feat(connectors): add Supabase hosted MCP entry (TASK-323)

backend/__tests__/unit/services/hostedMcpEntry.test.js

@@ -27,6 +27,7 @@ const AIRTABLE_AS_CAPTURE = require('../../fixtures/hostedMcp/airtable-authoriza
 const SENTRY_CAPTURE = require('../../fixtures/hostedMcp/sentry-tools-list-2026-10-19.json');
 const NOTION_CAPTURE = require('../../fixtures/hostedMcp/notion-tools-list-2026-10-19.json');
 const GITLAB_CAPTURE = require('../../fixtures/hostedMcp/gitlab-tools-list-2026-10-19.json');
+const SUPABASE_CAPTURE = require('../../fixtures/hostedMcp/supabase-tools-list-2026-10-19.json');
 
 const ENTRY_TEXT = 'ENTRY TEXT the pin agreed to.';
 const VENDOR_TEXT = 'VENDOR TEXT nobody reviewed.';
@@ -582,7 +583,7 @@ describe('the shipped catalogue cannot land half-wired', () => {
     // The catalogue is the one place that says what an instance offers before
     // any member has connected anything. Its ordering follows the build plan.
     expect(HOSTED_MCP_ENTRIES.map((entry) => entry.id)).toEqual([
-      'linear', 'google-calendar', 'atlassian', 'airtable', 'sentry', 'notion', 'gitlab',
+      'linear', 'google-calendar', 'atlassian', 'airtable', 'sentry', 'notion', 'gitlab', 'supabase',
     ]);
     const catalogue = [linear(), linear({ id: 'notion', title: 'Notion' })];
     expect(findHostedMcpEntry(catalogue, 'notion').title).toBe('Notion');
@@ -830,6 +831,49 @@ describe('the shipped catalogue cannot land half-wired', () => {
     }
   });
 
+  test('the Supabase pin follows the capture and excludes spend, code, and credential tools', () => {
+    const capture = SUPABASE_CAPTURE;
+    const entry = findHostedMcpEntry(HOSTED_MCP_ENTRIES, 'supabase');
+    expect(entry.client).toBe('dcr');
+    expect(entry.resource).toBe(capture.server);
+    expect([...entry.scopes].sort()).toEqual(capture.scopeRequested.split(' ').sort());
+    expect(entry.revoke.endpoint).toBeUndefined();
+    expect(entry.revoke.page).toBe('https://supabase.com/dashboard/org/_/apps');
+    expect(capture.tokenShape.grantedScope).toBeNull();
+    expect(capture.tokenShape.hasRefreshToken).toBe(true);
+
+    const excluded = [
+      'get_cost', 'confirm_cost', 'create_project', 'pause_project',
+      'restore_project', 'deploy_edge_function', 'create_branch',
+      'execute_sql', 'apply_migration', 'query_logs', 'search_docs', 'get_publishable_keys',
+    ];
+    expect(capture.tools).toHaveLength(29);
+    expect(entry.tools).toHaveLength(17);
+    expect(capture.tools.filter((tool) => !entry.tools.some((pin) => pin.upstreamName === tool.name))
+      .map((tool) => tool.name).sort()).toEqual(excluded.sort());
+    const measured = new Map(capture.tools.map((tool) => [tool.name, tool]));
+    for (const tool of entry.tools) {
+      const found = measured.get(tool.upstreamName);
+      expect(found).toBeDefined();
+      expect(canonicalJson(tool.inputSchema)).toBe(canonicalJson(found.inputSchema));
+      expect(tool.annotations.readOnlyHint).toBe(found.annotations.readOnlyHint);
+      expect(tool.annotations.destructiveHint).toBe(found.annotations.destructiveHint);
+      expect(tool.class).toBe(found.annotations.readOnlyHint ? 'read' : 'write');
+    }
+    const branchWrites = ['delete_branch', 'merge_branch', 'reset_branch', 'rebase_branch'];
+    expect(entry.tools.filter((tool) => tool.class === 'write').map((tool) => tool.name).sort())
+      .toEqual([...branchWrites].sort());
+    for (const name of branchWrites) {
+      const tool = entry.tools.find((pin) => pin.name === name);
+      expect(tool.annotations.destructiveHint).toBe(true);
+      expect(tool.irreversible).toBe(true);
+    }
+    expect(entry.tools.find((tool) => tool.name === 'merge_branch').description)
+      .toContain('migrations and Edge Functions to production');
+    expect(entry.tools.find((tool) => tool.name === 'reset_branch').description)
+      .toContain('untracked data and schema changes');
+  });
+
   test('the Linear pin is the measured list minus caller-chosen fetch paths', () => {
     // The latest capture `connector-ops` took (2026-10-14) is committed beside
     // this suite, so the pin's schemas are compared with the measurement rather

backend/integrations/hostedMcp/entries.ts

@@ -19,11 +19,13 @@ import { GITLAB_ENTRY } from './gitlab';
 import { LINEAR_ENTRY } from './linear';
 import { NOTION_ENTRY } from './notion';
 import { SENTRY_ENTRY } from './sentry';
+import { SUPABASE_ENTRY } from './supabase';
 
 export const HOSTED_MCP_ENTRIES: HostedMcpEntry[] = [
   LINEAR_ENTRY, GOOGLE_CALENDAR_ENTRY, ATLASSIAN_ENTRY, AIRTABLE_ENTRY, SENTRY_ENTRY,
   NOTION_ENTRY,
   GITLAB_ENTRY,
+  SUPABASE_ENTRY,
 ];
 
 /**