Database · PostgreSQL
An AI agent for your Supabase database
Every Supabase project is a PostgreSQL database, so Caterfli connects to it with its guarded PostgreSQL connector — a database login, not your Supabase account or service-role key. It reads your schema, writes a read tool and a count tool for each table, and stops destructive SQL for a person to approve.
What you get
Supabase capabilities, under your rules
- ✓ Tables, columns, types and foreign keys are read directly
- ✓ A read tool and a count tool for every visible table
- ✓ Choose which tables an agent can see; a table added later is picked up automatically
- ✓ Read-only until you turn on write operations
- ✓ Schema changes, and an UPDATE or DELETE with no WHERE clause, are always refused
- ✓ Values are always bound parameters, never pasted into the SQL text
- ✓ Reads capped by row count and payload size, with a timeout set on the session
What you need to connect it
- Host, port, database and user from your project’s Connect panel — the session pooler (port 5432) works over IPv4
- The pooler username includes your project reference, as in postgres.abcdefghijkl
- A database password, ideally for a dedicated role with only the grants the agent needs
Discovered tools
What a Supabase connection turns into
discovery · Supabase
ready- list_customers read
- count_customers read
- create_orders create
- update_orders update
- delete_customers delete Approval
Illustrative table names. A new connection is read-only, so only the list and count tools exist until you allow writes.
Human approval
Destructive work waits for a person
approval
waiting- Tool
- delete_customers
- Operation
- DELETE
- Runs against
- Production Supabase
- Agent
- Support Agent
Exactly these values
{
"filters": {
"id": 100
}
}
Your decision applies to these values only. If anything about the call changes, it stops for approval again.
A delete stops for a person. The approval covers this call with these arguments, once.
Does Caterfli need my Supabase service-role key?
No. It connects to the PostgreSQL database directly with a database username and password. It never asks for Supabase API keys, and nothing goes through the Supabase REST API or your Supabase account.
Does Row Level Security apply to the agent?
RLS policies apply to whichever database role Caterfli connects as, exactly as they would to any other client. The postgres role owns your tables and is usually not bound by them, so connect as a dedicated role if you want RLS to limit the agent — or use Caterfli’s own row filters.
Which Supabase connection string should I use?
The session pooler or the direct connection. Avoid the transaction pooler on port 6543: the connector sets a statement timeout on its session, and a transaction pooler does not keep session settings between statements.
Can the agent change or delete data in my Supabase database?
Not unless you allow it. A new connection is read-only, so only list and count tools exist. When you turn writes on, schema changes and any UPDATE or DELETE without a WHERE clause are still refused, and a destructive tool waits for a person to approve each call by default.
Does the database have to be reachable from the internet?
No. Either allow-list Caterfli’s outbound IP address in your firewall or database access rules, or keep the database private and reach it through an SSH tunnel via a bastion host you control.
Can I limit which tables and rows the agent sees?
Yes. Untick a table to put it out of reach. Row filters limit a table to matching rows — for example orders where user_id = 5 — and rows outside a filter cannot be read, counted, updated or deleted.
Can the agent write its own SQL?
Only if you turn on ad-hoc SQL, which is off by default. The agent then gets one tool that runs a single validated statement: one statement only, an allow-listed verb, no schema changes. Ad-hoc SQL is switched off while any row filter is set.
Can the AI model see my database password?
No. The password is encrypted before it is stored and injected by the connector at the moment of a call. The model only ever sees tool names and argument schemas.
Connect Supabase to your first agent
Connect one system and read the agent Caterfli writes from it. There is a demo connection too, if you would rather look before you wire anything up.