Supabase MCP authentication: known deviations
aud is the constant “authenticated” for every user of every project — cross-server replay is structural.
How Supabase deviates from the MCP authorization spec
- No RFC 8707 resource-indicator support.
- `aud` is pinned to the string “authenticated” for every user of every project; the default signing algorithm is ES256.
How to spot it without credentials
authorization_servers is {ref}.supabase.co/auth/v1 and scopes_supported is empty.
What it breaks in production
Any two MCP servers on one Supabase project accept each other's tokens — replay between them cannot be prevented by audience checking at all.
Check a Supabase-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp