feat(connectors): Supabase hosted MCP entry (TASK-242)

backend/__tests__/unit/services/hostedMcpEntry.test.js

@@ -24,6 +24,7 @@ const LINEAR_CAPTURE = require('../../fixtures/hostedMcp/linear-tools-list-2026-
 const ATLASSIAN_CAPTURE = require('../../fixtures/hostedMcp/atlassian-tools-list-2026-10-19.json');
 const AIRTABLE_CAPTURE = require('../../fixtures/hostedMcp/airtable-tools-list-2026-10-09.json');
 const SENTRY_CAPTURE = require('../../fixtures/hostedMcp/sentry-tools-list-2026-10-19.json');
+const SUPABASE_CAPTURE = require('../../fixtures/hostedMcp/supabase-tools-list-2026-10-19.json');
 
 const ENTRY_TEXT = 'ENTRY TEXT the pin agreed to.';
 const VENDOR_TEXT = 'VENDOR TEXT nobody reviewed.';
@@ -575,11 +576,11 @@ describe('the comparison is cached per row, and an outage is not cacheable', ()
 });
 
 describe('the shipped catalogue cannot land half-wired', () => {
-  test('ships Linear, Google Calendar, Atlassian, Airtable and Sentry, and lookup names the requested entry', () => {
+  test('ships the hosted-MCP catalogue and lookup names the requested entry', () => {
     // The catalogue is the one place that says what an instance offers before
     // any member has connected anything. Its ordering follows the build plan.
     expect(HOSTED_MCP_ENTRIES.map((entry) => entry.id)).toEqual([
-      'linear', 'google-calendar', 'atlassian', 'airtable', 'sentry',
+      'linear', 'google-calendar', 'atlassian', 'airtable', 'sentry', 'supabase',
     ]);
     const catalogue = [linear(), linear({ id: 'notion', title: 'Notion' })];
     expect(findHostedMcpEntry(catalogue, 'notion').title).toBe('Notion');
@@ -965,6 +966,48 @@ describe('the shipped catalogue cannot land half-wired', () => {
     const entry = linear();
     expect(hostedMcpToolName(entry, entry.tools[0])).toBe('linear.list_issues');
   });
+  test('the Supabase pin follows the capture and excludes spend, code, and credential tools', () => {
+    const capture = SUPABASE_CAPTURE;
+    const entry = findHostedMcpEntry(HOSTED_MCP_ENTRIES, 'supabase');
+    expect(entry.client).toBe('dcr');
+    expect(entry.resource).toBe(capture.server);
+    expect([...entry.scopes].sort()).toEqual(capture.scopeRequested.split(' ').sort());
+    expect(entry.revoke.endpoint).toBeUndefined();
+    expect(entry.revoke.page).toBe('https://supabase.com/dashboard/org/_/apps');
+    expect(capture.tokenShape.grantedScope).toBeNull();
+    expect(capture.tokenShape.hasRefreshToken).toBe(true);
+
+    const excluded = [
+      'get_cost', 'confirm_cost', 'create_project', 'pause_project',
+      'restore_project', 'deploy_edge_function', 'create_branch',
+      'execute_sql', 'apply_migration', 'query_logs', 'search_docs', 'get_publishable_keys',
+    ];
+    expect(capture.tools).toHaveLength(29);
+    expect(entry.tools).toHaveLength(17);
+    expect(capture.tools.filter((tool) => !entry.tools.some((pin) => pin.upstreamName === tool.name))
+      .map((tool) => tool.name).sort()).toEqual(excluded.sort());
+    const measured = new Map(capture.tools.map((tool) => [tool.name, tool]));
+    for (const tool of entry.tools) {
+      const found = measured.get(tool.upstreamName);
+      expect(found).toBeDefined();
+      expect(canonicalJson(tool.inputSchema)).toBe(canonicalJson(found.inputSchema));
+      expect(tool.annotations.readOnlyHint).toBe(found.annotations.readOnlyHint);
+      expect(tool.annotations.destructiveHint).toBe(found.annotations.destructiveHint);
+      expect(tool.class).toBe(found.annotations.readOnlyHint ? 'read' : 'write');
+    }
+    const branchWrites = ['delete_branch', 'merge_branch', 'reset_branch', 'rebase_branch'];
+    expect(entry.tools.filter((tool) => tool.class === 'write').map((tool) => tool.name).sort())
+      .toEqual([...branchWrites].sort());
+    for (const name of branchWrites) {
+      const tool = entry.tools.find((pin) => pin.name === name);
+      expect(tool.annotations.destructiveHint).toBe(true);
+      expect(tool.irreversible).toBe(true);
+    }
+    expect(entry.tools.find((tool) => tool.name === 'merge_branch').description)
+      .toContain('migrations and Edge Functions to production');
+    expect(entry.tools.find((tool) => tool.name === 'reset_branch').description)
+      .toContain('untracked data and schema changes');
+  });
 });
 
 // The three preconditions a vendor entry has to satisfy before the first one is

backend/integrations/hostedMcp/entries.ts

@@ -17,9 +17,11 @@ import { ATLASSIAN_ENTRY } from './atlassian';
 import { GOOGLE_CALENDAR_ENTRY } from './googleCalendar';
 import { LINEAR_ENTRY } from './linear';
 import { SENTRY_ENTRY } from './sentry';
+import { SUPABASE_ENTRY } from './supabase';
 
 export const HOSTED_MCP_ENTRIES: HostedMcpEntry[] = [
   LINEAR_ENTRY, GOOGLE_CALENDAR_ENTRY, ATLASSIAN_ENTRY, AIRTABLE_ENTRY, SENTRY_ENTRY,
+  SUPABASE_ENTRY,
 ];
 
 /**