---
title: Supabase
summary: Connect a Supabase account so your AI agents can list projects, review table schemas, functions, branches and backups, and — only when you allow it — run SQL and deploy functions.
category: integrations
slug: supabase
---

## What Supabase in Kronos AI lets your agents do

Once a Supabase account is connected to Kronos AI, your agents can —
within the permissions you grant — help you manage your Supabase
projects the way you would from the Supabase dashboard:

**Read actions** (available when an agent has "Read only" or higher):

- List your organizations and see the details and members of each one.
- List your projects.
- Check the health status of a project's services.
- See whether a project is in read-only mode.
- Read the structure of your tables — columns, types, and constraints.
- Generate TypeScript types from a project's database.
- List a project's edge functions and open the details of one.
- List a project's database branches.
- List a project's backups.
- List a project's storage buckets.

**Write actions** (available only when an agent has "Read and write"):

- Run a SQL query against a project's database.
- Deploy an edge function to a project.
- Create a database branch.

Running SQL is a write action even when the query only reads data,
because a query can also change or delete it. Keep an agent on "Read
only" unless you want it to have that power.

Some Supabase capabilities are deliberately not available to agents at
all: reading or creating API keys and secrets, deleting projects or
functions, restoring backups, and changing network or security
settings. Do those from the Supabase dashboard.

## Connecting Supabase

1. Open Kronos AI → **Connect** in the sidebar → **Applications** tab.
2. Click the **Supabase** card to open the detail dialog, then click the
   green **Connect** button.
3. You land on Supabase's sign-in screen — sign in if needed.
4. Review the access Supabase shows you and approve it.
5. You're sent back to Kronos AI at the **Already connected** tab with the
   new Supabase entry pre-selected.

You can connect more than one Supabase account; each appears as its own
entry.

## Naming the connection

If you connect more than one Supabase account, add a short personal
note next to each one (the "Your note for this connection" field) —
labels like "Production", "Client A", or "Staging" make a long list
easier to scan. The note is yours only.

## Giving an agent access

On the Supabase management page click **+ Add AI Agent**, pick the agent
from the dropdown, then choose:

- **Off** — the agent cannot touch this Supabase account.
- **Read only** — the agent can list projects, read table structures,
  functions, branches, backups and buckets, and check service health,
  but cannot run SQL or change anything.
- **Read and write** — the agent can do all of the above plus run SQL,
  deploy edge functions, and create database branches.

The same controls are available inside the AI Agent editor — open the **Connections** tab.

## Fine-grained overrides

Inside the permissions modal (the gear icon next to a Supabase account
in the agent editor or on the Supabase management page) you'll see the
full list of Supabase actions grouped by **Read tools** and **Write
tools**. Toggle individual actions on or off to override the preset.

Common combinations:

- **Reporting agent**: preset Read only, no overrides. The agent
  summarizes your projects, schemas and backups but cannot change
  anything.
- **Developer assistant**: preset Read only, override `Create database
  branch` ON. The agent can inspect everything and open a branch to
  experiment, but cannot run SQL against your data.
- **Safe operator**: preset Read and write, override `Run SQL query` OFF.
  The agent can deploy functions and create branches but never touches
  your data directly.
- **Full assistant**: preset Read and write, no overrides. Use this only
  for projects where you are comfortable with an agent running SQL.

Click Save to apply. Changes take effect on the next message the agent
processes.

## Multiple Supabase accounts on the same agent

If an agent has access to two or more Supabase accounts, the agent picks
which one to use on every action based on context. When the request is
ambiguous, the agent will ask which Supabase account to use.

You can cut ambiguity by turning the agent's access to one of the
accounts off, or by giving the connections obviously distinct notes.

## When something goes wrong

- **"Needs reconnect"** badge — Supabase revoked or expired the
  connection. Open `/app/connect`, click Supabase, and walk through
  Connect again. Permissions are preserved.
- **Agent says "I can't run that query"** — that agent's permission
  preset is Off or Read only without the matching write override. Open
  the permissions modal and adjust.
- **Agent says the connected app is temporarily unavailable** — Supabase
  or the connection had a transient hiccup. Ask the user to retry in a
  moment. If it persists, check the Supabase management page for a
  "Needs reconnect" badge.
- **Agent can't find a project** — the project belongs to an
  organization your connected account cannot see. Reconnect with an
  account that is a member of that organization.

## Privacy

Kronos AI does NOT store the content of your Supabase projects. Each time
an agent uses a Supabase action, it fetches just-in-time from Supabase
through the connection, uses what it needs to complete the task, and
discards the result. The audit log records that the action happened
(which agent, which action, when, and whether it succeeded), but not the
data itself.

When you disconnect Supabase or cancel your Kronos AI subscription, the
connection and all per-agent permissions are deleted immediately.