Ship a Supabase change from chat with Grok Bot and Cursor

What you'll learn

• How a request you type in chat to Grok Bot becomes a real change on your Supabase project, built by Cursor
• How to add a simple safety check so every database change is scanned for security and performance problems

What you need

• A Supabase project for development or your course. Never use a production project for this guide.
• Cursor connected to the Supabase MCP server
• Grok Bot connected to Cursor
• An app that already uses that Supabase project (a simple posts app is perfect)
• About 15 minutes

If you have not connected Cursor to Supabase yet, follow the connection steps in our Practical guide: Agent Plugins with Supabase, then come back here.

The idea

You describe what you want in plain English, in chat. Grok Bot takes that request and hands it to Cursor as a clear piece of engineering work. Cursor then writes and runs the change on your Supabase project.

Cursor can do this because of the Supabase MCP server. MCP stands for Model Context Protocol. In plain words, it is the connector that lets an agent use Supabase's own tools: look at your tables, change your database, read logs and check its work.

You set up the access. The agent does the building.

Two more words you will see:

• Row Level Security (RLS): rules on a table that decide who can read or change each row. Without it, a table can be open to anyone who has your app's public key.
• Advisors: Supabase's built-in checks. The Security Advisor spots risks such as a table without RLS. The Performance Advisor spots things that will make your app slow, such as a missing index.

Steps

1. Point everything at a safe project

When you connect the Supabase MCP server, choose your development or course project only. Supabase recommends limiting the connection to a single project, so the agent cannot touch anything else in your account.

For this guide the agent needs to make changes, so do not switch on read-only mode for this connection. Keep Cursor asking you to approve each tool call while you learn, so you can see what it is about to do.

2. Connect Grok Bot to Cursor

Link Grok Bot to Cursor so that requests you send in chat are passed to Cursor to carry out. The exact screens can change, so follow the current instructions in Grok Bot and Cursor. Once linked, Grok Bot can hand work to Cursor on your behalf.

3. Add the safety rule

Before your first real change, ask the agent to set up a safety habit. Send this in chat:

"Add a Cursor rule for this project that always applies. After every database change, run the Supabase Security and Performance Advisors. If they report any problems, explain them to me in plain English and suggest a fix before carrying on."

This means every change is scanned straight away, not weeks later. Supabase recommends exactly this kind of rule.

4. Ask for your first feature

Now send a real request. Copy and paste this:

"Add comments to my posts. Anyone can read comments, but only signed-in users can write them. Make sure Row Level Security is turned on, then run the advisors and tell me what they found."

Grok Bot hands this to Cursor. Cursor looks at your existing tables, makes the change, checks that it worked and runs the advisors because of your rule.

5. Check the result in Supabase

Open your project in the Supabase dashboard and check three things:

• Table Editor: a new comments table is there, linked to your posts.
• RLS: the comments table shows that Row Level Security is on, with rules for reading and for writing.
• Advisors: open the Security Advisor and the Performance Advisor. They should come back clean. If something is listed, ask the agent in chat to explain it and fix it.

6. Try it in your app

Ask the agent to add a simple comment box under each post if it has not already. Then open your app:

• Signed out, you should see comments but not be able to post one.
• Signed in, you should be able to add a comment and see it appear.

If either of these is wrong, describe what you saw in chat and let the agent fix it.

Common mistakes

• Pointing at production. Always connect a development or course project. Mistakes there cost nothing.
• Skipping the RLS check. Do not trust a summary alone. Look in the dashboard and confirm RLS is on for every new table.
• Ignoring advisor warnings. A warning is the agent telling you something is open or slow. Read it and ask for a fix before moving on.

Going further

• Let a teammate send requests too. Requests can come from anyone on your team, in chat, without them needing to know which table holds what. Your safety rule still runs on every change.
• Add a daily check. Set up a read-only agent that looks over your project every day and reports problems. See Hire a Supabase monitoring agent.

Source: Supabase blog, 13 October 2026 and the Supabase MCP docs.