How Supabase Agent Skills improves AI agent Postgres development

Supabase released Agent Skills to fix how AI coding agents handle Postgres tasks. You probably already know that AI agents lack context. Most models rely on training data that is months or years old. This causes them to skip Row Level Security policies or hallucinate non-existent CLI commands like supabase db execute. The new tool installs via a single command: npx skills add supabase/agent-skills. It provides a 100-line SKILL.md file that directs agents to verify everything against current documentation.

The skill includes a specific checklist of security requirements. It tells agents never to use user_metadata for authorization. It also forbids exposing the service_role_key on the frontend to prevent leaks. Views require security_invoker = true to avoid bypassing RLS. Finally, it mandates that UPDATE operations require a SELECT policy to work.

The tool targets Claude Code, Cursor, Codex, and Gemini CLI.

By implementing the Agent Skills open-source instructions, developers prevent AI models from skipping Row Level Security policies or using outdated CLI commands that frequently cause permission errors and silent failures during real-time database schema modifications and deployments.

Agents often skip security steps even when the correct guidance exists in the documentation. The skill instructs agents to use app_metadata instead of user_metadata. In Next.js environments, they must not expose the service_role_key in any NEXT_PUBLIC_ environment variable. Storage upsert operations require INSERT, SELECT, and UPDATE permissions. Without a SELECT policy, UPDATE operations silently return zero rows.

AI agents create different workloads than human users. They break work into many small reasoning steps. They run concurrently and retry automatically. They scale elastically. Because agents operate in bursts and perform many simultaneous reads and writes, they can overwhelm single-node databases.

In tests with 5,000 concurrent agents, PostgreSQL throughput dropped to 57 operations per second. CockroachDB maintained 130 operations per second at that same load.

Supabase Realtime leverages Postgres logical replication and Phoenix Channels to sync data. This architecture supports three patterns: database change subscriptions, presence tracking, and message broadcasting. Change subscriptions push model outputs to the UI via WebSockets. Presence shows active users. Broadcast sends ephemeral events. The SDK delivers four event types: INSERT, UPDATE, DELETE, and ANSWER. For UPDATE events, the old field only returns the primary key unless the user sets the table’s replica identity to "full".

Developers can modify schemas directly during development using the execute_sql MCP tool or the supabase db query CLI command. This approach avoids creating a new migration entry for every change. Once the schema stabilizes, the agent should run the Supabase database advisors to catch performance issues. Project admins can grant database access using Personal Access Tokens with expiry windows up to 90 days.

Supabase is an open-source alternative to Firebase. Firebase provides better offline support for mobile apps. Supabase provides a more predictable pricing model for read-heavy workloads. Firebase charges per document read, while Supabase uses compute and storage. The Free tier includes 500 MB of database storage and 50,000 monthly active users. However, Free projects pause after one week of inactivity.

Will this settle the debate between SQL and NoSQL for AI?

The Pro plan starts at $25 per month and includes 100,000 monthly active users and 8 GB of database size.