From cefe3ae4c260c95cac81c1d95e547d3571d815b4 Mon Sep 17 00:00:00 2001 From: Matt Rossman <22670878+mattrossman@users.noreply.github.com> Date: Fri, 6 Nov 2026 17:44:01 -0500 Subject: [PATCH 1/4] chore: update MCP with Dependabot --- .github/dependabot.yml | 12 ++++++++++++ packages/core/src/index.ts | 11 ++++++++++- packages/core/src/mcp-version.test.ts | 18 ++++++++++++++++++ packages/platform-lite/package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 5 files changed, 46 insertions(+), 7 deletions(-) create mode 100644 packages/core/src/mcp-version.test.ts diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 67dfa3aa7..95bd63e3e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,3 +8,15 @@ updates: interval: "daily" commit-message: prefix: "chore(deps)" + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "cron" + cronjob: "0 * * * *" + allow: + - dependency-name: "@supabase/mcp-server-supabase" + cooldown: + exclude: + - "@supabase/mcp-server-supabase" + commit-message: + prefix: "chore(deps)" diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index 2cfe476f7..8a1abed0e 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -1,4 +1,7 @@ import vm from 'node:vm'; +import platformLitePackage from '../../platform-lite/package.json' with { + type: 'json', +}; import { createRequire } from 'node:module'; import { createHash, createHmac } from 'node:crypto'; import { execFile, execFileSync } from 'node:child_process'; @@ -1415,7 +1418,13 @@ async function getAvailablePort(): Promise { } export const ACCESS_TOKEN = 'eval-token'; -export const MCP_SERVER_VERSION = '0.16.0'; +export const MCP_SERVER_VERSION = z + .string() + .regex( + /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, + 'MCP version must be an exact stable version' + ) + .parse(platformLitePackage.devDependencies['@supabase/mcp-server-supabase']); // Well-formed but inert PAT used when a Supabase MCP server is docs-only: the // server requires a token to boot but never authenticates without a platform. const THROWAWAY_ACCESS_TOKEN = `sbp_${'0'.repeat(40)}`; diff --git a/packages/core/src/mcp-version.test.ts b/packages/core/src/mcp-version.test.ts new file mode 100644 index 000000000..5416b8394 --- /dev/null +++ b/packages/core/src/mcp-version.test.ts @@ -0,0 +1,18 @@ +import { afterEach, expect, it, vi } from 'vitest'; + +afterEach(() => { + vi.doUnmock('../../platform-lite/package.json'); + vi.resetModules(); +}); + +it('rejects a version range before configuring the MCP server', async () => { + vi.doMock('../../platform-lite/package.json', () => ({ + default: { + devDependencies: { '@supabase/mcp-server-supabase': '^0.16.1' }, + }, + })); + + await expect(import('./index.js')).rejects.toThrow( + 'MCP version must be an exact stable version' + ); +}); diff --git a/packages/platform-lite/package.json b/packages/platform-lite/package.json index a1523dc0c..96be10e54 100644 --- a/packages/platform-lite/package.json +++ b/packages/platform-lite/package.json @@ -29,7 +29,7 @@ }, "devDependencies": { "@modelcontextprotocol/server": "^2.4.0", - "@supabase/mcp-server-supabase": "^0.16.0", + "@supabase/mcp-server-supabase": "0.16.1", "@types/node": "catalog:", "openapi-typescript": "^7.8.0", "tsx": "^4.21.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a9f3d97c2..2d7dc859b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -377,8 +377,8 @@ importers: specifier: ^2.4.0 version: 2.4.0 '@supabase/mcp-server-supabase': - specifier: ^0.16.0 - version: 0.16.0(@modelcontextprotocol/server@2.4.0)(zod@4.6.7) + specifier: 0.16.1 + version: 0.16.1(@modelcontextprotocol/server@2.4.0)(zod@4.6.7) '@types/node': specifier: 'catalog:' version: 22.19.20 @@ -2182,8 +2182,8 @@ packages: vite: optional: true - '@supabase/mcp-server-supabase@0.16.0': - resolution: {integrity: sha512-wDOkM4h4hMks9XnFDaiUWtBxNXKjR8vHedTkL9NVuSsg9AE+xt7Tc3JoRclXGiSg3a8RxfGO1W7MfoRJ3dBJHg==} + '@supabase/mcp-server-supabase@0.16.1': + resolution: {integrity: sha512-iMKxko3/chtykeaAq2N7YkE0eeWJOv/zPGbhOFSiOKSIqvIHIDtr82fxTVKA3HP+e0yUu7Y4h+YIcHVh1E+EBg==} hasBin: true peerDependencies: '@modelcontextprotocol/server': ^2.0.0 @@ -6434,7 +6434,7 @@ snapshots: - supports-color - typescript - '@supabase/mcp-server-supabase@0.16.0(@modelcontextprotocol/server@2.4.0)(zod@4.6.7)': + '@supabase/mcp-server-supabase@0.16.1(@modelcontextprotocol/server@2.4.0)(zod@4.6.7)': dependencies: '@mjackson/multipart-parser': 0.10.1 '@modelcontextprotocol/node': 2.1.2(@modelcontextprotocol/server@2.4.0) From 2078facaef5786ed96b53ed95e09130e83837079 Mon Sep 17 00:00:00 2001 From: Matt Rossman <22670878+mattrossman@users.noreply.github.com> Date: Tue, 10 Nov 2026 16:20:20 -0500 Subject: [PATCH 2/4] chore: check MCP updates daily --- .github/dependabot.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 95bd63e3e..fe72e0dfa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,8 +11,7 @@ updates: - package-ecosystem: "npm" directory: "/" schedule: - interval: "cron" - cronjob: "0 * * * *" + interval: "daily" allow: - dependency-name: "@supabase/mcp-server-supabase" cooldown: From 98f67d4c192cc83603ae8e5337ce20021402c537 Mon Sep 17 00:00:00 2001 From: Matt Rossman <22670878+mattrossman@users.noreply.github.com> Date: Wed, 11 Nov 2026 16:39:37 -0500 Subject: [PATCH 3/4] refactor: export MCP version from platform-lite --- packages/core/src/index.ts | 12 ++---------- packages/core/src/mcp-version.test.ts | 8 ++++++++ packages/platform-lite/src/index.ts | 10 ++++++++++ 3 files changed, 20 insertions(+), 10 deletions(-) diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index 8a1abed0e..28db7287e 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -1,7 +1,4 @@ import vm from 'node:vm'; -import platformLitePackage from '../../platform-lite/package.json' with { - type: 'json', -}; import { createRequire } from 'node:module'; import { createHash, createHmac } from 'node:crypto'; import { execFile, execFileSync } from 'node:child_process'; @@ -36,6 +33,7 @@ import { createManagementApiClient, createPlatform, loadFunctionSeeds, + MCP_SERVER_VERSION, type ManagementApiClient, type PgServerHandle, type PlatformHandle, @@ -1418,13 +1416,7 @@ async function getAvailablePort(): Promise { } export const ACCESS_TOKEN = 'eval-token'; -export const MCP_SERVER_VERSION = z - .string() - .regex( - /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, - 'MCP version must be an exact stable version' - ) - .parse(platformLitePackage.devDependencies['@supabase/mcp-server-supabase']); +export { MCP_SERVER_VERSION }; // Well-formed but inert PAT used when a Supabase MCP server is docs-only: the // server requires a token to boot but never authenticates without a platform. const THROWAWAY_ACCESS_TOKEN = `sbp_${'0'.repeat(40)}`; diff --git a/packages/core/src/mcp-version.test.ts b/packages/core/src/mcp-version.test.ts index 5416b8394..74385d7ee 100644 --- a/packages/core/src/mcp-version.test.ts +++ b/packages/core/src/mcp-version.test.ts @@ -5,6 +5,14 @@ afterEach(() => { vi.resetModules(); }); +it('exports the same MCP version from platform-lite and core', async () => { + const platformLite = await import('@supabase-evals/platform-lite'); + const core = await import('./index.js'); + + expect(platformLite.MCP_SERVER_VERSION).toBeTypeOf('string'); + expect(core.MCP_SERVER_VERSION).toBe(platformLite.MCP_SERVER_VERSION); +}); + it('rejects a version range before configuring the MCP server', async () => { vi.doMock('../../platform-lite/package.json', () => ({ default: { diff --git a/packages/platform-lite/src/index.ts b/packages/platform-lite/src/index.ts index 02aa02678..13279b730 100644 --- a/packages/platform-lite/src/index.ts +++ b/packages/platform-lite/src/index.ts @@ -1,3 +1,6 @@ +import { z } from 'zod'; +import platformLitePackage from '../package.json' with { type: 'json' }; + export { createPlatform } from './app.js'; export type { PlatformHandle, ServerHandle, PgServerHandle } from './app.js'; export type { @@ -11,3 +14,10 @@ export type { ProjectInstance } from './project/ProjectInstance.js'; export { createManagementApiClient } from './management-api/client.js'; export type { ManagementApiClient } from './management-api/client.js'; export { loadFunctionSeeds } from './seed.js'; +export const MCP_SERVER_VERSION = z + .string() + .regex( + /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, + 'MCP version must be an exact stable version' + ) + .parse(platformLitePackage.devDependencies['@supabase/mcp-server-supabase']); From 382bc4a9846f403e0d96e961de9ce855f063c713 Mon Sep 17 00:00:00 2001 From: Matt Rossman <22670878+mattrossman@users.noreply.github.com> Date: Wed, 11 Nov 2026 16:48:45 -0500 Subject: [PATCH 4/4] refactor: import MCP version directly from platform-lite --- apps/framework/harness/mcp-tools.ts | 1 - apps/framework/scripts/mcp-demo.ts | 6 ++++-- packages/core/src/index.ts | 1 - packages/core/src/mcp-server.test.ts | 11 +++++------ packages/core/src/mcp-version.test.ts | 8 -------- 5 files changed, 9 insertions(+), 18 deletions(-) diff --git a/apps/framework/harness/mcp-tools.ts b/apps/framework/harness/mcp-tools.ts index b6977af04..18f7bd871 100644 --- a/apps/framework/harness/mcp-tools.ts +++ b/apps/framework/harness/mcp-tools.ts @@ -1,6 +1,5 @@ export { executorMcpServer, - MCP_SERVER_VERSION, supabaseMcpServer, } from '@supabase-evals/core'; export type { diff --git a/apps/framework/scripts/mcp-demo.ts b/apps/framework/scripts/mcp-demo.ts index 7bc2772a7..b784cc16d 100644 --- a/apps/framework/scripts/mcp-demo.ts +++ b/apps/framework/scripts/mcp-demo.ts @@ -12,8 +12,10 @@ import { createMCPClient } from '@ai-sdk/mcp'; import { Experimental_StdioMCPTransport as StdioMCPTransport } from '@ai-sdk/mcp/mcp-stdio'; import { openai } from '@ai-sdk/openai'; import { generateText, stepCountIs } from 'ai'; -import { createPlatform } from '@supabase-evals/platform-lite'; -import { MCP_SERVER_VERSION } from '../harness/mcp-tools.js'; +import { + createPlatform, + MCP_SERVER_VERSION, +} from '@supabase-evals/platform-lite'; const ACCESS_TOKEN = 'demo-token'; diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index 28db7287e..999ffc4a0 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -1416,7 +1416,6 @@ async function getAvailablePort(): Promise { } export const ACCESS_TOKEN = 'eval-token'; -export { MCP_SERVER_VERSION }; // Well-formed but inert PAT used when a Supabase MCP server is docs-only: the // server requires a token to boot but never authenticates without a platform. const THROWAWAY_ACCESS_TOKEN = `sbp_${'0'.repeat(40)}`; diff --git a/packages/core/src/mcp-server.test.ts b/packages/core/src/mcp-server.test.ts index 21d5ec26f..a32d8cde9 100644 --- a/packages/core/src/mcp-server.test.ts +++ b/packages/core/src/mcp-server.test.ts @@ -9,7 +9,10 @@ import { } from 'vitest'; import { execFile, execFileSync } from 'node:child_process'; import { promisify } from 'node:util'; -import { createPlatform } from '@supabase-evals/platform-lite'; +import { + createPlatform, + MCP_SERVER_VERSION, +} from '@supabase-evals/platform-lite'; import { rewriteLoopback } from './agents/shared.js'; import { mkdirSync, @@ -21,11 +24,7 @@ import { } from 'node:fs'; import { join, relative } from 'node:path'; import { tmpdir } from 'node:os'; -import { - MCP_SERVER_VERSION, - supabaseMcpServer, - supabaseMcpServerMounts, -} from './index.js'; +import { supabaseMcpServer, supabaseMcpServerMounts } from './index.js'; // Stub (not mutate) env so a pre-existing SUPABASE_MCP_SERVER_PATH is restored // per test. diff --git a/packages/core/src/mcp-version.test.ts b/packages/core/src/mcp-version.test.ts index 74385d7ee..5416b8394 100644 --- a/packages/core/src/mcp-version.test.ts +++ b/packages/core/src/mcp-version.test.ts @@ -5,14 +5,6 @@ afterEach(() => { vi.resetModules(); }); -it('exports the same MCP version from platform-lite and core', async () => { - const platformLite = await import('@supabase-evals/platform-lite'); - const core = await import('./index.js'); - - expect(platformLite.MCP_SERVER_VERSION).toBeTypeOf('string'); - expect(core.MCP_SERVER_VERSION).toBe(platformLite.MCP_SERVER_VERSION); -}); - it('rejects a version range before configuring the MCP server', async () => { vi.doMock('../../platform-lite/package.json', () => ({ default: {