result
These are fixed with optional chaining. The `tsconfig.json` change
(adding `.next/dev/types/**/*.ts` to `include`) is auto-generated by
Next.js and committed as correct behavior.
* Add vercel/ai. Commit additional next types.
* Add a API route in /app for streaming responses.
* Make the components work with streaming response.
* Add a dummy page to /app folder to fix a linking bug.
* Fix the dummy page.
* Fix the dummy page again.
* Add an empty layout to the app folder.
* Make the code snippets in the chat read-only.
* Remove queries and mutations for suggest.
* Reset the chat when closing the panel.
* Make the AI instructions a bit better.
* Don't render empty code blocks.
* Try to use remark for rendering the code. Style fixes for CodeBlock in AI assistant panel.
* Fix the styling of the definitions when sending them to OpenAI.
* Fix the css styling of the messages and code blocks.
* Move the suggest API route from app to pages folder.
* Revert the change for app API routes.
* Make the API route look like the rest of the API routes.
* Use Pre instead of Code because the <code> tags aren't working if between spans.
* Minor leftovers.
* Revert to using app route handlers.
* Change the wording on the diff header.
* Add nextjs types.
* Fix a missing import.
* Move AssistantChatForm back to db-new.
* Fix a build error.
* Rename the suggest route to assistant.
* Fix Joshen's comments.
