supabase / mcp / 34123920962

96%

push

github

feat: add --http local HTTP entry to mcp-server-supabase (#401)

## What kind of change does this PR introduce?

Feature: a local Streamable HTTP entry (`--http`) for the MCP server.

## What is the current behavior?

The local server is stdio only. It needs a PAT in the client config,
cannot show elicitation dialogs, and the hosted handler only runs inside
platform. Matt asked for a local HTTP entry
[here](https://supabase.slack.com/archives/C051L8U2EJF/p1788277668621589).

## What is the new behavior?

- `--http` on the primary bin serves the tools over Streamable HTTP on
`http://127.0.0.1:3111/mcp`.
- The client sends a bearer PAT per request in `Authorization`; the
server stores nothing and has no token flag or env var.
- Runs with `legacy: 'stateless'`, so 2025-era clients keep working; one
stderr line per request names the protocol era.
- The startup banner prints a ready-to-paste `.mcp.json` snippet using
`${SUPABASE_ACCESS_TOKEN}`.
- Modern form-capable clients get cost-confirmation dialogs for
`create_project` and `create_branch`; legacy clients keep `get_cost` /
`confirm_cost`.
- `CONTRIBUTING.md` recommends `--http` for local development; stdio
stays documented as the alternative.

## How to Review

1. **CLI entry**
   - `packages/mcp-server-supabase/src/cli.ts`
- The `--http` branch: flag parsing, the `--access-token` rejection, and
the hand-off to the entry.

2. **Per-request pipeline**
   - `packages/mcp-server-supabase/src/transports/local-http-entry.ts`
- Bearer extraction, the 401 shape, the era log line, the banner, and
the `costConfirmation` wiring.

3. **Body cap and node adapter**
   - `packages/mcp-server-supabase/src/transports/local-http-entry.ts`
- `readJsonBody` owns the 4 MiB cap (413) and the -32700 parse-error
envelope for malformed JSON; `toNodeHandler` from
`@modelcontextprotocol/node` adapts the fetch handler to `node:http`.

4. **Shared handler option**
   - `packages/mcp-server-supabase/src/transports/http.ts`
- The n... (continued)

489 of 526 branches covered (92.97%)

Branch coverage included in aggregate %.

124 of 132 new or added lines in 1 file covered. (93.94%)

3448 of 3558 relevant lines covered (96.91%)

60.33 hits per line