{
 "slug": "supabase",
 "name": "Supabase",
 "url": "https://supabase.com",
 "domain": "supabase.com",
 "category": "databases",
 "category_name": "Databases",
 "tested_at": "2026-10-16",
 "run": "20261016T061103Z",
 "draft": false,
 "reviewed": true,
 "owner_verified": null,
 "origin": "editorial",
 "history": [
  {
   "run": "20261001T211834Z",
   "date": "2026-10-01",
   "level": 1,
   "engine": {
    "runner": "omp",
    "model": null,
    "driver": null,
    "signed": true,
    "inbox": [
     "agentdrives.com"
    ],
    "robots": "start"
   },
   "drives": 2
  },
  {
   "run": "20261006T092205Z",
   "date": "2026-10-06",
   "level": 1,
   "engine": {
    "runner": "omp",
    "model": "claude-opus-5-5",
    "driver": 2,
    "signed": true,
    "inbox": [
     "agentdrives.com"
    ],
    "robots": "start"
   }
  },
  {
   "run": "20261016T061103Z",
   "date": "2026-10-16",
   "level": 1,
   "engine": {
    "runner": "omp",
    "model": "claude-opus-5-5",
    "driver": 4,
    "signed": true,
    "inbox": [
     "agentdrives.com"
    ],
    "robots": "skip"
   }
  }
 ],
 "level": 1,
 "level_name": "Needs a person",
 "level_selfhost": null,
 "entry": "closed",
 "door": {
  "passed": 1,
  "tries": 3,
  "self_start": false
 },
 "badges": [],
 "stages": [
  {
   "key": "in",
   "label": "Access",
   "state": "part",
   "text": "Gets in 1 of 3 drives"
  },
  {
   "key": "work",
   "label": "Use",
   "state": "yes",
   "text": "Work done: 100% of the core"
  },
  {
   "key": "pay",
   "label": "Pay",
   "state": "no",
   "text": "A person has to buy: a CAPTCHA at checkout",
   "value": "person",
   "route": "portal",
   "why": "captcha"
  },
  {
   "key": "leave",
   "label": "Leave",
   "state": "yes",
   "text": "Nothing to cancel; deletes its data, but the login stays",
   "at": "delete",
   "left": "data_only"
  }
 ],
 "outcomes": [
  {
   "key": "find",
   "label": "Find",
   "state": "yes",
   "text": "Docs agents can read: llms.txt, an OpenAPI and an MCP server; a docs page for each core task",
   "have": [
    "llms_txt",
    "openapi",
    "mcp"
   ],
   "docs": "complete"
  },
  {
   "key": "access",
   "label": "Access",
   "state": "part",
   "text": "Gets in 1 of 3 drives",
   "stage": "in"
  },
  {
   "key": "use",
   "label": "Use",
   "state": "yes",
   "text": "Work done: 100% of the core",
   "stage": "work"
  },
  {
   "key": "pay",
   "label": "Pay",
   "state": "no",
   "text": "A person has to buy: a CAPTCHA at checkout",
   "value": "person",
   "route": "portal",
   "why": "captcha",
   "stage": "pay"
  },
  {
   "key": "leave",
   "label": "Leave",
   "state": "yes",
   "text": "Nothing to cancel; deletes its data, but the login stays",
   "at": "delete",
   "left": "data_only",
   "stage": "leave"
  }
 ],
 "access": [
  {
   "key": "person",
   "label": "A person sets it up",
   "routes": [],
   "minutes": null,
   "core": null
  }
 ],
 "minutes": null,
 "next": {
  "to": 3,
  "text": "Next: let an agent get in on its own in every drive"
 },
 "stop": "pay",
 "core": "10/10",
 "scores": {
  "coverage": 93,
  "reliability": 88,
  "resilience": 77,
  "setup": 100,
  "surface_coverage": null,
  "docs_accuracy": null,
  "docs_completeness": null
 },
 "parts": {
  "holds_up": 82,
  "docs_match": null,
  "setup": 100,
  "security": "private",
  "standards": [
   {
    "standard": "MCP",
    "state": "current",
    "behind": null,
    "value": "2026-07-28"
   },
   {
    "standard": "MCP discovery",
    "state": "current",
    "behind": null,
    "value": "ok"
   },
   {
    "standard": "MCP client registration",
    "state": "behind",
    "behind": null,
    "value": "dcr"
   },
   {
    "standard": "OpenAPI",
    "state": "behind",
    "behind": 2,
    "value": "3.0.0"
   }
  ]
 },
 "reliability_method": "pass^k",
 "resilience": {
  "parts": {
   "error_legibility": 97,
   "recovery": 100,
   "idempotency": 33
  },
  "summary": {
   "error_legibility": "clear",
   "recovery": "good",
   "idempotency": "risky",
   "rate_limits": "none-seen",
   "notes": "Errors named the field or the fix (PostgREST codes, db_pass, Invalid/Unregistered API key, the CLI's repair command); Storage bodies disagree with the HTTP status. Repeated REST creates duplicate rows (no idempotency key); 20 quick Management API GETs all 200 with X-RateLimit headers (limit 120)."
  }
 },
 "stress": [
  {
   "capability": "Query/manage data via auto-generated REST API",
   "probe": "missing required column",
   "outcome": "{\"code\":\"23502\",\"details\":\"Failing row contains (10, null, no title, null, 16 Oct 2026 06:43:51.190741+00, null, null).\",\"hint\":null,\"message\":\"null value in column \\\"title\\\" of relation \\\"notes\\\" viol",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Query/manage data via auto-generated REST API",
   "probe": "unknown table",
   "outcome": "{\"code\":\"PGRST205\",\"details\":null,\"hint\":null,\"message\":\"Could not find the table 'public.nosuchtable' in the schema cache\"}\nHTTP:404",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Create and run a Postgres project with tables",
   "probe": "create project missing db_pass",
   "outcome": "{\"message\":\"db_pass: Invalid input: expected string, received undefined\"}\nHTTP:400",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Create and run a Postgres project with tables",
   "probe": "well-formed project ref that does not exist",
   "outcome": "{\"message\":\"Not Found\"}\nHTTP:404",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Upload, store and serve files (buckets)",
   "probe": "repeat a create (same bucket twice)",
   "outcome": "{\"statusCode\":\"409\",\"error\":\"Duplicate\",\"message\":\"The resource already exists\",\"code\":\"BucketAlreadyExists\"}\nHTTP:400",
   "grade": "clear",
   "idempotent": "yes",
   "rate_limit": null
  },
  {
   "capability": "Query/manage data via auto-generated REST API",
   "probe": "repeat a create (same row body twice, no key)",
   "outcome": "both 201/201; count -> [{\"count\":2}] (duplicated; no Idempotency-Key support documented; upsert via Prefer: resolution=merge-duplicates on a unique key is the documented way)",
   "grade": "clear",
   "idempotent": "no",
   "rate_limit": null
  },
  {
   "capability": "Query/manage data via auto-generated REST API",
   "probe": "bad API key",
   "outcome": "{\"message\":\"Invalid API key\",\"hint\":\"Double check your API key.\"}\nHTTP:401",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Create and run a Postgres project with tables",
   "probe": "bad Management API token",
   "outcome": "{\"message\":\"JWT could not be decoded\"}\nHTTP:401",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Create and run a Postgres project with tables",
   "probe": "burst of 20 GET /v1/organizations",
   "outcome": "codes ['200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200', '200']; headers ['x-ratelimit-limit: 120', 'x-ratelimit-rema",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": "none-seen"
  },
  {
   "capability": "Upload, store and serve files (buckets)",
   "probe": "interrupt a resumable upload after the first chunk",
   "outcome": "{\"statusCode\":\"404\",\"error\":\"not_found\",\"message\":\"Object not found\",\"code\":\"NoSuchKey\"}\nHTTP:400 (object not visible until complete: consistent)",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  },
  {
   "capability": "Query/manage data via auto-generated REST API",
   "probe": "revoked key",
   "outcome": "{\"message\":\"Unregistered API key\",\"hint\":\"Double check the provided API key as it is not registered for this project.\"}\nHTTP:401",
   "grade": "clear",
   "idempotent": null,
   "rate_limit": null
  }
 ],
 "surface_audit": null,
 "coverage_core": 100,
 "after_wall": null,
 "coverage_source": "computed",
 "driver": {
  "version": 4,
  "model": "claude-opus-5-5",
  "profile": "full",
  "assisted": false,
  "handoff": false,
  "prompt_sha": "365f93123295",
  "kb_version": "3+overlay-83f4487de6",
  "identity": "e8a92f24a9a8"
 },
 "methodology": 15,
 "rules_date": "2026-10-15",
 "engine": {
  "runner": "omp",
  "model": "claude-opus-5-5",
  "driver": 4,
  "signed": true,
  "inbox": [
   "agentdrives.com"
  ],
  "robots": "skip"
 },
 "same_level_drives": 4,
 "drives": 4,
 "works_assisted": null,
 "freshness": "fresh",
 "nothing_to_pay": false,
 "core_gated": false,
 "profiles": {},
 "agent_check": null,
 "agent_pass": null,
 "who_gets_in": {
  "server": {
   "state": "closed"
  },
  "signed": {
   "state": "page",
   "kind": "signup",
   "at": "2026-10-16"
  },
  "browser": {
   "state": "unknown",
   "measured": false
  },
  "our_key": "pending",
  "robots": null,
  "tip": false
 },
 "ladder": {
  "docs": {
   "status": "headless",
   "note": "llms.txt, OpenAPI 3.0.0 (169 ops), markdown docs via Accept: text/markdown and .md URLs, AI Catalog listing the MCP server."
  },
  "signup": {
   "status": "browser",
   "note": "Continue with GitHub in the browser (scope user:email only), no CAPTCHA on that path. Email + password sign-up showed a visible hCaptcha puzzle on submit, so that way stopped.",
   "way": "device_login"
  },
  "verify": {
   "status": "n/a",
   "note": "GitHub sign-in needs no email verification."
  },
  "credentials": {
   "status": "browser",
   "note": "Personal access token made on the dashboard Access Tokens page (no API to create one). MCP OAuth (DCR + consent page) and the CLI login (code shown in a signed-in browser) also need a browser once. Project secret keys are then created headless via POST /v1/projects/{ref}/api-keys.",
   "via": ""
  },
  "first_call": {
   "status": "headless",
   "note": "GET /v1/organizations and /v1/profile with the PAT, 200.",
   "route": "account"
  },
  "first_action": {
   "status": "headless",
   "note": "POST /v1/projects created a healthy Free project in seconds; table created via /database/query. The Free organization itself had to be created in the browser first."
  },
  "pay": {
   "status": "blocked",
   "grade": "P1",
   "rails": [
    "card (Stripe Elements in the dashboard)"
   ],
   "rail_ids": [
    "stripe-elements"
   ],
   "first_party": false,
   "rail_scope": "none",
   "trial_path": "free tier",
   "route": "portal",
   "checkout": {
    "reached": "plan_page",
    "processor": "stripe_elements",
    "captcha": "visible",
    "three_ds": "not_seen",
    "card_form": false,
    "phone_field": "none",
    "wallets": [],
    "rail_offer": "none",
    "price": "25.00",
    "currency": "USD",
    "period": "month",
    "plan": "Pro",
    "last_button": "Confirm upgrade"
   },
   "person": "captcha",
   "ours": "no_card",
   "note": "No 402, x402 or MPP on any Supabase host (pay_probe, pay_tx: nothing paid). Plans change only in the dashboard: Billing > Change subscription plan > Upgrade to Pro showed 'Charge today $25.00' with Stripe.js loaded, and a visible hCaptcha puzzle opened at once. The Management API only manages project add-ons; no plan change. Listed in the Stripe Projects catalog (not confirmed by us)."
  },
  "cancel": {
   "status": "n/a",
   "note": "Nothing to cancel: our agent used the free plan.",
   "docs_note": "Nothing to cancel: the drive used the Free plan. Docs (Manage your subscription): downgrade in the dashboard, takes effect immediately, unused time credited.",
   "docs_grade": "",
   "nothing": "free_plan"
  },
  "delete": {
   "status": "blocked",
   "note": "Projects (API), the organization (dashboard), keys, tokens and the MCP grant were all deleted and refused afterwards, and the GitHub grant was revoked. The Supabase account itself has no delete option in the dashboard or the support form's issue list; its session still opened /dashboard/account/me afterwards.",
   "left": "data_only",
   "after_hours": null,
   "account": true
  }
 },
 "routes": [
  {
   "route": "local",
   "offered": "documented",
   "tried": false,
   "not_tried": "policy",
   "result": null,
   "wall": null,
   "person": null,
   "brings": null,
   "fresh": null,
   "minutes": null
  },
  {
   "route": "claimable",
   "offered": "documented",
   "tried": false,
   "not_tried": "no_kit",
   "result": null,
   "wall": null,
   "person": null,
   "brings": null,
   "fresh": null,
   "minutes": null
  },
  {
   "route": "email_password",
   "offered": "seen",
   "tried": true,
   "not_tried": null,
   "result": "walled",
   "wall": {
    "type": "challenge",
    "owner": "product"
   },
   "person": "each",
   "brings": "inbox",
   "fresh": true,
   "minutes": 2
  },
  {
   "route": "sso_github",
   "offered": "seen",
   "tried": true,
   "not_tried": null,
   "result": "in",
   "wall": null,
   "person": "once",
   "brings": "github_account",
   "fresh": true,
   "minutes": 4
  },
  {
   "route": "device_login",
   "offered": "documented",
   "tried": true,
   "not_tried": null,
   "result": "in",
   "wall": null,
   "person": "none",
   "brings": "nothing",
   "fresh": false,
   "minutes": 1.5
  },
  {
   "route": "oauth_consent",
   "offered": "documented",
   "tried": true,
   "not_tried": null,
   "result": "in",
   "wall": null,
   "person": "none",
   "brings": "nothing",
   "fresh": false,
   "minutes": 2.5
  },
  {
   "route": "sso_enterprise",
   "offered": "seen",
   "tried": false,
   "not_tried": "assisted_only",
   "result": null,
   "wall": null,
   "person": null,
   "brings": null,
   "fresh": null,
   "minutes": null
  }
 ],
 "checkout": {
  "reached": "plan_page",
  "processor": "stripe_elements",
  "captcha": "visible",
  "three_ds": "not_seen",
  "phone_field": "none",
  "rail_offer": "none",
  "period": "month",
  "card_form": false,
  "price": "25.00",
  "currency": "USD",
  "plan": "Pro",
  "last_button": "Confirm upgrade"
 },
 "docs": {
  "at": "2026-10-16",
  "read": 599,
  "listed": 2813,
  "sampled": true,
  "overall": "complete",
  "getting_started": "found",
  "auth": "found",
  "errors": "found",
  "examples": "good",
  "freshness": "fresh",
  "newest": "2026-10-16",
  "core_pages": "9 of 10",
  "capabilities": "most"
 },
 "claims": {
  "claimed": 19,
  "tried": 19,
  "held": 19,
  "broken": 0,
  "unclear": 0,
  "not_tried": 0,
  "undocumented_works": 0
 },
 "pay_options": {
  "checked": "2026-10-16",
  "source": "probe",
  "options": [
   {
    "id": "stripe-projects",
    "name": "Stripe Projects",
    "kind": "agent-rail",
    "first_party": true,
    "lead": false,
    "networks": [],
    "testnet": false
   }
  ],
  "agentic": [
   "stripe-projects"
  ],
  "paid": null,
  "exercised": null,
  "detected_grade": null,
  "trial": {
   "no_card": null,
   "card_required": null,
   "free_plan": true
  },
  "owner_fixes": [
   {
    "title": "Accept x402 or MPP on your API",
    "how": "Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card."
   },
   {
    "title": "Let a verified agent finish your checkout",
    "how": "Show signed agents no visible CAPTCHA at checkout, accept virtual and prepaid cards, and don't ask for a phone number to pay."
   }
  ]
 },
 "surfaces": {
  "api": true,
  "openapi": true,
  "cli": true,
  "mcp": "official",
  "llms_txt": true,
  "webhooks": true,
  "sandbox": false
 },
 "surface_notes": {
  "api": "Management API REST, 169 operations; project REST/GraphQL/Storage/Auth/Realtime APIs",
  "openapi": "3.0.0 at api.supabase.com/api/v1-json",
  "mcp": "official, 29 tools, MCP (the 28 Jul 2026 spec), OAuth with DCR",
  "cli": "supabase 2.121.0; login by browser code",
  "llms_txt": "supabase.com/llms.txt; AI Catalog at /.well-known/ai-catalog.json (robots line is Cloudflare Content-Signal, not aipref)"
 },
 "can_do": [
  "Create and delete Postgres projects through the Management API, and run SQL on them",
  "Create, read, update and delete rows through the auto-generated REST API, and bulk-import CSV",
  "Query and mutate data through GraphQL once pg_graphql is enabled",
  "Enable Row Level Security and write policies through MCP or CLI migrations",
  "Sign up, confirm, sign in, update and delete app users through the Auth API, with TOTP MFA and custom JWT claim hooks",
  "Create buckets, upload (also resumable TUS), serve publicly, upsert and delete files",
  "Deploy, redeploy, invoke and delete Edge Functions through MCP, the API and the CLI",
  "Receive Postgres change events, broadcast and presence over Realtime",
  "Store embeddings with pgvector and run similarity search through an RPC function",
  "Read logs and security/performance advisors through MCP",
  "Set function secrets through the CLI"
 ],
 "cannot_do": [
  {
   "what": "Sign up with email and password",
   "why": "a visible hCaptcha puzzle on the sign-up form"
  },
  {
   "what": "Get the first access token without a browser",
   "why": "no API or device flow for personal access tokens; MCP OAuth and CLI login need a consent/code page in a signed-in browser"
  },
  {
   "what": "Create the first organization headless",
   "why": "done in the dashboard; POST /v1/organizations needs a token that itself needs the browser"
  },
  {
   "what": "Upgrade to a paid plan",
   "why": "dashboard-only checkout with a visible hCaptcha; no billing API or agent payment rail"
  },
  {
   "what": "Delete the account",
   "why": "no self-serve account deletion found"
  },
  {
   "what": "Sign up more than two app users in a row with the built-in mailer",
   "why": "429 over_email_send_rate_limit on the third signup"
  }
 ],
 "blockers": [
  "Visible hCaptcha on email sign-up",
  "Visible hCaptcha at the plan upgrade",
  "No self-serve account deletion"
 ],
 "tips_for_owner": [
  "Let signed agents sign up without a puzzle",
  "Add a device flow for tokens",
  "Let accounts delete themselves",
  "Offer a headless way to buy a plan",
  "Support CIMD for MCP OAuth",
  "Enable pg_graphql or say it is off",
  "Accept sb_secret keys on resumable uploads",
  "Match Storage error status to HTTP"
 ],
 "tips_for_agents": [
  "Sign in with GitHub (only user:email asked); email sign-up shows an hCaptcha puzzle.",
  "Create the Free org in the dashboard, then make a PAT on Account > Access Tokens; after that everything is headless.",
  "Use the Management API (POST /v1/projects, /database/query, /api-keys) or MCP (2026-07-28, OAuth with DCR) for setup; projects are healthy within seconds.",
  "Run 'create extension pg_graphql' before using /graphql/v1 on a new project.",
  "For TUS uploads use a JWT (legacy service_role or a user token), not an sb_secret key.",
  "The built-in mailer allows about two auth emails in a row; use admin create user with email_confirm or set custom SMTP for tests.",
  "MCP apply_migration writes migration history; run supabase migration repair before supabase db push from a fresh local dir.",
  "supabase login needs a TTY; the CLI token never expires unless you delete it."
 ],
 "selfhost": {
  "install": {
   "status": "skipped",
   "minutes": 0,
   "note": "no docker in the drive sandbox (official Docker Compose self-hosting at docs/guides/self-hosting/docker)"
  }
 },
 "summary": "Once in, an agent can do nearly all of Supabase headless: all 10 core capabilities passed create-read-update-delete through the Management API, MCP (the 28 Jul 2026 spec) and CLI, with repeats passing except a third user signup that hit the built-in mailer's rate limit (GraphQL first needed pg_graphql enabled). Getting in needs a browser: email sign-up shows an hCaptcha puzzle, so the drive came in with GitHub, and the first organization and token were made in the dashboard. Paying is a dashboard card checkout behind a visible hCaptcha, and the account itself cannot be deleted.",
 "wall": "hCaptcha puzzle on email sign-up",
 "plan_scope": "free plan",
 "robots_stop": null,
 "robots": null,
 "plain": {
  "summary": "Supabase is a backend platform for databases, user accounts, file storage and serverless functions. Once the agent signed in with GitHub, it could do almost everything on its own through code: create a database, add users, store files, run functions, and more. It stopped at the very first step: creating an account by email showed a puzzle test it couldn't solve, so it had to use a GitHub sign-in instead, and upgrading to a paid plan hit the same kind of puzzle.",
  "can_do": [
   "Create and manage databases, tables and rows on its own",
   "Sign up and sign in app users, including two-factor codes",
   "Upload, list and delete files",
   "Deploy and run small server-side programs",
   "Send and receive live updates and notifications",
   "Search by meaning using stored embeddings"
  ],
  "cannot_do": [
   {
    "what": "Sign up for Supabase with just an email",
    "why": "a visible puzzle test blocks the sign-up button"
   },
   {
    "what": "Get its first access key without opening a browser",
    "why": "the key is only created on a dashboard page"
   },
   {
    "what": "Upgrade to a paid plan by itself",
    "why": "the upgrade page also shows a visible puzzle test"
   },
   {
    "what": "Delete its own account",
    "why": "no option to delete the account was found anywhere"
   }
  ]
 },
 "plan_gated": [
  {
   "capability": "Branching",
   "plan": "paid usage (hourly)",
   "evidence": "MCP get_cost branch: hourly 0.01344; creating needs confirm_cost"
  },
  {
   "capability": "Restore/PITR",
   "plan": "Pro+",
   "evidence": "backups [] and pitr_enabled false; entitlement pitr not available"
  },
  {
   "capability": "Read replicas/Pipelines",
   "plan": "Pro+",
   "evidence": "entitlements instances.read_replicas, replication.etl hasAccess false"
  },
  {
   "capability": "SAML SSO",
   "plan": "Pro+",
   "evidence": "entitlement auth.saml_2 hasAccess false"
  },
  {
   "capability": "Iceberg analytics buckets",
   "plan": "Pro+",
   "evidence": "entitlement storage.iceberg_catalog hasAccess false"
  },
  {
   "capability": "Log drains",
   "plan": "Pro+ add-on",
   "evidence": "entitlement log_drains hasAccess false"
  },
  {
   "capability": "Custom domain",
   "plan": "Pro+ add-on",
   "evidence": "GET custom-hostname: 'Custom domains require the Custom Domain add-on, available on the Pro plan and above.'"
  }
 ],
 "reply": null,
 "capabilities": [
  {
   "id": "cap-01",
   "group": "Database",
   "capability": "Create and run a Postgres project with tables",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /v1/projects (Management API)",
    "mcp": "create_project / execute_sql",
    "cli": "supabase init / supabase db push",
    "ui": "Dashboard > Table Editor / New Project"
   },
   "check": "GET /v1/projects/{ref} shows status ACTIVE_HEALTHY; querying the new table returns rows",
   "source": "https://supabase.com/docs/guides/database/overview, https://supabase.com/docs/guides/database/tables"
  },
  {
   "id": "cap-02",
   "group": "Database",
   "capability": "Query/manage data via auto-generated REST API",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "GET/POST/PATCH/DELETE /rest/v1/{table}",
    "mcp": "execute_sql",
    "cli": null,
    "ui": "Dashboard > SQL Editor / Table Editor"
   },
   "check": "GET /rest/v1/{table}?select=* returns inserted/updated row",
   "source": "https://supabase.com/docs/guides/database/overview"
  },
  {
   "id": "cap-03",
   "group": "Database",
   "capability": "Query data via auto-generated GraphQL API",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /graphql/v1",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > GraphQL Editor"
   },
   "check": "GraphQL query returns requested fields matching table row",
   "source": "https://supabase.com/index.md"
  },
  {
   "id": "cap-04",
   "group": "Database",
   "capability": "Secure data with Row Level Security policies",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "SQL CREATE POLICY via /rest/v1/rpc or SQL Editor",
    "mcp": "apply_migration",
    "cli": "supabase db push (migration)",
    "ui": "Dashboard > Authentication > Policies"
   },
   "check": "Request from a user without matching policy returns 401/403; matching user receives row",
   "source": "https://supabase.com/docs/guides/database/secure-data, https://supabase.com/docs/guides/database/postgres/row-level-security"
  },
  {
   "id": "cap-05",
   "group": "Auth",
   "capability": "Sign up and sign in users (password, magic link, OTP, social, SSO)",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /auth/v1/signup, POST /auth/v1/token",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication; supabase-js client"
   },
   "check": "GET /auth/v1/user with returned JWT shows the new user's id/email",
   "source": "https://supabase.com/docs/guides/auth, https://supabase.com/docs/guides/auth/passwords"
  },
  {
   "id": "cap-06",
   "group": "Storage",
   "capability": "Upload, store and serve files (buckets)",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /storage/v1/object/{bucket}/{path}",
    "mcp": null,
    "cli": "supabase storage",
    "ui": "Dashboard > Storage"
   },
   "check": "GET /storage/v1/object/public/{bucket}/{path} returns the uploaded file bytes",
   "source": "https://supabase.com/docs/guides/storage, https://supabase.com/docs/guides/storage/quickstart"
  },
  {
   "id": "cap-07",
   "group": "Edge Functions",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /functions/v1/{name}",
    "mcp": "deploy_edge_function",
    "cli": "supabase functions deploy / supabase functions serve",
    "ui": "Dashboard > Edge Functions"
   },
   "check": "Invoking the function URL returns the handler's response; dashboard shows invocation log",
   "source": "https://supabase.com/docs/guides/functions, https://supabase.com/docs/guides/functions/quickstart"
  },
  {
   "id": "cap-08",
   "group": "Realtime",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "WebSocket wss://.../realtime/v1 (postgres_changes channel)",
    "mcp": null,
    "cli": null,
    "ui": "supabase-js client; Dashboard > Realtime Inspector"
   },
   "check": "Client subscribed to a table receives an event when a row is inserted/updated/deleted",
   "source": "https://supabase.com/docs/guides/realtime, https://supabase.com/docs/guides/realtime/postgres-changes"
  },
  {
   "id": "cap-09",
   "group": "Realtime",
   "capability": "Broadcast arbitrary low-latency messages between clients",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "WebSocket broadcast channel / POST /realtime/v1/api/broadcast",
    "mcp": null,
    "cli": null,
    "ui": "supabase-js client"
   },
   "check": "A second connected client receives the broadcast payload sent by the first",
   "source": "https://supabase.com/docs/guides/realtime/broadcast"
  },
  {
   "id": "cap-11",
   "group": "AI/Vector",
   "capability": "Store and query vector embeddings (pgvector) for semantic search",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "/rest/v1/rpc/{match_fn} (SQL similarity query)",
    "mcp": "execute_sql",
    "cli": null,
    "ui": "Dashboard > Database > Extensions (pgvector)"
   },
   "check": "RPC similarity search returns nearest-neighbor rows ordered by distance to a query embedding",
   "source": "https://supabase.com/docs/guides/ai, https://supabase.com/docs/guides/ai/vector-columns"
  },
  {
   "id": "cap-10",
   "group": "Realtime",
   "capability": "Track online presence/state across clients",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "WebSocket presence channel",
    "mcp": null,
    "cli": null,
    "ui": "supabase-js client"
   },
   "check": "presenceState on one client reflects another client's tracked state",
   "source": "https://supabase.com/docs/guides/realtime/presence"
  },
  {
   "id": "cap-12",
   "group": "Database",
   "capability": "Enable Postgres extensions (pgvector, PostGIS, pg_cron, etc.)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "SQL CREATE EXTENSION via SQL Editor/Management API",
    "mcp": "execute_sql",
    "cli": "supabase migration new",
    "ui": "Dashboard > Database > Extensions"
   },
   "check": "pg_extension catalog lists the enabled extension after toggling it on",
   "source": "https://supabase.com/docs/guides/database/extensions"
  },
  {
   "id": "cap-13",
   "group": "Database",
   "capability": "Define database functions and triggers",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "SQL CREATE FUNCTION/TRIGGER",
    "mcp": "apply_migration",
    "cli": "supabase migration new",
    "ui": "Dashboard > Database > Functions/Triggers"
   },
   "check": "An insert on the source table fires the trigger and the function's side effect (e.g. row in log table) appears",
   "source": "https://supabase.com/docs/guides/database/functions, https://supabase.com/docs/guides/database/postgres/triggers"
  },
  {
   "id": "cap-14",
   "group": "Database",
   "capability": "Send database row changes to external HTTP endpoints (Webhooks)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "SQL trigger calling http extension; configured via Dashboard",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Database > Webhooks"
   },
   "check": "External endpoint receives an HTTP POST payload when the watched table changes",
   "source": "https://supabase.com/docs/guides/database/webhooks"
  },
  {
   "id": "cap-15",
   "group": "Database",
   "capability": "Import existing data (CSV, pg_dump, another Postgres DB)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": "psql / pg_restore",
    "ui": "Dashboard > Table Editor > Import data"
   },
   "check": "Table row count matches the imported CSV/dump after import completes",
   "source": "https://supabase.com/docs/guides/database/import-data"
  },
  {
   "id": "cap-16",
   "group": "Database",
   "capability": "Branch the database for preview/dev environments",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "Management API /v1/branches",
    "mcp": "create_branch",
    "cli": "supabase branches create",
    "ui": "Dashboard > Branches"
   },
   "check": "GET /v1/branches/{id} shows a new isolated project with its own credentials and migrated schema",
   "source": "https://supabase.com/docs/guides/deployment/branching, https://supabase.com/pricing"
  },
  {
   "id": "cap-17",
   "group": "Database",
   "capability": "Restore database from backups / point-in-time recovery",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "Management API backups endpoint",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Database > Backups"
   },
   "check": "After restoring to a prior timestamp, table data matches that point in time",
   "source": "https://supabase.com/docs/guides/platform/backups, https://supabase.com/pricing"
  },
  {
   "id": "cap-18",
   "group": "Database",
   "capability": "Replicate to read replicas / stream changes (Pipelines)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Database > Replication"
   },
   "check": "Read query against the replica endpoint returns data consistent with primary after sync",
   "source": "https://supabase.com/docs/guides/database/replication, https://supabase.com/pricing"
  },
  {
   "id": "cap-19",
   "group": "Database",
   "capability": "Monitor and optimize query performance (slow query/index advisor)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": "get_advisors",
    "cli": null,
    "ui": "Dashboard > Database > Query Performance / Advisors"
   },
   "check": "Advisor panel lists a slow query/missing index that corresponds to a seeded slow query",
   "source": "https://supabase.com/docs/guides/database/query-optimization"
  },
  {
   "id": "cap-20",
   "group": "Auth",
   "capability": "Add social/OAuth login providers (Google, GitHub, etc.)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "GET /auth/v1/authorize?provider=",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication > Providers"
   },
   "check": "OAuth redirect flow completes and /auth/v1/user shows identity linked to the provider",
   "source": "https://supabase.com/docs/guides/auth#providers"
  },
  {
   "id": "cap-21",
   "group": "Auth",
   "capability": "Add multi-factor authentication (TOTP/phone)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "POST /auth/v1/factors",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication > MFA"
   },
   "check": "Sign-in requires a verified second factor before a session JWT is issued",
   "source": "https://supabase.com/docs/guides/auth/auth-mfa"
  },
  {
   "id": "cap-22",
   "group": "Auth",
   "capability": "Configure Enterprise SSO (SAML 2.0)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "Management API /v1/projects/{ref}/config/auth/sso",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication > SSO"
   },
   "check": "SSO-initiated login returns a valid Supabase session for the federated user",
   "source": "https://supabase.com/docs/guides/auth/enterprise-sso, https://supabase.com/pricing"
  },
  {
   "id": "cap-23",
   "group": "Auth",
   "capability": "Customize Auth behavior with hooks (custom JWT claims, custom email/SMS)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication > Hooks"
   },
   "check": "Issued JWT contains the custom claim added by the configured hook function",
   "source": "https://supabase.com/docs/guides/auth/auth-hooks"
  },
  {
   "id": "cap-24",
   "group": "Auth",
   "capability": "Manage user sessions (timeouts, single session, refresh tokens)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /auth/v1/logout, config endpoints",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Authentication > Sessions"
   },
   "check": "A second sign-in invalidates the first session when single-session-per-user is enabled",
   "source": "https://supabase.com/docs/guides/auth/sessions, https://supabase.com/pricing"
  },
  {
   "id": "cap-25",
   "group": "Storage",
   "capability": "Resumable large-file uploads (TUS protocol)",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "TUS endpoint /storage/v1/upload/resumable",
    "mcp": null,
    "cli": null,
    "ui": null
   },
   "check": "Interrupted upload resumes from last confirmed offset and file is complete after resume",
   "source": "https://supabase.com/docs/guides/storage"
  },
  {
   "id": "cap-26",
   "group": "Storage",
   "capability": "Transform/resize images on the fly",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "GET /storage/v1/render/image/public/{bucket}/{path}?width=",
    "mcp": null,
    "cli": null,
    "ui": null
   },
   "check": "Requested image URL with width/height params returns a resized image",
   "source": "https://supabase.com/docs/guides/storage, https://supabase.com/pricing"
  },
  {
   "id": "cap-27",
   "group": "Storage",
   "capability": "Query analytics/log data stored as Apache Iceberg tables",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "Postgres foreign table query",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Storage > Analytics buckets"
   },
   "check": "SQL query against the foreign table returns rows written into the analytics bucket",
   "source": "https://supabase.com/docs/guides/storage/analytics/introduction"
  },
  {
   "id": "cap-29",
   "group": "Platform",
   "capability": "View API/database/function logs",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "Management API /v1/projects/{ref}/analytics/endpoints/logs.all",
    "mcp": "get_logs",
    "cli": null,
    "ui": "Dashboard > Logs"
   },
   "check": "A request/invocation appears as a log entry with matching timestamp and status",
   "source": "https://supabase.com/pricing#database"
  },
  {
   "id": "cap-30",
   "group": "Platform",
   "capability": "Stream logs to external destination (Log Drains)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Settings > Log Drains"
   },
   "check": "Configured external sink receives forwarded log events",
   "source": "https://supabase.com/pricing"
  },
  {
   "id": "cap-31",
   "group": "Platform",
   "capability": "View usage against plan limits / metrics endpoint",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "Metrics endpoint (Pro+)",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Org > Usage"
   },
   "check": "Usage page numbers change after generating load (e.g. API requests, egress)",
   "source": "https://supabase.com/pricing#faq"
  },
  {
   "id": "cap-35",
   "group": "Platform",
   "capability": "Manage project configuration/secrets via CLI",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": "supabase secrets set / supabase login / supabase link",
    "ui": "Dashboard > Settings"
   },
   "check": "supabase secrets list shows the newly set secret name",
   "source": "https://supabase.com/index.md, https://supabase.com/docs/reference/cli/supabase-secrets"
  },
  {
   "id": "cap-28",
   "group": "Realtime",
   "capability": "Set a custom Postgres message size/channel limits for realtime",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Realtime settings"
   },
   "check": "A message under the configured max size is delivered; one over it is rejected",
   "source": "https://supabase.com/pricing"
  },
  {
   "id": "cap-32",
   "group": "Platform",
   "capability": "Set a spend cap to stop usage billing beyond plan limits",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Org > Billing > Spend cap"
   },
   "check": "Toggling the spend cap off/on changes whether overage usage is billed, shown on the billing page",
   "source": "https://supabase.com/pricing#faq, https://supabase.com/docs/guides/platform/cost-control"
  },
  {
   "id": "cap-33",
   "group": "Platform",
   "capability": "Invite and manage team members / access roles",
   "weight": "peripheral",
   "plan": "free",
   "surfaces": {
    "api": "Management API /v1/organizations/{slug}/members",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Org > Team"
   },
   "check": "Invited member appears in the org member list with the assigned role",
   "source": "https://supabase.com/pricing#platform-security-and-compliance"
  },
  {
   "id": "cap-36",
   "group": "Platform",
   "capability": "Self-host the full Supabase stack via Docker",
   "weight": "peripheral",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": "docker compose up",
    "ui": null
   },
   "check": "Local Supabase Studio at localhost reflects the self-hosted stack's project state",
   "source": "https://supabase.com/docs/guides/hosting/docker, https://supabase.com/pricing#faq"
  },
  {
   "id": "cap-37",
   "group": "Platform",
   "capability": "Set up a custom domain / vanity URL for the project",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": "Management API /v1/projects/{ref}/custom-hostname",
    "mcp": null,
    "cli": null,
    "ui": "Dashboard > Settings > Custom Domains"
   },
   "check": "Project API is reachable at the configured custom domain with a valid cert",
   "source": "https://supabase.com/pricing#platform-security-and-compliance"
  }
 ],
 "attempts": [
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "MCP server/discover",
   "task": "POST server/discover 2026-07-28 to https://mcp.supabase.com/mcp",
   "evidence": "HTTP 401 {\"message\":\"No access token provided\"}, WWW-Authenticate: Bearer resource_metadata=https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp; retry with credentials after sign-in",
   "notes": "auth-required before version answer"
  },
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "PRM + AS metadata",
   "task": "GET PRM and AS metadata",
   "evidence": "PRM 200 JSON (resource https://mcp.supabase.com/mcp, AS https://api.supabase.com, 13 scopes). AS metadata 200: registration_endpoint https://api.supabase.com/platform/oauth/apps/register (DCR), no client_id_metadata_document_supported (no CIMD), no device_authorization_endpoint, grant jwt-bearer, authorization_grant_profiles_supported id-jag, PKCE S256 and plain, iss param supported"
  },
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "cards",
   "task": "server-card, ai-catalog, A2A card",
   "evidence": "mcp.supabase.com/mcp/server-card 404; supabase.com/.well-known/ai-catalog.json 200 application/json (specVersion 1.0, entry urn:air:supabase.com:mcp:server -> https://mcp.supabase.com/mcp); /.well-known/agent-card.json 404; /.well-known/agent.json 404; /.well-known/mcp/server-card.json 404"
  },
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "aipref / robots",
   "task": "robots.txt Content-Usage and header",
   "evidence": "robots.txt: User-agent: * Allow: /; Content-Signal: ai-train=yes, search=yes, ai-input=yes (Cloudflare Content Signals scheme, parses: lowercase, yes/no); no aipref Content-Usage line or header"
  },
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "markdown docs",
   "task": "Accept: text/markdown and .md URL on /docs/guides/database/overview",
   "evidence": "Accept: text/markdown -> 200 content-type text/markdown, Vary: Accept; .md URL -> 200 text/markdown"
  },
  {
   "t": "00:59",
   "cap": "discovery",
   "route": "api",
   "documented": true,
   "verified": true,
   "result": "done",
   "capability": "OpenAPI",
   "task": "GET https://api.supabase.com/api/v1-json",
   "evidence": "openapi 3.0.0, 169 operations; no endpoint to create a personal access token; project api-keys create/delete exist"
  },
  {
   "t": "02:25",
   "cap": "signup",
   "way": "email_password",
   "capability": "Sign up with email and password",
   "task": "Sign up at supabase.com/dashboard/sign-up with the agent's inbox",
   "route": "browser",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "After clicking Sign up, a visible hCaptcha puzzle appeared (\"Click the animal the ball never touches\"), screenshot browser/shots/003.png; snapshot visible_challenge true",
   "notes": "visible hCaptcha on the email sign-up form; not solved by us"
  },
  {
   "t": "03:46",
   "cap": "signup",
   "way": "sso_github",
   "capability": "Sign up with GitHub",
   "task": "Continue with GitHub on supabase.com/dashboard/sign-up with our agent GitHub account",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "GitHub consent asked only scope user:email (Email addresses read-only); after Authorize, landed on https://supabase.com/dashboard/organizations?method=github with \"Your organizations / Create an organization\" (new account, no orgs). No CAPTCHA on this path.",
   "notes": "fresh account; no email verification needed"
  },
  {
   "t": "03:47",
   "cap": "verify",
   "way": "sso_github",
   "capability": "Verify email",
   "task": "email verification",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "No verification step on the GitHub route: dashboard opened directly after GitHub consent",
   "notes": "n/a for GitHub sign-in"
  },
  {
   "t": "06:44",
   "cap": "credentials",
   "way": "sso_github",
   "capability": "Get API credentials",
   "task": "Generate a personal access token at /dashboard/account/tokens",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "Created legacy (full-account) PAT \"agentdrives-drive\" (expires 23 Oct 2026) in the dashboard; the Management API has no documented endpoint to create a PAT (OpenAPI 169 ops checked). Org \"AgentDrives\" (Free) had to be created first in the browser (/dashboard/new, hCaptcha script loaded, no challenge shown).",
   "notes": "scoped tokens also offered (project/org scope, permission presets)"
  },
  {
   "t": "06:44",
   "cap": "first_call",
   "way": "sso_github",
   "capability": "First API call",
   "task": "GET /v1/organizations and /v1/profile with the PAT",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "200 [{\"slug\":\"kgmppuqscmylfeysxecb\",\"name\":\"AgentDrives\"}]; /v1/profile 200 username AgentDrives-agent",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-list-all-organizations"
   }
  },
  {
   "t": "07:25",
   "cap": "first_action",
   "way": "sso_github",
   "capability": "First real action",
   "task": "POST /v1/projects (Free org) then create a table",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "201 project ref ucopklbgekikzwzmeifn eu-west-1 ACTIVE_HEALTHY in seconds; health endpoint shows db/rest/auth/storage/realtime healthy"
  },
  {
   "t": "07:25",
   "cap": "cap-01",
   "way": "sso_github",
   "step": "create",
   "capability": "Create and run a Postgres project with tables",
   "task": "Create project via Management API, create table notes via /database/query",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "POST /v1/projects 201; POST /v1/projects/{ref}/database/query create table + insert returning row id 1",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-create-a-project",
    "verify_route": "yes"
   },
   "notes": "A GET right after create briefly returned name \"warm-project-pool_AWS_eu-west-1_nano_17_ga_...\" and another organization_slug (syrgqipofixtlesjwozp) before switching to ours 10 s later"
  },
  {
   "t": "07:48",
   "cap": "credentials",
   "key": "create",
   "way": "sso_github",
   "capability": "Create scoped key headless",
   "task": "POST /v1/projects/{ref}/api-keys type secret",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "201 id aab25bbf-..., prefix sb_secret_W0C_p",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-create-project-api-key"
   }
  },
  {
   "t": "07:48",
   "cap": "credentials",
   "key": "use",
   "way": "sso_github",
   "capability": "Use the new key",
   "task": "GET /rest/v1/notes with apikey: sb_secret_...",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "200 [{\"id\":1,\"title\":\"first\"}]"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "POST /rest/v1/notes 201 id 2"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "GET id=eq.2 200 row"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "PATCH 200 body=updated"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "GET 200 [{\"body\":\"updated\"}]"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "DELETE 204"
  },
  {
   "t": "07:52",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "CRUD a row in notes via PostgREST",
   "result": "done",
   "verified": true,
   "evidence": "GET after delete 200 []"
  },
  {
   "t": "08:03",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "CRUD a row (create/read/update/delete/read)",
   "result": "done",
   "verified": true,
   "evidence": "statuses ['201', '200', '200', '200', '204', '200']"
  },
  {
   "t": "08:07",
   "cap": "cap-02",
   "way": "sso_github",
   "capability": "Query/manage data via auto-generated REST API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/api",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "CRUD a row (create/read/update/delete/read)",
   "result": "done",
   "verified": true,
   "evidence": "statuses ['201', '200', '200', '200', '204', '200']"
  },
  {
   "t": "08:16",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "read table schema back",
   "result": "done",
   "verified": true,
   "evidence": "read-only query lists notes columns: [{\"column_name\":\"id\"},{\"column_name\":\"title\"},{\"column_name\":\"body\"},{\"column_name\":\"embedding_dummy\"},{\"column_name\":\"created_at\"}]"
  },
  {
   "t": "08:17",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "alter table add column tag",
   "result": "done",
   "verified": true,
   "evidence": "ALTER 201 []; read back column tag: [{\"column_name\":\"tag\"}]"
  },
  {
   "t": "08:18",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "step": "use",
   "task": "insert a row in the new table",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":5,\"tag\":\"x\"}]"
  },
  {
   "t": "08:19",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "drop table tmp_t and read back",
   "result": "done",
   "verified": true,
   "evidence": "drop 201; to_regclass -> [{\"t\":null}]"
  },
  {
   "t": "08:41",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "create a fresh project, create+fill a table, delete the project",
   "result": "done",
   "verified": true,
   "evidence": "POST /v1/projects 201 ref ylbmwsrynxctaskngpaw; query -> [{\"count\":1}]; DELETE 200; GET after delete -> {\"message\":\"Project not found\"} 404"
  },
  {
   "t": "08:53",
   "cap": "cap-01",
   "way": "sso_github",
   "capability": "Create and run a Postgres project with tables",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "create a fresh project, create+fill a table, delete the project",
   "result": "done",
   "verified": true,
   "evidence": "POST /v1/projects 201 ref amwtmvwetsuwkpamjkyk; query -> [{\"count\":1}]; DELETE 200; GET after delete -> {\"message\":\"Resource has been removed\"} 404"
  },
  {
   "t": "09:55",
   "cap": "discovery",
   "way": "oauth_consent",
   "capability": "MCP server/discover with credentials",
   "task": "POST server/discover 2026-07-28 with OAuth token",
   "route": "mcp",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "200 application/json supportedVersions [\"2026-07-28\"], serverInfo supabase 0.14.0, tools capability; X-RateLimit-Limit 120 per 60 s"
  },
  {
   "t": "09:55",
   "cap": "credentials",
   "way": "oauth_consent",
   "capability": "MCP OAuth sign-in (DCR)",
   "task": "DCR at /platform/oauth/apps/register, authorize with PKCE + resource, approve consent in browser, exchange code",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "DCR 201 client_id; consent page /dashboard/authorize \"Authorize AgentDrives drive\" org AgentDrives, Database/Edge Functions/Environment/Projects/Storage read+write, Secrets/Organizations/Analytics read; callback had code, state, iss=https://api.supabase.com; token 200 Bearer expires_in 86400 with refresh_token",
   "notes": "no CIMD in AS metadata; DCR only; consent in a browser"
  },
  {
   "t": "10:52",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "enable RLS + two owner policies via MCP apply_migration",
   "result": "done",
   "verified": true,
   "evidence": "apply_migration {\"success\":true}"
  },
  {
   "t": "10:52",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "read policies back via MCP execute_sql pg_policies",
   "result": "done",
   "verified": true,
   "evidence": "[own rows read SELECT, own rows insert INSERT]"
  },
  {
   "t": "10:52",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "rename policy via execute_sql, read back",
   "result": "done",
   "verified": true,
   "evidence": "pg_policies now [own rows insert, owner can read]"
  },
  {
   "t": "10:52",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "step": "use",
   "task": "check enforcement through REST",
   "result": "done",
   "verified": true,
   "evidence": "anon GET /rest/v1/notes -> [] (rows hidden); signed-in user insert 201 owner=auth.uid, read returns only own row; insert with foreign owner -> 403 42501 \"new row violates row-level security policy\""
  },
  {
   "t": "10:52",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "POST /auth/v1/signup with our inbox an inbox",
   "result": "done",
   "verified": true,
   "evidence": "200 user f321682f..., confirmation_sent_at set; confirmation mail arrived from noreply@mail.app.supabase.io in 1 s; verify link 303 to redirect with tokens"
  },
  {
   "t": "10:52",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "sign in with password, GET /auth/v1/user",
   "result": "done",
   "verified": true,
   "evidence": "token?grant_type=password 200, email_confirmed_at 2026-10-16T06:32:44Z; GET /auth/v1/user 200"
  },
  {
   "t": "10:52",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "PUT /auth/v1/user metadata, read via admin API",
   "result": "done",
   "verified": true,
   "evidence": "PUT 200 display_name set; admin GET /auth/v1/admin/users/{id} 200 shows it"
  },
  {
   "t": "10:52",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "step": "use",
   "task": "use the session JWT against RLS-protected table",
   "result": "done",
   "verified": true,
   "evidence": "insert 201 / select own row 200 with user JWT"
  },
  {
   "t": "10:54",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "drop policy and read back",
   "result": "done",
   "verified": true,
   "evidence": "drop policy \"owner can read\"; pg_policies count for it -> [{\"count\":0}]"
  },
  {
   "t": "10:55",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "admin delete user, read back, try sign-in",
   "result": "done",
   "verified": true,
   "evidence": "DELETE 200; GET -> {\"code\":404,\"error_code\":\"user_not_found\",\"msg\":\"User not found\"}; sign-in -> {\"code\":400,\"error_code\":\"invalid_credentials\",\"msg\":\"Invalid login credentials\"}"
  },
  {
   "t": "11:16",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "new table, enable RLS + policy via MCP, check anon sees nothing, drop",
   "result": "failed",
   "verified": false,
   "evidence": "apply_migration {\"result\": {\"content\": [{\"type\": \"text\", \"text\": \"{\\\"success\\\":true}\"}], \"result; anon GET -> {\"code\":\"PGRST205\",\"details\":null,\"hint\":null,\"message\":\"Cou"
  },
  {
   "t": "11:25",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "sign up a fresh user, confirm mail, sign in, delete",
   "result": "done",
   "verified": true,
   "evidence": "signup 200; mail received; sign-in 200; delete 200"
  },
  {
   "t": "11:31",
   "cap": "cap-04",
   "way": "sso_github",
   "capability": "Secure data with Row Level Security policies",
   "route": "mcp",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "new table, enable RLS + policy via MCP, check anon sees nothing, drop",
   "result": "done",
   "verified": true,
   "evidence": "apply_migration {\"result\": {\"content\": [{\"type\": \"text\", \"text\": \"{\\\"success\\\":true}\"}], \"result; anon GET -> []"
  },
  {
   "t": "11:36",
   "cap": "cap-05",
   "way": "sso_github",
   "capability": "Sign up and sign in users",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signup",
    "verify_route": "yes",
    "error_legibility": "clear"
   },
   "trial": 3,
   "step": "use",
   "task": "sign up a fresh user, confirm mail, sign in, delete",
   "result": "failed",
   "verified": false,
   "evidence": "signup 429: {\"code\":429,\"error_code\":\"over_email_send_rate_limit\",\"msg\":\"email rate limit exceeded\"}"
  },
  {
   "t": "11:49",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "drift",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes",
    "error_legibility": "clear",
    "recoverable": "yes"
   },
   "trial": 1,
   "step": "create",
   "task": "insert via GraphQL",
   "result": "failed",
   "verified": false,
   "evidence": "{\"errors\": [{\"message\": \"pg_graphql extension is not enabled.\"}]}\nHTTP:200\n[rc=0]",
   "notes": "pg_graphql not enabled on a new project; the GraphQL guide does not say it must be enabled first (it covers enabling introspection). Fixed with create extension pg_graphql."
  },
  {
   "t": "12:09",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"insertIntoitemsCollection\": {\"records\": [{\"id\": \"1\", \"name\": \"g1\"}]}}}"
  },
  {
   "t": "12:09",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"itemsCollection\": {\"edges\": [{\"node\": {\"id\": \"1\", \"name\": \"g1\"}}]}}}"
  },
  {
   "t": "12:09",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"updateitemsCollection\": {\"records\": [{\"name\": \"upd\"}]}}}"
  },
  {
   "t": "12:10",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"itemsCollection\": {\"edges\": [{\"node\": {\"name\": \"upd\"}}]}}}"
  },
  {
   "t": "12:10",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"deleteFromitemsCollection\": {\"affectedCount\": 1}}}"
  },
  {
   "t": "12:10",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "insert/query/update/delete a row via /graphql/v1 (after create extension pg_graphql)",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"itemsCollection\": {\"edges\": []}}}"
  },
  {
   "t": "12:13",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "GraphQL CRUD on items",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"itemsCollection\": {\"edges\": []}}}"
  },
  {
   "t": "12:16",
   "cap": "cap-03",
   "way": "sso_github",
   "capability": "Query data via auto-generated GraphQL API",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/graphql",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "GraphQL CRUD on items",
   "result": "done",
   "verified": true,
   "evidence": "{\"data\": {\"itemsCollection\": {\"edges\": []}}}"
  },
  {
   "t": "12:30",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "bucket (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "{\"name\":\"ad-bucket-1\"} HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "upload (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "{\"Key\":\"ad-bucket-1/doc.txt\",\"Id\":\"[id]\"} HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "list (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "[{\"name\":\"doc.txt\",\"version\":\"[id]\",\"id\":\"[id]\",\"updated_at\":\"2026-10-16T06:34:49.586Z\",\"created HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "upsert v2 (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "{\"Key\":\"ad-bucket-1/doc.txt\",\"Id\":\"[id]\"} HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "use",
   "task": "public URL download (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "hello storage v2 HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "remove object (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "[{\"name\":\"doc.txt\",\"bucket_id\":\"ad-bucket-1\",\"owner\":\"\",\"owner_id\":\"\",\"version\":\"[id]\",\"id\":\"a1ae5b29-043f-470e-b0d2-6db4984b24b HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "delete bucket (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "{\"message\":\"Successfully deleted\"} HTTP 200"
  },
  {
   "t": "12:31",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "read back bucket (ad-bucket-1)",
   "result": "done",
   "verified": true,
   "evidence": "{\"statusCode\":\"404\",\"error\":\"Bucket not found\",\"message\":\"Bucket not found\",\"code\":\"NoSuchBucket\"} HTTP 400"
  },
  {
   "t": "12:36",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "bucket, upload, list, upsert, public download, delete",
   "result": "done",
   "verified": true,
   "evidence": "[('create', 'bucket', '200'), ('create', 'upload', '200'), ('read', 'list', '200'), ('update', 'upsert v2', '200'), ('use', 'public URL download', '200'), ('delete', 'remove object', '200'), ('delete', 'delete bucket', '200'), ('read', 'read back bucket', '400')]"
  },
  {
   "t": "12:40",
   "cap": "cap-06",
   "way": "sso_github",
   "capability": "Upload, store and serve files (buckets)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "bucket, upload, list, upsert, public download, delete",
   "result": "done",
   "verified": true,
   "evidence": "[('create', 'bucket', '200'), ('create', 'upload', '200'), ('read', 'list', '200'), ('update', 'upsert v2', '200'), ('use', 'public URL download', '200'), ('delete', 'remove object', '200'), ('delete', 'delete bucket', '200'), ('read', 'read back bucket', '400')]"
  },
  {
   "t": "13:10",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "mcp",
   "step": "create",
   "task": "deploy hello-1 via MCP deploy_edge_function",
   "result": "done",
   "verified": true,
   "evidence": "{\"result\": {\"content\": [{\"type\": \"text\", \"text\": \"{\\\"id\\\":\\\"[id]\\\",\\\"slug\\\":\\\"hello-1\\\",\\\"name\\\":\\\"hello-1\\\",\\\"status\\\":\\\"ACTIVE\\\",\\\"version\\\":1,\\\"created_at\\\":17921325"
  },
  {
   "t": "13:11",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "api",
   "step": "use",
   "task": "invoke POST /functions/v1/hello-1",
   "result": "done",
   "verified": true,
   "evidence": "{\"msg\":\"hello agent\"}\nHTTP:200"
  },
  {
   "t": "13:11",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "api",
   "step": "read",
   "task": "GET /v1/projects/{ref}/functions/hello-1",
   "result": "done",
   "verified": true,
   "evidence": "{\"id\":\"[id]\",\"slug\":\"hello-1\",\"name\":\"hello-1\",\"status\":\"ACTIVE\",\"version\":1,\"created_at\":1792132520131,\"updated_at\":1792132520131,\"verify_jwt\":true,\"import_map\":false,"
  },
  {
   "t": "13:11",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "mcp",
   "step": "update",
   "task": "redeploy with new body, invoke",
   "result": "done",
   "verified": true,
   "evidence": "{\"msg\":\"hi v2 agent\"}\nHTTP:200"
  },
  {
   "t": "13:11",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "api",
   "step": "delete",
   "task": "DELETE /v1/projects/{ref}/functions/hello-1, read back, invoke",
   "result": "done",
   "verified": true,
   "evidence": "DELETE 200; GET -> {\"message\":\"Function not found\"}; invoke -> {\"code\":\"NOT_FOUND\",\"message\":\"Requested function was not found\"}"
  },
  {
   "t": "13:25",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "mcp",
   "trial": 2,
   "step": "use",
   "task": "deploy, invoke, redeploy, invoke, delete",
   "result": "done",
   "verified": true,
   "evidence": "{\"msg\":\"hello agent\"}\nHTTP:200\n[rc=0] | {\"msg\":\"hi v2 agent\"}\nHTTP:200\n[rc=0] | {\"message\":\"Function not found\"}\nHTTP:404\n[rc=0]"
  },
  {
   "t": "13:54",
   "cap": "cap-07",
   "way": "sso_github",
   "capability": "Deploy and invoke server-side TypeScript functions",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/functions",
    "verify_route": "yes"
   },
   "route": "mcp",
   "trial": 3,
   "step": "use",
   "task": "deploy, invoke, redeploy, invoke, delete",
   "result": "done",
   "verified": true,
   "evidence": "{\"msg\":\"hello agent\"}\nHTTP:200\n[rc=0] | {\"msg\":\"hi v2 agent\"}\nHTTP:200\n[rc=0] | {\"message\":\"Function not found\"}\nHTTP:404\n[rc=0]"
  },
  {
   "t": "14:48",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "step": "create",
   "task": "add table rt to publication supabase_realtime",
   "result": "done",
   "verified": true,
   "evidence": "alter publication supabase_realtime add table public.rt -> 201 []"
  },
  {
   "t": "14:48",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "step": "read",
   "task": "read publication tables",
   "result": "done",
   "verified": true,
   "evidence": "[{\"tablename\":\"rt\"}]"
  },
  {
   "t": "14:48",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "step": "use",
   "task": "join postgres_changes channel, insert a row, receive event",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"pg\",\"events\":[\"INSERT {\\\"id\\\":1,\\\"msg\\\":\\\"realtime insert\\\"}\"],\"joined\":\"ok\",\"insert\":{\"status\":201,\"body\":\"[{\\\"id\\\":1,\\\"msg\\\":\\\"realtime insert\\\"}]\"}}"
  },
  {
   "t": "14:49",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "step": "update",
   "task": "set replica identity full (old record in UPDATE/DELETE events)",
   "result": "done",
   "verified": true,
   "evidence": "201 []"
  },
  {
   "t": "14:52",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "trial": 2,
   "step": "use",
   "task": "subscribe, insert, receive INSERT event",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"pg\",\"events\":[\"INSERT {\\\"id\\\":2,\\\"msg\\\":\\\"realtime insert\\\"}\"],\"joined\":\"ok\",\"insert\":{\"status\":201,\"body\":\"[{\\\"id\\\":2,\\\"msg\\\":\\\"realtime insert\\\"}]\"}}"
  },
  {
   "t": "14:56",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "trial": 3,
   "step": "use",
   "task": "subscribe, insert, receive INSERT event",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"pg\",\"events\":[\"INSERT {\\\"id\\\":3,\\\"msg\\\":\\\"realtime insert\\\"}\"],\"joined\":\"ok\",\"insert\":{\"status\":201,\"body\":\"[{\\\"id\\\":3,\\\"msg\\\":\\\"realtime insert\\\"}]\"}}"
  },
  {
   "t": "14:57",
   "cap": "cap-08",
   "way": "sso_github",
   "capability": "Subscribe to live database changes (Postgres Changes)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node",
   "step": "delete",
   "task": "remove rt from publication, read back",
   "result": "done",
   "verified": true,
   "evidence": "[{\"count\":0}]"
  },
  {
   "t": "14:57",
   "cap": "cap-09",
   "way": "sso_github",
   "capability": "Broadcast low-latency messages",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/broadcast",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node (not signed); REST broadcast via fetch from Node",
   "step": "use",
   "task": "join broadcast channel (self), send via socket and via POST /realtime/v1/api/broadcast, receive both",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"bc\",\"events\":[\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"hello\\\":\\\"agent\\\"},\\\"type\\\":\\\"broadcast\\\"}\",\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"via\\\":\\\"rest\\\"},\\\"type\\\":\\\"broadcast\\\"}\"],\"joined\":\"ok\"}"
  },
  {
   "t": "14:58",
   "cap": "cap-09",
   "way": "sso_github",
   "capability": "Broadcast low-latency messages",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/broadcast",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node (not signed); REST broadcast via fetch from Node",
   "trial": 2,
   "step": "use",
   "task": "join broadcast channel (self), send via socket and via POST /realtime/v1/api/broadcast, receive both",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"bc\",\"events\":[\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"hello\\\":\\\"agent\\\"},\\\"type\\\":\\\"broadcast\\\"}\",\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"via\\\":\\\"rest\\\"},\\\"type\\\":\\\"broadcast\\\"}\"],\"joined\":\"ok\"}"
  },
  {
   "t": "14:58",
   "cap": "cap-09",
   "way": "sso_github",
   "capability": "Broadcast low-latency messages",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/broadcast",
    "verify_route": "yes"
   },
   "notes": "WebSocket from Node (not signed); REST broadcast via fetch from Node",
   "trial": 3,
   "step": "use",
   "task": "join broadcast channel (self), send via socket and via POST /realtime/v1/api/broadcast, receive both",
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"bc\",\"events\":[\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"hello\\\":\\\"agent\\\"},\\\"type\\\":\\\"broadcast\\\"}\",\"{\\\"event\\\":\\\"ping\\\",\\\"payload\\\":{\\\"via\\\":\\\"rest\\\"},\\\"type\\\":\\\"broadcast\\\"}\"],\"joined\":\"ok\"}"
  },
  {
   "t": "14:59",
   "cap": "cap-10",
   "way": "sso_github",
   "capability": "Track online presence",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "{\"mode\":\"pr\",\"events\":[\"presence_diff {\\\"joins\\\":{\\\"agent-1\\\":{\\\"metas\\\":[{\\\"phx_ref\\\":\\\"GN7vJGiMOmXXVfMF\\\",\\\"online_at\\\":\\\"2026-10-16T06:37:21.379Z\\\",\\\"user\\\":\\\"agent\\\"}]}},\\\"leaves\\\":{}}\"],\"joined\":\"ok\"}",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/realtime/presence"
   }
  },
  {
   "t": "15:15",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "step": "create",
   "task": "enable vector, create docs table + match_docs function",
   "result": "done",
   "verified": true,
   "evidence": "database/query 201"
  },
  {
   "t": "15:18",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "step": "use",
   "task": "insert 2 embeddings, similarity search via /rest/v1/rpc/match_docs",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":1,\"content\":\"cats\",\"similarity\":0.993883748801337}]"
  },
  {
   "t": "15:19",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "step": "read",
   "task": "read rows back",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":1,\"content\":\"cats\",\"embedding\":\"[1,0,0]\"}, \n {\"id\":2,\"content\":\"dogs\",\"embedding\":\"[0,1,0]\"}]"
  },
  {
   "t": "15:19",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "step": "update",
   "task": "PATCH embedding, re-query",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":2,\"content\":\"dogs2\",\"similarity\":1}]"
  },
  {
   "t": "15:19",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "step": "delete",
   "task": "delete rows, read back",
   "result": "done",
   "verified": true,
   "evidence": "DELETE 204 then GET []\nHTTP:20"
  },
  {
   "t": "15:22",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "trial": 2,
   "step": "use",
   "task": "insert, search, update, search, delete",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":4,\"content\":\"dogs2\",\"similarity\":1}]\nHTTP:200\n[rc=0]"
  },
  {
   "t": "15:25",
   "cap": "cap-11",
   "way": "sso_github",
   "capability": "Store and query vector embeddings (pgvector)",
   "route": "api",
   "documented": true,
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/ai/vector-columns",
    "verify_route": "yes"
   },
   "trial": 3,
   "step": "use",
   "task": "insert, search, update, search, delete",
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":6,\"content\":\"dogs2\",\"similarity\":1}]\nHTTP:200\n[rc=0]"
  },
  {
   "t": "15:52",
   "cap": "cap-12",
   "way": "sso_github",
   "capability": "Enable Postgres extensions",
   "task": "create extension pg_trgm via MCP execute_sql; list_extensions",
   "route": "mcp",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "he below <untrusted-data-[id]> boundaries.\\\\n\\\\n<untrusted-data-[id]>\\\\n[{\\\\\\\"extname\\\\\\\":\\\\\\\"pg_graphql\\\\\\\"},{\\\\\\\"extname\\\\\\\":\\\\\\\"vector\\\\\\\"},{\\\\\\\"extname\\",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/extensions"
   }
  },
  {
   "t": "15:53",
   "cap": "cap-13",
   "way": "sso_github",
   "capability": "Define database functions and triggers",
   "task": "create function + BEFORE trigger via MCP apply_migration; insert row and read updated_at",
   "route": "mcp",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "[{\"id\":4,\"name\":\"trig\",\"updated_at\":\"2026-10-16T06:38:15.186282+00:00\"}]",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/postgres/triggers"
   }
  },
  {
   "t": "15:54",
   "cap": "cap-19",
   "way": "sso_github",
   "capability": "Monitor/optimize query performance (advisors)",
   "task": "MCP get_advisors security and performance",
   "route": "mcp",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "{\"result\": {\"content\": [{\"type\": \"text\", \"text\": \"{\\\"result\\\":{\\\"lints\\\":[{\\\"name\\\":\\\"function_search_path_mutable\\\",\\\"title\\\":\\\"Function Search Path Mutable\\\",\\\"level\\\":\\\"WARN\\\",\\\"facing\\\":\\\"EXTERNAL\\\",\\\"categories\\\":[\\\"SECURITY\\\"],\\\"description\\\":\\\"Detects functions where the search_path parameter",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/database-advisors"
   }
  },
  {
   "t": "16:10",
   "cap": "cap-29",
   "way": "sso_github",
   "capability": "View API/database/function logs",
   "task": "MCP query_logs edge_logs (first call used wrong arg name \"service\": ZodError naming field \"sql\")",
   "route": "mcp",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "query_logs returned our own POST /rest/v1/items 201 with our user agent",
   "quality": {
    "docs_match": "drift",
    "error_legibility": "clear",
    "recoverable": "yes",
    "docs_url": "https://supabase.com/docs/guides/getting-started/mcp"
   },
   "notes": "map/docs name get_logs; server 0.14.0 exposes query_logs (ClickHouse SQL)"
  },
  {
   "t": "17:00",
   "cap": "cap-14",
   "way": "sso_github",
   "capability": "Send row changes to external HTTP endpoints (Webhooks)",
   "task": "AFTER INSERT trigger calling pg_net net.http_post to our own edge function hook-sink; insert a row; read net._http_response",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "net._http_response latest: status_code 200, content \"ok\"",
   "notes": "first try with supabase_functions.http_request (the Database Webhooks helper) failed: schema \"supabase_functions\" does not exist on a new project until webhooks are enabled in the dashboard; pg_net trigger worked",
   "quality": {
    "docs_match": "drift",
    "error_legibility": "clear",
    "recoverable": "yes",
    "docs_url": "https://supabase.com/docs/guides/database/webhooks"
   }
  },
  {
   "t": "17:03",
   "cap": "cap-21",
   "way": "sso_github",
   "capability": "Add multi-factor authentication (TOTP)",
   "task": "enroll TOTP factor for an app user, challenge, verify with computed code",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "POST /auth/v1/factors 200; challenge+verify 200; factor status verified; new JWT aal=aal2",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/auth/auth-mfa/totp"
   }
  },
  {
   "t": "17:03",
   "cap": "cap-24",
   "way": "sso_github",
   "capability": "Manage user sessions",
   "task": "POST /auth/v1/logout then try the refresh token",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "logout 204; refresh after logout -> {\"code\":400,\"error_code\":\"refresh_token_not_found\",\"msg\":\"Invalid Refresh Token: Refresh Token Not Found\"}",
   "notes": "session timeouts / single session settings are a paid (Pro) feature per map; not tried",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/javascript/auth-signout"
   }
  },
  {
   "t": "17:29",
   "cap": "cap-23",
   "way": "sso_github",
   "capability": "Customize Auth with hooks",
   "task": "custom access token hook: pg function adds claim, enable via PATCH /v1/projects/{ref}/config/auth, sign in, read JWT",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "PATCH config/auth 200; new JWT claim agentdrives=yes",
   "notes": "map says UI only; Management API config/auth exposes hook_* fields",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/auth/auth-hooks/custom-access-token-hook"
   }
  },
  {
   "t": "17:30",
   "cap": "cap-20",
   "way": "sso_github",
   "capability": "Add social/OAuth login providers",
   "task": "read auth config; GET /auth/v1/authorize?provider=github",
   "route": "api",
   "documented": true,
   "result": "partial",
   "verified": true,
   "evidence": "config external_github_enabled=False; authorize -> HTTP:400 \n[rc=0]",
   "notes": "Enabling a provider needs a GitHub OAuth app client id/secret we would have to create at GitHub; not done (outside our agent scope). PATCH config/auth external_github_* is the documented route.",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/auth/social-login/auth-github"
   }
  },
  {
   "t": "17:30",
   "cap": "cap-22",
   "way": "sso_github",
   "capability": "Configure Enterprise SSO (SAML 2.0)",
   "task": "GET /v1/projects/{ref}/config/auth/sso/providers",
   "route": "api",
   "documented": true,
   "result": "plan_gated",
   "verified": false,
   "evidence": "GET /v1/projects/{ref}/config/auth/sso/providers 200 {\"items\":[]}; org entitlements auth.saml_2 hasAccess=false (Free plan)",
   "notes": "Adding a SAML provider needs an IdP metadata URL of our own; we have none, so no provider was added. Pricing lists SAML SSO for Pro and up (not checked further)."
  },
  {
   "t": "18:09",
   "cap": "cap-25",
   "way": "sso_github",
   "capability": "Resumable large-file uploads (TUS)",
   "task": "TUS create, PATCH 6 MiB chunk, HEAD offset, PATCH rest, read object info",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "POST 201 Location; PATCH 204; HEAD upload-offset 6291456; PATCH 204; object info size 6291556",
   "notes": "first try with the new sb_secret_ key: create 201 but PATCH 403 {\"message\":\"Invalid Compact JWS\"}; works with the legacy service_role JWT. Docs show the JWT-based header.",
   "quality": {
    "docs_match": "drift",
    "error_legibility": "vague",
    "recoverable": "yes",
    "docs_url": "https://supabase.com/docs/guides/storage/uploads/resumable-uploads"
   }
  },
  {
   "t": "18:47",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-26",
   "capability": "Transform/resize images on the fly",
   "task": "upload 2x2 PNG to public bucket, GET /storage/v1/render/image/public/img/a.png?width=1",
   "route": "api",
   "result": "done",
   "verified": true,
   "evidence": "200 image/png, output IHDR width 1 (resized) on the Free plan",
   "notes": "org entitlements list storage.image_transformations hasAccess=false, yet the render endpoint resized the image",
   "quality": {
    "docs_match": "drift",
    "docs_url": "https://supabase.com/docs/guides/storage/serving/image-transformations"
   }
  },
  {
   "t": "18:47",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-16",
   "capability": "Branch the database",
   "task": "MCP get_cost type branch for our org",
   "route": "mcp",
   "result": "plan_gated",
   "verified": false,
   "evidence": "get_cost -> {\"type\":\"branch\",\"recurrence\":\"hourly\",\"amount\":0.01344}; creating a branch needs confirm_cost and is billed: not done under our no-spend rule"
  },
  {
   "t": "18:47",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-17",
   "capability": "Restore from backups / PITR",
   "task": "GET /v1/projects/{ref}/database/backups",
   "route": "api",
   "result": "plan_gated",
   "verified": false,
   "evidence": "200 {\"walg_enabled\":true,\"pitr_enabled\":false,\"backups\":[]}; entitlements pitr not available on Free; new project has no backup to restore yet"
  },
  {
   "t": "18:48",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-18",
   "capability": "Read replicas / Pipelines",
   "task": "GET /v1/organizations/{slug}/entitlements",
   "route": "api",
   "result": "plan_gated",
   "verified": false,
   "evidence": "entitlements instances.read_replicas hasAccess=false, replication.etl hasAccess=false (Free plan)"
  },
  {
   "t": "18:48",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-27",
   "capability": "Analytics/Iceberg buckets",
   "task": "GET entitlements",
   "route": "api",
   "result": "plan_gated",
   "verified": false,
   "evidence": "entitlements storage.iceberg_catalog hasAccess=false (Free plan)"
  },
  {
   "t": "18:48",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-31",
   "capability": "View usage against plan limits",
   "task": "GET /v1/organizations/{slug}/entitlements",
   "route": "api",
   "result": "done",
   "verified": true,
   "evidence": "200, 64 entitlements with hasAccess flags (e.g. custom_domain false, log.retention_days true)",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-get-organization-entitlements"
   }
  },
  {
   "t": "18:48",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-33",
   "capability": "Team members and roles",
   "task": "GET /v1/organizations/{slug}/members",
   "route": "api",
   "result": "done",
   "verified": true,
   "evidence": "200 one member AgentDrives-agent role Owner; inviting not tried (no messages to real people)",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/api/v1-list-organization-members"
   }
  },
  {
   "t": "18:48",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-37",
   "capability": "Custom domain",
   "task": "GET /v1/projects/{ref}/custom-hostname",
   "route": "api",
   "result": "plan_gated",
   "verified": false,
   "evidence": "{\"message\":\"Custom domains require the Custom Domain add-on, available on the Pro plan and above.\",\"error\":{\"code\":\"entitlement_required\",\"feature\":\"custom_domain\",\"upgrade_url\":\"https://supabase.com/dashboard/org/kgmppuqscmylfeysxecb/billing\"}}",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "18:54",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-30",
   "capability": "Log drains",
   "task": "GET entitlements",
   "route": "api",
   "result": "plan_gated",
   "verified": false,
   "evidence": "entitlements log_drains hasAccess=false (Free plan)"
  },
  {
   "t": "19:01",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-15",
   "capability": "Import existing data (CSV)",
   "task": "POST CSV body (Content-Type text/csv) to /rest/v1/notes; count rows",
   "route": "api",
   "result": "done",
   "verified": true,
   "evidence": "201; count of imported rows = 2",
   "notes": "PostgREST CSV bulk insert; psql/pg_restore not tried (direct Postgres port)",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/guides/database/import-data"
   }
  },
  {
   "t": "19:12",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-35",
   "capability": "Manage project secrets via CLI",
   "task": "supabase secrets set AGENT_FLAG=on / secrets list (CLI 2.121.0, SUPABASE_ACCESS_TOKEN env)",
   "route": "cli",
   "result": "done",
   "verified": true,
   "evidence": "secrets set: \"Finished supabase secrets set.\"; secrets list shows AGENT_FLAG with digest",
   "notes": "CLI traffic is not signed with Web Bot Auth (plain binary)",
   "quality": {
    "docs_match": "match",
    "docs_url": "https://supabase.com/docs/reference/cli/supabase-secrets-set"
   }
  },
  {
   "t": "20:07",
   "cap": "credentials",
   "way": "device_login",
   "capability": "CLI login (code flow)",
   "task": "supabase login --no-browser: open the printed link in our signed-in browser, type the shown code into the CLI",
   "route": "cli",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "CLI printed https://supabase.com/dashboard/cli/login?session_id=…; page \"Authorize Supabase CLI\" showed an 8-char code for agent@agentdrives.com without any click; entering it: \"Token cli_adrun@matfy-2_… created successfully\"; supabase projects list then listed our project",
   "notes": "Not RFC 8628 (no device_authorization_endpoint); needs a browser that is already signed in to read the code. Needs a TTY."
  },
  {
   "kind": "claim",
   "t": "20:43",
   "cap": "cap-01",
   "surface": "api",
   "claim": "POST /v1/projects (Management API)",
   "doc_url": "https://supabase.com/docs/reference/api/v1-create-a-project",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "201, project healthy in seconds; also created+deleted 2 more",
   "capability": "Docs claim: Create and run a Postgres project with tables",
   "task": "POST /v1/projects (Management API)",
   "route": "api",
   "evidence": "201, project healthy in seconds; also created+deleted 2 more"
  },
  {
   "kind": "claim",
   "t": "20:43",
   "cap": "cap-01",
   "surface": "mcp",
   "claim": "create_project / execute_sql",
   "doc_url": "https://supabase.com/docs/guides/getting-started/mcp",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "execute_sql ran DDL/queries; create_project not called (needs get_cost/confirm_cost round, and Free plan allows 2 active projects)",
   "capability": "Docs claim: Create and run a Postgres project with tables",
   "task": "create_project / execute_sql",
   "route": "mcp",
   "evidence": "execute_sql ran DDL/queries; create_project not called (needs get_cost/confirm_cost round, and Free plan allows 2 active projects)"
  },
  {
   "kind": "claim",
   "t": "20:43",
   "cap": "cap-01",
   "surface": "cli",
   "claim": "supabase init / supabase db push",
   "doc_url": "https://supabase.com/docs/reference/cli/supabase-db-push",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "init+link ok; first push refused: remote migrations from MCP apply_migration not in local dir (error named the repair command); after migration repair, push applied cli_t",
   "capability": "Docs claim: Create and run a Postgres project with tables",
   "task": "supabase init / supabase db push",
   "route": "cli",
   "evidence": "init+link ok; first push refused: remote migrations from MCP apply_migration not in local dir (error named the repair command); after migration repair, push applied cli_t"
  },
  {
   "kind": "claim",
   "t": "20:43",
   "cap": "cap-02",
   "surface": "api",
   "claim": "GET/POST/PATCH/DELETE /rest/v1/{table}",
   "doc_url": "https://supabase.com/docs/guides/api",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "full CRUD x3",
   "capability": "Docs claim: Query/manage data via auto-generated REST API",
   "task": "GET/POST/PATCH/DELETE /rest/v1/{table}",
   "route": "api",
   "evidence": "full CRUD x3"
  },
  {
   "kind": "claim",
   "t": "20:44",
   "cap": "cap-02",
   "surface": "mcp",
   "claim": "execute_sql",
   "doc_url": "https://supabase.com/docs/guides/getting-started/mcp",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "select/insert via execute_sql; results wrapped in untrusted-data boundary",
   "capability": "Docs claim: Query/manage data via auto-generated REST API",
   "task": "execute_sql",
   "route": "mcp",
   "evidence": "select/insert via execute_sql; results wrapped in untrusted-data boundary"
  },
  {
   "kind": "claim",
   "t": "20:44",
   "cap": "cap-03",
   "surface": "api",
   "claim": "POST /graphql/v1",
   "doc_url": "https://supabase.com/docs/guides/graphql",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "needs create extension pg_graphql first on a new project (\"pg_graphql extension is not enabled.\")",
   "capability": "Docs claim: Query data via auto-generated GraphQL API",
   "task": "POST /graphql/v1",
   "route": "api",
   "evidence": "needs create extension pg_graphql first on a new project (\"pg_graphql extension is not enabled.\")"
  },
  {
   "kind": "claim",
   "t": "20:44",
   "cap": "cap-04",
   "surface": "mcp",
   "claim": "apply_migration",
   "doc_url": "https://supabase.com/docs/guides/getting-started/mcp",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "RLS + policies applied",
   "capability": "Docs claim: Secure data with Row Level Security policies",
   "task": "apply_migration",
   "route": "mcp",
   "evidence": "RLS + policies applied"
  },
  {
   "kind": "claim",
   "t": "20:44",
   "cap": "cap-04",
   "surface": "cli",
   "claim": "supabase db push (migration)",
   "doc_url": "https://supabase.com/docs/reference/cli/supabase-db-push",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "migration with enable RLS + policy applied; pg_policies shows cli_read",
   "capability": "Docs claim: Secure data with Row Level Security policies",
   "task": "supabase db push (migration)",
   "route": "cli",
   "evidence": "migration with enable RLS + policy applied; pg_policies shows cli_read"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-04",
   "surface": "api",
   "claim": "SQL CREATE POLICY via /v1/projects/{ref}/database/query",
   "doc_url": "https://supabase.com/docs/reference/api/v1-run-a-query",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "policy rename/drop via SQL",
   "capability": "Docs claim: Secure data with Row Level Security policies",
   "task": "SQL CREATE POLICY via /v1/projects/{ref}/database/query",
   "route": "api",
   "evidence": "policy rename/drop via SQL"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-05",
   "surface": "api",
   "claim": "POST /auth/v1/signup, POST /auth/v1/token",
   "doc_url": "https://supabase.com/docs/reference/javascript/auth-signup",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "signup+mail+verify+password token; 3rd signup hit 429 over_email_send_rate_limit (built-in mailer)",
   "capability": "Docs claim: Sign up and sign in users (password, magic link, OTP, social, SSO)",
   "task": "POST /auth/v1/signup, POST /auth/v1/token",
   "route": "api",
   "evidence": "signup+mail+verify+password token; 3rd signup hit 429 over_email_send_rate_limit (built-in mailer)"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-06",
   "surface": "api",
   "claim": "POST /storage/v1/object/{bucket}/{path}",
   "doc_url": "https://supabase.com/docs/reference/javascript/storage-from-upload",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "upload/upsert/public download/delete x3",
   "capability": "Docs claim: Upload, store and serve files (buckets)",
   "task": "POST /storage/v1/object/{bucket}/{path}",
   "route": "api",
   "evidence": "upload/upsert/public download/delete x3"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-06",
   "surface": "cli",
   "claim": "supabase storage",
   "doc_url": "https://supabase.com/docs/reference/cli/supabase-storage-ls",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "storage ls ss:/// --experimental --linked listed tus/ img/",
   "capability": "Docs claim: Upload, store and serve files (buckets)",
   "task": "supabase storage",
   "route": "cli",
   "evidence": "storage ls ss:/// --experimental --linked listed tus/ img/"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-07",
   "surface": "api",
   "claim": "POST /functions/v1/{name}",
   "doc_url": "https://supabase.com/docs/guides/functions",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "invoke 200",
   "capability": "Docs claim: Deploy and invoke server-side TypeScript functions",
   "task": "POST /functions/v1/{name}",
   "route": "api",
   "evidence": "invoke 200"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-07",
   "surface": "mcp",
   "claim": "deploy_edge_function",
   "doc_url": "https://supabase.com/docs/guides/getting-started/mcp",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "deploy + redeploy x3",
   "capability": "Docs claim: Deploy and invoke server-side TypeScript functions",
   "task": "deploy_edge_function",
   "route": "mcp",
   "evidence": "deploy + redeploy x3"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-07",
   "surface": "cli",
   "claim": "supabase functions deploy",
   "doc_url": "https://supabase.com/docs/reference/cli/supabase-functions-deploy",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "--use-api (no Docker); invoke -> cli ok\nHTTP:200\n[rc=",
   "capability": "Docs claim: Deploy and invoke server-side TypeScript functions",
   "task": "supabase functions deploy",
   "route": "cli",
   "evidence": "--use-api (no Docker); invoke -> cli ok\nHTTP:200\n[rc="
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-07",
   "surface": "cli",
   "claim": "supabase functions serve",
   "doc_url": "https://supabase.com/docs/reference/cli/supabase-functions-serve",
   "result": "skipped",
   "verified": false,
   "documented": true,
   "notes": "needs Docker (local stack); no Docker in the drive sandbox",
   "capability": "Docs claim: Deploy and invoke server-side TypeScript functions",
   "task": "supabase functions serve",
   "route": "cli",
   "evidence": "needs Docker (local stack); no Docker in the drive sandbox"
  },
  {
   "kind": "claim",
   "t": "20:45",
   "cap": "cap-08",
   "surface": "api",
   "claim": "WebSocket realtime/v1 postgres_changes",
   "doc_url": "https://supabase.com/docs/guides/realtime/postgres-changes",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "INSERT event received x3",
   "capability": "Docs claim: Subscribe to live database changes (Postgres Changes)",
   "task": "WebSocket realtime/v1 postgres_changes",
   "route": "api",
   "evidence": "INSERT event received x3"
  },
  {
   "kind": "claim",
   "t": "20:46",
   "cap": "cap-09",
   "surface": "api",
   "claim": "WebSocket broadcast / POST /realtime/v1/api/broadcast",
   "doc_url": "https://supabase.com/docs/guides/realtime/broadcast",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "both socket and REST broadcast received x3",
   "capability": "Docs claim: Broadcast arbitrary low-latency messages between clients",
   "task": "WebSocket broadcast / POST /realtime/v1/api/broadcast",
   "route": "api",
   "evidence": "both socket and REST broadcast received x3"
  },
  {
   "kind": "claim",
   "t": "20:46",
   "cap": "cap-11",
   "surface": "api",
   "claim": "/rest/v1/rpc/{match_fn}",
   "doc_url": "https://supabase.com/docs/guides/ai/vector-columns",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "similarity search x3",
   "capability": "Docs claim: Store and query vector embeddings (pgvector) for semantic search",
   "task": "/rest/v1/rpc/{match_fn}",
   "route": "api",
   "evidence": "similarity search x3"
  },
  {
   "kind": "claim",
   "t": "20:46",
   "cap": "cap-11",
   "surface": "mcp",
   "claim": "execute_sql",
   "doc_url": "https://supabase.com/docs/guides/getting-started/mcp",
   "result": "done",
   "verified": true,
   "documented": true,
   "notes": "create extension via execute_sql (pg_trgm), vector via database/query",
   "capability": "Docs claim: Store and query vector embeddings (pgvector) for semantic search",
   "task": "execute_sql",
   "route": "mcp",
   "evidence": "create extension via execute_sql (pg_trgm), vector via database/query"
  },
  {
   "t": "21:01",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-28",
   "capability": "Realtime message size/channel limits",
   "task": "docs check + GET /v1/projects/{ref}/config/realtime",
   "route": "api",
   "result": "done",
   "verified": true,
   "evidence": "docs guides/realtime/settings: settings in the Realtime Settings screen, ceilings per plan (Realtime Limits); API: {\"private_only\":null,\"connection_pool\":2,\"postgres_changes_pool\":null,\"max_concurrent_users\":200,\"max_events_per_second\":100,\"max_bytes_per_second\":100000,\"max_channels_per_client\":100,\"max_joins_per_"
  },
  {
   "t": "21:01",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-32",
   "capability": "Spend cap",
   "task": "docs check",
   "route": "none",
   "result": "done",
   "verified": false,
   "evidence": "docs guides/platform/cost-control \"## Spend Cap ... determines whether your organization can exceed your subscription plan's quota\"; set in Dashboard org billing; no Management API operation for it in the OpenAPI (169 ops); Free plan has no usage billing to cap"
  },
  {
   "t": "21:01",
   "way": "sso_github",
   "documented": true,
   "cap": "cap-36",
   "capability": "Self-host via Docker",
   "task": "docs check",
   "route": "none",
   "result": "skipped",
   "verified": false,
   "evidence": "docs guides/self-hosting/docker: Docker + Docker Compose, docker compose pull; not installed: no docker in the drive sandbox",
   "edition": "selfhost"
  },
  {
   "t": "21:13",
   "cap": "signup",
   "way": "keyless",
   "capability": "way in: keyless",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "No keyless use: Management API, MCP and project APIs all need a token or project key (MCP 401 \"No access token provided\")"
  },
  {
   "t": "21:13",
   "cap": "signup",
   "way": "local",
   "capability": "way in: local",
   "route": "cli",
   "documented": true,
   "result": "skipped",
   "not_tried": "policy",
   "verified": false,
   "notes": "supabase start (local stack) needs Docker; no Docker in the drive sandbox"
  },
  {
   "t": "21:13",
   "cap": "signup",
   "way": "claimable",
   "capability": "way in: claimable",
   "route": "none",
   "documented": true,
   "result": "skipped",
   "not_tried": "no_kit",
   "verified": false,
   "notes": "OpenAPI has project-claim operations (GET /v1/oauth/authorize/project-claim, /v1/organizations/{slug}/project-claim/{token}) for an OAuth partner app to hand a project over; it needs a partner org account, no anonymous create"
  },
  {
   "t": "21:13",
   "cap": "signup",
   "way": "pay_per_call",
   "capability": "way in: pay_per_call",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "pay_tx.json: no 402 on Supabase hosts; pay_probe challenges []"
  },
  {
   "t": "21:13",
   "cap": "signup",
   "way": "api_signup",
   "capability": "way in: api_signup",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "No documented sign-up API: OpenAPI has no account/user create; /auth.md is the Supabase Auth product page, no agent registration (door_probe authmd registers false)"
  },
  {
   "t": "21:14",
   "cap": "signup",
   "way": "sso_agent",
   "capability": "way in: sso_agent",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "No Sign in with AgentID on the sign-up page (buttons: GitHub, ChatGPT, SSO, email+password)"
  },
  {
   "t": "21:14",
   "cap": "signup",
   "way": "email_code",
   "capability": "way in: email_code",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "Not offered: sign-up form has email + password only"
  },
  {
   "t": "21:14",
   "cap": "signup",
   "way": "magic_link",
   "capability": "way in: magic_link",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "Not offered on the dashboard sign-up"
  },
  {
   "t": "21:14",
   "cap": "signup",
   "way": "sso_google",
   "capability": "way in: sso_google",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "same_as",
   "verified": false,
   "notes": "No Continue with Google button on the sign-up page"
  },
  {
   "t": "21:15",
   "cap": "signup",
   "way": "sso_enterprise",
   "capability": "way in: sso_enterprise",
   "route": "browser",
   "documented": true,
   "result": "skipped",
   "not_tried": "assisted_only",
   "verified": false,
   "notes": "\"Continue with SSO\" needs a company IdP set up by a person"
  },
  {
   "t": "21:15",
   "cap": "signup",
   "way": "stripe_projects",
   "capability": "way in: stripe_projects",
   "route": "none",
   "documented": false,
   "result": "skipped",
   "not_tried": "no_kit",
   "verified": false,
   "notes": "projects.dev catalog lists supabase (pay_probe lead); our agent has no Stripe Projects account"
  },
  {
   "t": "21:15",
   "cap": "signup",
   "way": "oauth_consent",
   "capability": "way in: oauth_consent",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "notes": "MCP OAuth: DCR + PKCE + consent page in our signed-in browser; token used for MCP server/discover, tools/list and tools/call"
  },
  {
   "t": "23:03",
   "cap": "pay",
   "way": "sso_github",
   "capability": "pay probes",
   "task": "read pay_probe.json/pay_tx.json; billing in Management API",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "pay_probe: no 402 challenges, no MPP/x402 listings, Stripe Projects catalog lists supabase (lead), free plan; pay_tx: refused, no 402 on Supabase hosts. Management API has only project add-on ops (GET/PATCH/DELETE /v1/projects/{ref}/billing/addons); no plan-change operation. MCP tools: get_cost/confirm_cost only (cost confirmation for projects/branches), no upgrade tool. GET billing/addons -> {\"selected_addons\":[],\"available_addons\":[{\"type\":\"custom_domain\",\"name\":\"Custom Domain\",\"variants\":[{\"id\":\"cd_default\",\"name\":\"Custom Domain\",\"price\""
  },
  {
   "t": "23:03",
   "cap": "pay",
   "step": "checkout",
   "way": "sso_github",
   "capability": "walk to the last click",
   "task": "Billing > Change subscription plan > Upgrade to Pro",
   "route": "browser",
   "documented": true,
   "result": "blocked",
   "verified": true,
   "evidence": "Panel \"Confirm upgrade\": Charge today $25.00, Monthly invoice estimate $25.00; Stripe.js (js.stripe.com, pk_live) loaded; a visible hCaptcha puzzle (\"Tap the egg-laying animal\") opened over the panel as soon as Upgrade to Pro was clicked; screenshot browser/plan2.png. Stopped: no card and no CAPTCHA solving.",
   "notes": "no card on file; card form not reached because of the visible hCaptcha"
  },
  {
   "t": "23:03",
   "cap": "cancel",
   "way": "sso_github",
   "capability": "cancel plan",
   "task": "nothing to cancel",
   "route": "none",
   "documented": true,
   "result": "skipped",
   "verified": false,
   "evidence": "Drive used the Free plan only; nothing recurring started. Billing page offers Change subscription plan (downgrade in the dashboard)."
  },
  {
   "t": "23:18",
   "cap": "credentials",
   "key": "revoke",
   "way": "sso_github",
   "capability": "Revoke the key",
   "task": "DELETE /v1/projects/{ref}/api-keys/{id}, then use the key",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "DELETE 200; key afterwards -> {\"message\":\"Unregistered API key\",\"hint\":\"Double check the provided API key as it is not registered 401"
  },
  {
   "t": "24:32",
   "cap": "delete",
   "way": "sso_github",
   "step": "project",
   "capability": "Delete project and its data",
   "task": "DELETE /v1/projects/{ref}; read back; call its REST API",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "DELETE 200; GET 404 \"Resource has been removed\"; GET /v1/projects []; project REST -> 410 \"Project removed.\""
  },
  {
   "t": "24:44",
   "cap": "delete",
   "way": "oauth_consent",
   "step": "revoke",
   "capability": "Revoke MCP OAuth grant",
   "task": "POST /v1/oauth/revoke with refresh token; MCP tools/list after",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "revoke 204; MCP tools/list with the old access token -> 401 {\"message\":\"Invalid access token\"}"
  },
  {
   "t": "25:30",
   "cap": "delete",
   "way": "sso_github",
   "step": "organization",
   "capability": "Delete organization",
   "task": "Org settings > Delete organization, type slug, confirm",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "redirect to /dashboard/organizations; GET /v1/organizations -> [] (no Management API operation to delete an organization)"
  },
  {
   "t": "26:26",
   "cap": "delete",
   "way": "sso_github",
   "step": "tokens",
   "capability": "Delete access tokens",
   "task": "Access Tokens > More options > Delete token (CLI token, then the PAT)",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "CLI afterwards: {\"message\":\"Invalid access token\"}; Management API with the PAT -> 401 {\"message\":\"Invalid access token\"}",
   "notes": "No Management API operation to list or delete personal access tokens; the CLI token was created with no expiry (\"Never\")"
  },
  {
   "t": "28:01",
   "cap": "delete",
   "way": "sso_github",
   "step": "revoke",
   "capability": "Revoke GitHub grant",
   "task": "github.com/settings/connections/applications/<Supabase client> > Revoke access",
   "route": "browser",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "GitHub: \"Supabase has been revoked from your account.\""
  }
 ],
 "stale": false,
 "icon": "/logos/supabase.png",
 "monitored": false,
 "verdict": null,
 "page": "https://agentdrives.com/tools/supabase?via=api"
}