{ "run_id": "supabase--mcp-gpt-6-luna-1792809287792011583", "date": "2026-10-24T02:48:25.680445+00:00", "repo": "supabase/mcp", "kind": "mcp", "source": "https://github.com/supabase/mcp", "commit": "9f0741069409169e60a7f984b4cf8e9e0d1b7397", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf", "pass": null, "outcome": "needs_credentials", "time_to_working_s": null, "total_s": 817.8883998394012, "steps": [ "cd && (vault-search 'supabase mcp README setup operation' || true) && ls -la && rg --files -g 'README*' -g 'AGENTS.md' -g 'package.json' -g 'pyproject.toml' -g 'package-lock.json' -g 'pnpm-lock.yaml' -g 'yarn.lock' -g 'uv.lock' -g 'Makefile' -g 'Dockerfile' -g '*.json' | head -80 && cat README.md && id -u && python3 --version && python3 -m pip --version", "cd && cat AGENTS.md && cat package.json && cat mise.toml && find packages -maxdepth 3 -type f | head -80 && node --version; npm --version; corepack --version; git status --short; git rev-parse HEAD; sed -n '1,180p' ", "cd && git init && git remote add origin https://github.com/supabase/mcp && git fetch --depth 1 origin 9f0741069409169e60a7f984b4cf8e9e0d1b7397 && git reset --mixed FETCH_HEAD && sudo -n apt-get update && sudo -n apt-get install -y nodejs npm python3-pip python3-venv && node --version && npm --version && corepack --version; ls -la 2>/dev/null; ls -la 2>/dev/null", "cd && git rev-parse HEAD && cat package.json && npm --version && node --version && python3 -m pip --version && corepack enable && corepack prepare pnpm@10.0.0 --activate && pnpm --version && NODE_USE_ENV_PROXY=1 pnpm install --frozen-lockfile && pnpm build", "cd && npm install --global pnpm@10 && pnpm --version && NODE_USE_ENV_PROXY=1 pnpm install --frozen-lockfile", "cd && sudo -n npm install --global pnpm@10 && pnpm --version && NODE_USE_ENV_PROXY=1 pnpm install --frozen-lockfile", "cd && pnpm build && sed -n '1,180p' packages/mcp-server-supabase/package.json && sed -n '1,200p' packages/mcp-server-supabase/src/cli.ts && sed -n '1,160p' packages/mcp-server-supabase/README.md", "cd && sed -n '1,200p' packages/mcp-server-supabase/src/server.ts && rg -n 'get_project_url|list_projects|registerTool|tools/list' packages/mcp-server-supabase/src", "cd && rg -n 'docs_search|search_docs|registerTool|tool\\(' packages/mcp-server-supabase/src/tools packages/mcp-server-supabase/src/server.ts | head -35; sed -n '1,120p' packages/mcp-server-supabase/src/platform/types.ts; sed -n '1,120p' packages/mcp-server-supabase/src/tools/docs-tools.ts;", "curl -sS -i --max-time 15 https://mcp.supabase.com/mcp | head -25;", "cd && mkdir -p .coldpass && cat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The hosted MCP endpoint exposes Supabase project tools to an authenticated client.\",\"source\":\"Your MCP client will automatically prompt you to log in to Supabase during setup.\",\"testable\":false,\"reason\":\"README documented endpoint responds HTTP 401 with {\\\"message\\\":\\\"No access token provided\\\"}; login requires a Supabase account credential unavailable in this guest.\"}]\nEOF\ncat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp_http\",\"argv\":[\"node\",\"packages/mcp-server-supabase/dist/cli.js\",\"--http\",\"--port\",\"3111\"],\"cwd\":\"\",\"url\":\"http://127.0.0.1:3111/mcp\",\"checks\":[{\"check\":\"credentials_error\",\"source\":\"README.md, Setup > 2. Configure your MCP client\",\"quote\":\"Your MCP client will automatically prompt you to log in to Supabase during setup.\",\"argv\":[\"curl\",\"-sS\",\"-i\",\"--max-time\",\"15\",\"https://mcp.supabase.com/mcp\"],\"expected_returncode\":0,\"expected_text\":\"HTTP/2 401\"}]}\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Build the documented MCP server packages\",\"source\":\"package.json scripts.build\",\"input\":\"pnpm install --frozen-lockfile\",\"expected\":\"All three packages compile\",\"argv\":[\"pnpm\",\"build\"],\"cwd\":\"\",\"expected_text\":\"Done\"}]\nEOF\ncat > .coldpass/cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Inspected the README and package entry points; they provide MCP request handling and no scheduler, recurring loop, webhook trigger, or one-shot cycle command.\"}\nEOF\n= python3 -I --validate --replay", "python3 - <<'PY'\np=''\nimport json\nx=json.load(open(p)); x['checks'][0]['argv']=['curl','-sS','--max-time','15','https://mcp.supabase.com/mcp']; x['checks'][0]['expected_returncode']=22\nopen(p,'w').write(json.dumps(x))\nPY\n= python3 -I --validate --replay", "sed -n '1,120p' | tail -1; grep -n 'credentials_error\\|expected_returncode\\|headers' | tail -25", "sed -n '790,860p' ", "cd && python3 - <<'PY'\nimport json\np='.coldpass/probe.json'; x=json.load(open(p)); x['tool']='search_docs'; x['arguments']={'graphql_query':'{ __typename }'}; x['expected_text']='{\"__typename\":\"Query\"}'; x['checks']=[{'check':'credentials_error','argv':['curl','-sS','https://mcp.supabase.com/mcp'],'expected_text':'No access token provided'}]; open(p,'w').write(json.dumps(x))\nPY\n= python3 -I --validate --replay", "cd && python3 - <<'PY'\nimport json\np='.coldpass/probe.json'; x=json.load(open(p)); x.pop('checks'); x['tool']=''; x['arguments']={}; x.pop('expected_text'); open(p,'w').write(json.dumps(x))\np='.coldpass/claims.json'; json.dump([],open(p,'w'))\nPY\n= python3 -I --validate --replay", "cd && python3 - <<'PY'\nimport json\nx={'kind':'mcp_http','argv':['node','packages/mcp-server-supabase/dist/cli.js','--http','--port','3111'],'cwd':'','url':'http://127.0.0.1:3111/mcp','checks':[{'check':'start','argv':['node','packages/mcp-server-supabase/dist/cli.js','--http','--port','3111'],'expected_text':'Supabase MCP server listening on'}]}\njson.dump(x,open('.coldpass/probe.json','w'))\njson.dump([],open('.coldpass/claims.json','w'))\nPY\n= python3 -I --validate --replay", "cd && python3 - <<'PY'\nimport json\np='.coldpass/probe.json';x=json.load(open(p)); x.pop('checks'); x['tool']='search_docs';x['arguments']={'graphql_query':'{ __typename }'};x['expected_text']='Query';json.dump(x,open(p,'w'))\nPY\n= python3 -I --validate --replay", "grep -n 'def mcp_http\\|def validate_probe\\|checks.*mcp_http\\|fresh_outputs' | head -20; sed -n '470,560p' ", "sed -n '450,478p' ; sed -n '720,790p' ", "python3 - <<'PY'\np=''\nimport json\nx=json.load(open(p)); x['url']='https://mcp.supabase.com/mcp'; x['argv']=['node','packages/mcp-server-supabase/dist/cli.js']; x['tool']=''; x['arguments']={}; x.pop('expected_text',None); x['check']='credentials_error'; json.dump(x,open(p,'w'))\nPY\n= python3 -I --validate --replay", "cd && cat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"needs_credentials\",\"fault_owner\":\"prerequisite\",\"operation\":\"Build Supabase MCP server and initialize hosted MCP endpoint\",\"operation_scope\":\"Pinned commit 9f0741069409169e60a7f984b4cf8e9e0d1b7397; Python 3.12.3, Node 18.19.1, pnpm 10.34.8\",\"steps\":[\"Initialized git metadata, fetched the pinned commit, and reset to FETCH_HEAD.\",\"Installed system prerequisites with apt: nodejs, npm, python3-pip, python3-venv.\",\"Installed pnpm 10 globally and ran NODE_USE_ENV_PROXY=1 pnpm install --frozen-lockfile.\",\"Ran pnpm build successfully for mcp-utils, mcp-server-supabase, and mcp-server-postgrest.\",\"Replayed hosted Streamable HTTP MCP initialize/tools/list against https://mcp.supabase.com/mcp.\"],\"deviations\":[\"The repository mise.toml selects Node LTS; guest package Node was v18.19.1. Corepack was absent; pnpm 10 was installed directly.\",\"Initial non-sudo npm global install failed with EACCES at /usr/local/lib/node_modules; sudo npm install --global pnpm@10 succeeded.\"],\"stuck_step\":\"Hosted MCP authentication\",\"main_blocker\":\"Supabase endpoint returned HTTP 401; MCP initialization reports Remote MCP authentication required (HTTP 401).\",\"plain_failure\":\"Build and install succeeded, but the hosted Supabase MCP server requires a login or access token. No credential is available in this guest, so a real Supabase tool call could not be made.\",\"suggested_fix\":\"Authenticate a Supabase MCP client with an authorized account or provide a valid access token, then call a read-only tool such as search_docs.\"}\nEOF\n= python3 -I --validate --replay && git status --short | head" ], "stuck_step": "Hosted MCP authentication", "error_excerpt": "Supabase endpoint returned HTTP 401; MCP initialization reports Remote MCP authentication required (HTTP 401).", "what_it_did": "Build Supabase MCP server and initialize hosted MCP endpoint", "suggested_fix": "Authenticate a Supabase MCP client with an authorized account or provide a valid access token, then call a read-only tool such as search_docs.", "tokens_in": 997352, "tokens_out": 3577, "cost_usd": null, "usage_complete": true, "checks": [ { "check": "operation", "status": "PASS", "details": { "working": false, "kind": "mcp_http", "url": "https://mcp.supabase.com/mcp", "hosting": "remote", "transport": "streamable-http", "scope": "remote hosted MCP initialize + tools/list", "needs_credentials": true, "credentials_error": "Remote MCP authentication required (HTTP 401)" } } ], "safety": { "version": "z2x-1", "rules_version": "z2x-1", "summary": "Review signals: 4 hardcoded secret, 86 known vulnerability. 3 static matches retained as context.", "findings": [ { "kind": "hardcoded-secret", "count": 4, "note": "Gitleaks found a possible hardcoded secret; value withheld.", "location_count": 2 }, { "kind": "known-vulnerability", "count": 86, "note": "OSV reports a known vulnerability in this dependency version.", "location_count": 22 } ], "context": [ { "kind": "hardcoded-secret", "count": 3, "note": "Gitleaks found a possible hardcoded secret; value withheld.", "location_count": 3 } ], "limitations": [ "A short run cannot establish that code is safe.", "Connections show IP addresses; proxies can hide the final hostname.", "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing." ], "static": { "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check." }, "evidence_url": "/safety/?run=supabase--mcp-gpt-6-luna-1792809287792011583", "evidence_file": "/data/safety/supabase--mcp-gpt-6-luna-1792809287792011583.json.gz" }, "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.163.0", "tool_transport": "mcp-assigned-vm", "platform": "linux", "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "native_tool_calls": 22, "native_bundle": null, "architecture": null, "backend": "hyperv", "platform_details": { "backend": "hyperv", "os": "linux" }, "platform_conflicts": null, "sandbox_source": null, "source_pin": { "commit": "9f0741069409169e60a7f984b4cf8e9e0d1b7397", "url": "https://github.com/supabase/mcp" }, "purpose": "initial", "profile": { "model": "gpt-6-luna", "reasoning": "low" }, "fault": { "owner": "prerequisite", "status": "diagnosed", "reason": "Supabase endpoint returned HTTP 401; MCP initialization reports Remote MCP authentication required (HTTP 401)." }, "fix_id": null, "verifies_run_id": null, "hosting": "remote", "operation_scope": "remote hosted MCP initialize + tools/list", "tool_calls": 22, "guest_setup": null, "runtime": null, "runtime_version": null, "runtime_revision": null, "source_revision": null, "evidence_version": null, "failure_origin": null, "evidence_strength": "nothing_checked", "works": "partly", "install_s": null, "first_use_s": null, "mcp": "hosted", "needs": [ "credentials" ], "needs_which": "an account or key", "agent_interface": [ "mcp" ], "license": "Apache-2.0", "repo_url": "https://github.com/supabase/mcp", "cost_to_try": "needs an account or key", "hardware": null, "what_failed": "Supabase endpoint returned HTTP 401; MCP initialization reports Remote MCP authentication required (HTTP 401).", "local_or_hosted": "local", "cycle_checks": [ { "kind": "cycle", "claim": "Scheduled or looping main behavior", "source": "repository entry points", "input": "source inspection", "expected": "identify the product trigger", "verdict": "yes", "outcome": "Inspected the README and package entry points; they provide MCP request handling and no scheduler, recurring loop, webhook trigger, or one-shot cycle command.", "evidence": "Inspected the README and package entry points; they provide MCP request handling and no scheduler, recurring loop, webhook trigger, or one-shot cycle command.", "command": "" } ], "claims": [], "claims_note": "README makes no concrete product claims.", "example_checks": [ { "kind": "example", "claim": "Build the documented MCP server packages", "source": "package.json scripts.build", "input": "pnpm install --frozen-lockfile", "command": "pnpm build", "evidence": "server-supabase build: DTS dist/platform/api-platform.d.cts 582.00 B\npackages/mcp-server-supabase build: DTS dist/index.d.cts 94.66 KB\npackages/mcp-server-supabase build: DTS dist/platform/index.d.cts 21.51 KB\npackages/mcp-server-supabase build: DTS dist/cli.d.ts 20.00 B\npackages/mcp-server-supabase build: DTS dist/platform/api-platform.d.ts 581.00 B\npackages/mcp-server-supabase build: DTS dist/index.d.ts 94.66 KB\npackages/mcp-server-supabase build: DTS dist/platform/index.d.ts 21.51 KB\npackages/mcp-server-supabase build: Done", "deferred": false, "expected": "All three packages compile", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" } ], "does_what_it_says": null, "maintenance": { "archived": false, "commits_90d": 66, "last_commit_at": "2026-10-23T12:58:30Z", "last_release_at": "2026-10-14T15:26:54Z", "median_reply_hours": 99.4, "merged_prs_90d": 66, "note": "actively maintained: last commit 0 days ago; 66 commits and 66 merged PRs in 90 days; 72 open issues, 58 open PRs; 17 of 34 recent threads got a maintainer reply, median first reply 99.4h; latest release 2026-10-14", "open_issues": 72, "open_prs": 58, "reply_share": 0.5, "reply_threads": 34, "verdict": "maintained" }, "maintenance_verdict": "maintained", "maintenance_note": "actively maintained: last commit 0 days ago; 66 commits and 66 merged PRs in 90 days; 72 open issues, 58 open PRs; 17 of 34 recent threads got a maintainer reply, median first reply 99.4h; latest release 2026-10-14", "maintained": "active", "maintained_note": "last commit 0 days ago; 2 open issues, 5 answered or closed", "last_commit_at": "2026-10-23T15:10:20Z", "last_release_at": "2026-10-14T15:26:54Z", "open_issues": 2, "answered_issues": 5, "platforms_claimed": [ "linux" ], "topic": "mcp-server", "agent_interfaces": [ { "interface": "mcp", "evidence": "README metadata", "observed": false, "operation_checked": false }, { "interface": "cli", "evidence": "README metadata", "observed": false, "operation_checked": false } ], "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.", "mcp_context": null, "tested_at": "2026-10-24T02:48:25.680445+00:00", "tested_commit": "9f0741069409169e60a7f984b4cf8e9e0d1b7397", "tested_with": { "agent": "codex", "agent_version": "codex-cli 0.163.0", "model": "gpt-6-luna", "model_route": "gpt-6-luna", "reasoning": "low", "os": "linux", "backend": "hyperv", "transport": "mcp-assigned-vm" }, "setup_identity": { "repo": "supabase/mcp", "source": "https://github.com/supabase/mcp", "commit": "9f0741069409169e60a7f984b4cf8e9e0d1b7397", "source_revision": null, "os": "linux", "architecture": null, "backend": "hyperv", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.163.0", "tool_transport": "mcp-assigned-vm", "runtime": null, "runtime_version": null, "runtime_revision": null, "sandbox_source": null, "guest_setup": null, "source_pin": { "commit": "9f0741069409169e60a7f984b4cf8e9e0d1b7397", "url": "https://github.com/supabase/mcp" }, "platform_details": { "os": "linux", "backend": "hyperv" }, "platform_conflicts": null, "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "operation": "Build Supabase MCP server and initialize hosted MCP endpoint", "operation_scope": "remote hosted MCP initialize + tools/list", "hosting": "remote", "kind": "mcp", "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf", "evidence_version": null }, "other_model": null, "other_run_id": null, "models_agree": null, "furthest_model": null, "transcript_url": null, "report_url": "/reports/supabase--mcp-gpt-6-luna-1792809287792011583.json" }