supabase / mcp / 35227726693

97%

push

github

feat: URL-mode secret collection for create_edge_function_secret (#412)

## Why

Add an Edge Function’s third-party API key without pasting it into the
conversation.

## What changed

- Secret values are entered only in Dashboard, never the AI
client/model. Local HTTP enables this by default.
- Discovery requires modern per-request URL capability; existing
functions, read-only, auth and platform-support gates remain.
- Breaking: move confirmation signing to
`elicitation.requestState:{key,principal,ttlSeconds?}`
(`requestStateKey` becomes `key`).
- Optional `elicitation.confirmation:{enabledTools:readonly
ElicitationToolName[]}` selects unified cost/SQL forms; `enabledTools`
is explicit, with no implicit library all-tools default, and `[]`
disables forms.
- `elicitation.secretCollection:{connectUrlTemplate}` is independently
optional.

## How to test

**Optional manual checks—not reported as run.** Use existing credentials
and authorized test resources. Accepting cost/SQL actions or saving a
secret makes real writes and may incur costs.

Follow
[setup](https://github.com/supabase/mcp/blob/bdb744f21/CONTRIBUTING.md#development-setup),
install dependencies, then run `pnpm dev:http --port 3111 --api-url
https://api.supabase.green`.

Connect Inspector 2.5.0 Modern with both form and URL support to
`http://127.0.0.1:3111/mcp?project_ref=REF&read_only=false` with
`Authorization: Bearer <PAT>`; omit `features` and `skip_elicitations`
for normal local defaults.

- **Cost:** remove `project_ref` for an unscoped connection with account
tools available. On an eligible billable `create_project` path, inspect
and decline the confirmation to avoid creating a project. Restore
`project_ref=REF` for the SQL and secret checks.
- **SQL:** use disposable project/data you are authorized to modify.
Inspect and decline destructive `execute_sql`/`apply_migration`
confirmations.
- **Secret:** with Dashboard authentication/write permission and the... (continued)

640 of 681 branches covered (93.98%)

Branch coverage included in aggregate %.

359 of 363 new or added lines in 6 files covered. (98.9%)

4072 of 4174 relevant lines covered (97.56%)

89.82 hits per line