Skip to main content

MCP authentication

The MCP server authenticates with OAuth 2.1 via Supabase Auth, with dynamic client registration so connectors like Claude and ChatGPT can self-onboard. The token you end up with is an ordinary Supabase JWT, and the server executes every query as that user — RLS applies to AI clients exactly as it does to humans. There is no service-role access from MCP tools.

Connecting a client​

Point your MCP client at the endpoint:

https://jionfqfmjinkrmzlsghf.supabase.co/functions/v1/mcp

(or the proxy, https://mcp.contentpipe.app). The discovery + OAuth handshake is automatic:

  1. The client makes an unauthenticated request.
  2. The server replies 401 with a WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource" header.
  3. The client fetches that metadata (served by the function itself) and discovers the Supabase authorization server.
  4. The client registers dynamically, sends you through the consent + login flow, and receives a token.
  5. Every subsequent tool call carries the bearer token; the server runs it as you.

Consent & identity providers​

The consent and login screens live in the Contentpipe web app. Supabase redirects to /oauth/consent?authorization_id=…, which round-trips through /login if you have no session, then approves or denies the grant.

GitHub and Google are the configured identity providers.

Provider status

GitHub and Google OAuth app credentials are still being wired up. Until they land, the login page is email/password only — which is enough to connect a client end-to-end (use a disposable, project-scoped account you control). This matches the API authentication guide.

Relationship to the data API​

MCP auth is the same Supabase Auth described in the API authentication guide — an OAuth-issued token is interchangeable with a password-grant token. If you're scripting against the database instead of driving an AI client, you don't need MCP at all; use the REST and workflow RPC surfaces with the same token.