Connectors

The connectors block stores the MCP servers an organization lets its assistants call. Tokens never sit in these tables: a grant holds a credential_ref that a credential provider resolves, and removing a grant or its server revokes the credential.

better-supabase sql add connectors   # adds tenant and access as well

A server's auth type is none, header (an app credential sent as headers) or oauth (one grant per user). A header server's credentialRef must carry the server's tenant (tenant refs), or the save fails with CREDENTIAL_REF_FOREIGN. Server URLs must use https unless allowHttp is on, and sessions expire after sessionTtl (1 hour by default).

Exports leave out credential_ref on servers and grants. The organization purge in data lifecycle revokes a server's credential and each grant's (for the grant's user) before it deletes the rows, when the ref carries the organization; a grant ref without a tenant comes back in credentials.unrevoked.

Rename the keys with sql.modules.connectors.permissions.read, .use and .manage.

ServerCopy Anchor Link

import { vaultCredentials } from "better-supabase/credentials";
import {
  createConnectors,
  rpcTransport,
} from "better-supabase/blocks/connectors";

export const connectorsFor = (
  supabase: SupabaseClient,
  admin: SupabaseClient,
) =>
  createConnectors({
    transport: rpcTransport(supabase),
    service: rpcTransport(admin),
    credentials: vaultCredentials({ transport: rpcTransport(admin) }),
  });

servers.get(id) returns the caller's active grant with the server. grants.record runs as the service role after the provider stored the credential, and revokes the grant it replaces. grants.expiring(before) lists grants to renew.

Tool list changesCopy Anchor Link

A server can change its tools at any time. fingerprints.check records the digest of the tool list and returns its status: the first list of a server is approved, a later different list waits as pending until an admin approves or rejects it. With trustFirstUse: false the first list waits too. Until then the assistant gets none of the server's tools.

AI SDKCopy Anchor Link

better-supabase/ai-sdk/mcp runs the OAuth flow, connects to a server with the stored session and returns its tools.