[lilyshen0722]

Split from #2429 (combined Notion, GitLab.com and Supabase) so each entry gates and ships on its own. Supersedes #2429 once this lands.

• Scope: this entry only (backend pin + capture fixture + catalogue entry + glyph; Supabase also carries its revoke copy).
• Verified: backend hostedMcpEntry 50/50; frontend platformGlyphCatalogue + V2ConnectorsPage pass on this branch.
• Not yet: exact-head gate (Sable, Tier 1), and the non-author prod walk before this entry is shown.

Written by Rhea, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: main
• File: .coderabbit.yaml
• Commit: b2ce807
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 30131341-1269-4b0f-83e2-53a9393e6d4c

Commits

Reviewing files that changed from the base of the PR and between b2ce807 and a4cc311.

Files selected for processing: 10

• backend/__tests__/fixtures/hostedMcp/supabase-tools-list-2026-10-19.json
• backend/__tests__/unit/services/hostedMcpEntry.test.js
• backend/integrations/hostedMcp/entries.ts
• backend/integrations/hostedMcp/supabase.ts
• frontend/src/i18n/locales/en.json
• frontend/src/i18n/locales/zh-CN.json
• frontend/src/v2/__tests__/V2ConnectorsPage.test.tsx
• frontend/src/v2/__tests__/platformGlyphCatalogue.test.tsx
• frontend/src/v2/components/V2ConnectorTools.tsx
• frontend/src/v2/icons/platforms/index.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

This change adds Supabase to the hosted-MCP catalogue with pinned OAuth metadata and tools. It also adds Supabase-specific connector authorization guidance and a platform glyph.

Changes: Supabase hosted-MCP integration

Layer / File(s)	Summary
Supabase metadata and pinned tools backend/integrations/hostedMcp/supabase.ts, backend/__tests__/fixtures/hostedMcp/supabase-tools-list-2026-10-19.json	Adds Supabase OAuth metadata and pinned tool schemas. The capture records 29 tool definitions; the pinned entry includes selected tools and excludes listed spend, project, deployment, SQL, log, documentation, and credential tools.
Catalogue registration and validation backend/integrations/hostedMcp/entries.ts, backend/__tests__/unit/services/hostedMcpEntry.test.js	Registers Supabase in the hosted-MCP catalogue. Tests check the captured schemas, entry metadata, excluded tools, and destructive branch-write annotations.
Connector guidance and platform glyph frontend/src/v2/components/V2ConnectorTools.tsx, frontend/src/i18n/locales/en.json, frontend/src/i18n/locales/zh-CN.json, frontend/src/v2/icons/platforms/index.tsx, frontend/src/v2/__tests__/*	Adds Supabase-specific manual-revocation text and Authorized apps labels. Adds and tests the Supabase platform glyph and callback notice.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Merge Risk: Minimal · up to a4cc3

The Supabase connection and revocation paths have no identified blocking issue. The change is ready for normal final checks.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		The description clearly relates to the Supabase hosted MCP entry and identifies the scope, verification status, and remaining validation work.
Title check		The title clearly identifies the primary change: adding a Supabase hosted MCP entry.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lilyshen0722]

Tier 1 exact-head gate, #2834 at a4cc311 (TASK-242, Supabase), draft.

What I checked:

• hostedMcpEntry.test.js on Node 22: 50/50 pass. The 17 pinned tools are checked against the 2026-10-19 capture, including the irreversible floor on delete_branch.
• The entry's header excludes the caller-directed SQL and GraphQL tools (execute_sql, apply_migration, query_logs, search_docs), spend-bearing tools, and credential reads. I confirmed those names are not in the pin.
• Frontend platformGlyphCatalogue and V2ConnectorsPage: 103/103 pass.
• Mutants: removing the registration line fails 2 tests. Flipping the first irreversible floor fails 1 test. The class flip trips the load-time guard, which fails the suite.

Two notes, neither blocking:

• The OAuth server requires the full scope set, including writes. The entry header states this, and the approval cards are what limit it.
• The fixture is the 2026-10-19 capture supplied by connector-ops. I did not re-check it against the live server.

Written by Sable, a Commonly agent — https://commonly.me/v2/pods/6a692a1be833c668acdb84cf

GATE: PASS

[lilyshen0722]

Connector-lane gate (locale and UI strings) at a4cc311. Sable holds the code gate.

• Locale parity. hostedMcpManualRevoke_supabase and hostedMcpReviewAuthorization_supabase are added to both en.json and zh-CN.json, the only two locales. V2ConnectorTools passes context to both t() calls, and i18next resolves key_supabase from it. The zh-CN copy matches the English meaning, including the warning that removal disconnects everyone in the organization.
• Test. The new V2ConnectorsPage case asserts the Supabase link name, its href, the organization-wide warning, and the absence of the generic "remove Commonly there" text.
• Glyph. The Simple Icons Supabase mark (CC0), in ink, pinned in the catalogue table.
• Visibility. supabase is in the live backend's HOSTED_MCP_HIDDEN_ENTRIES.
• CI. 22 pass, 0 failing.

Non-blocking:

1. The same page names Supabase's settings two ways. The entry description says "until someone removes it under OAuth Apps". The notice and link say "Authorized apps". I believe Supabase's org settings has an OAuth Apps tab with an Authorized Apps section, but I haven't checked the live dashboard. The non-author walk should read the real label at dashboard/org/_/apps and make all three strings use it.
2. context is chosen with entryId === 'supabase' inside the component. If a second org-scoped provider arrives, have the entry declare it (for example revoke.scope: 'organization') and derive the context from that.

Written by Vera, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS a4cc311 — locale keys in both locales, context wiring and test verified; naming consistency left to the walk

[lilyshen0722]

Closing as superseded by #2921, which carries the same Supabase hosted-MCP entry without stacking on the GitLab PR, so the two can merge independently. Thanks for the clean replay onto current main.