feat: form-mode cost confirmation via MCP elicitations

CONTRIBUTING.md

@@ -48,6 +48,19 @@ Configure your MCP client to run the local build. You may need to restart the se
 
 Optionally, configure `--api-url` to point at a different Supabase instance (defaults to `https://api.supabase.com`)
 
+## Testing
+
+```bash
+pnpm test              # unit and integration suites for all three packages
+pnpm test:coverage     # mcp-server-supabase, with coverage
+```
+
+### Packaging gates
+
+`scripts/` holds checks that span more than one package and run outside the pnpm workspace. `pnpm test:packed-platform-consumer` packs `@supabase/mcp-server-supabase` together with its workspace dependency `@supabase/mcp-utils`, installs both from real tarballs with plain `npm` in a temporary project, and drives the public surface there. Workspace resolution (`workspace:`, `catalog:`, symlinked `node_modules`) cannot reach that project, which is what makes it a test of the published artifact rather than of the checkout.
+
+Add a script here when a check needs more than one package, or needs to run from outside the workspace. Anything scoped to a single package belongs in that package's own `test` script.
+
 ## Releases
 
 Releases are automated via [release-please](https://github.com/googleapis/release-please). It tracks commits on `main` and opens a release PR when there are releasable changes (`fix:` or `feat:`). Merging that PR:

README.md

@@ -50,6 +50,13 @@ See the [Supabase MCP Server](https://supabase.com/mcp) docs for the full list o
 
 The docs also feature an interactive URL builder to populate configuration options for you.
 
+### Disable elicitations
+
+Disable form-mode elicitation for one connection while keeping the legacy `confirm_cost` flow:
+
+- **stdio CLI:** start the server with `--disable-elicitations`.
+- **Hosted URL:** add `disable_elicitations=true` to the connection URL query.
+
 ## Usage with AI SDK's MCP Client
 
 The `@supabase/mcp-server-supabase` package exports `createToolSchemas()` to populate input and output schemas for Vercel AI SDK's [MCP client](https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools). This allows Supabase MCP tools to be treated as static tools with client-side validation and inferred TypeScript types for their inputs and outputs.
@@ -110,6 +117,41 @@ const tools = await mcpClient.tools({
 
 For more information, see [Schema Definition](https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools#schema-definition) and [Typed Tool Outputs](https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools#typed-tool-outputs) in the AI SDK docs.
 
+## Self-hosting the MCP endpoint
+
+The `@supabase/mcp-server-supabase` package exports `createSupabaseMcpHandler()` to serve the tools over HTTP from your own endpoint. It accepts the same `SupabaseMcpServerOptions` as `createSupabaseMcpServer()`, most importantly `platform`.
+
+The handler speaks the current protocol revision only. It is created with `legacy: 'reject'`, so a client that only speaks the 2025-era protocol receives an HTTP 400 instead of being served.
+
+When `platform` carries a per-request credential, create the handler per request and close it when the response finishes. The handler closes over the `platform` you supply, so a shared one serves every request with that platform.
+
+A long-lived handler is fine when the `platform` is meant to be shared, a service-account token for example. Create it once and `close()` it at shutdown rather than per response, since `close()` tears down the subscription router and refuses later requests.
+
+```ts
+import { createServer } from 'node:http';
+import { toNodeHandler } from '@modelcontextprotocol/node';
+import { createSupabaseMcpHandler } from '@supabase/mcp-server-supabase';
+import { createSupabaseApiPlatform } from '@supabase/mcp-server-supabase/platform/api';
+
+const server = createServer((req, res) => {
+  const accessToken = getAccessTokenFromRequest(req); // your own auth
+
+  const handler = createSupabaseMcpHandler({
+    platform: createSupabaseApiPlatform({ accessToken }),
+  });
+
+  // `close()` aborts in-flight exchanges, so close on `res` finishing rather
+  // than when the handler resolves, which would cut streaming responses short.
+  res.on('close', () => {
+    handler.close().catch((error) => console.error(error));
+  });
+
+  toNodeHandler(handler)(req, res).catch((error) => console.error(error));
+});
+```
+
+`toNodeHandler` comes from `@modelcontextprotocol/node`, which is not a dependency of this package. Install it alongside.
+
 ## Other MCP servers
 
 ### `@supabase/mcp-server-postgrest`

package.json

@@ -3,6 +3,7 @@
     "build": "pnpm --filter @supabase/mcp-utils --filter @supabase/mcp-server-supabase --filter @supabase/mcp-server-postgrest build",
     "test": "pnpm --parallel --filter @supabase/mcp-utils --filter @supabase/mcp-server-supabase --filter @supabase/mcp-server-postgrest test",
     "test:coverage": "pnpm --filter @supabase/mcp-server-supabase test:coverage",
+    "test:packed-platform-consumer": "node scripts/test-packed-platform-consumer.mjs",
     "format": "biome check --write .",
     "format:check": "biome check ."
   },

packages/mcp-server-postgrest/README.md

@@ -92,10 +92,14 @@ pnpm add @supabase/mcp-server-postgrest
 
 #### Example
 
-The following example uses the [`StreamTransport`](../mcp-utils#streamtransport) to connect directly between an MCP client and server.
+The following example uses the [`StreamTransport`](../mcp-utils#streamtransport) to connect directly between an MCP client and server. It also needs `@modelcontextprotocol/client`, which is a separate package from the `@modelcontextprotocol/server` peer dependency and is not installed for you:
+
+```bash
+npm i @modelcontextprotocol/client
+```
 
 ```ts
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { Client } from '@modelcontextprotocol/client';
 import { StreamTransport } from '@supabase/mcp-utils';
 import { createPostgrestMcpServer } from '@supabase/mcp-server-postgrest';
 

packages/mcp-server-postgrest/package.json

@@ -37,11 +37,12 @@
     "@supabase/sql-to-rest": "^0.1.8"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "catalog:",
+    "@modelcontextprotocol/server": "catalog:",
     "zod": "catalog:"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "catalog:",
+    "@modelcontextprotocol/client": "catalog:",
+    "@modelcontextprotocol/server": "catalog:",
     "@supabase/auth-js": "^2.67.3",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/node": "^22.8.6",

packages/mcp-server-postgrest/src/server.test.ts

@@ -1,7 +1,8 @@
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { Client } from '@modelcontextprotocol/client';
 import { AuthClient } from '@supabase/auth-js';
 import { StreamTransport } from '@supabase/mcp-utils';
 import { describe, expect, test } from 'vitest';
+
 import { createPostgrestMcpServer } from './server.js';
 
 // Requires local Supabase stack running

packages/mcp-server-postgrest/src/stdio.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { parseArgs } from 'node:util';
+import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
+
 import { createPostgrestMcpServer } from './server.js';
 
 async function main() {

packages/mcp-server-supabase/package.json

@@ -60,14 +60,15 @@
     "openapi-fetch": "^0.13.5"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "catalog:",
+    "@modelcontextprotocol/server": "catalog:",
     "zod": "catalog:"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "catalog:",
     "@ai-sdk/mcp": "catalog:",
     "@electric-sql/pglite": "^0.2.17",
-    "@modelcontextprotocol/sdk": "catalog:",
+    "@modelcontextprotocol/client": "catalog:",
+    "@modelcontextprotocol/server": "catalog:",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/common-tags": "^1.8.4",
     "@types/node": "^22.8.6",

packages/mcp-server-supabase/server.json

@@ -92,6 +92,13 @@
           "format": "boolean",
           "isRequired": false
         },
+        {
+          "type": "named",
+          "name": "--disable-elicitations",
+          "description": "Disable form-mode elicitation",
+          "format": "boolean",
+          "isRequired": false
+        },
         {
           "type": "named",
           "name": "--features",