fix(mcp): resolve supabase MCP -32000 crash from missing peer deps#743
Conversation
@supabase/mcp-utils@0.5.0 declares @modelcontextprotocol/sdk and zod as peerDependencies; npx's temp-install never resolves peer-of-peer deps, so the server crashed on startup with ERR_MODULE_NOT_FOUND. Fix: pass all three packages via -p flags so npx installs them in the same temp env and the peer dep is satisfied. Also pins to 0.8.1 instead of @latest. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for familiarise ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .mcp.json.example configuration to pin the @supabase/mcp-server-supabase package to version 0.8.1 and explicitly includes peer dependencies using the npx -p flag. Feedback suggests pinning these peer dependencies to specific versions and using the modern --package flag instead of the legacy -p flag to ensure better compatibility and reliability.
| "-p", "@modelcontextprotocol/sdk", | ||
| "-p", "zod", | ||
| "-p", "@supabase/mcp-server-supabase@0.8.1", |
There was a problem hiding this comment.
To align with the goal of avoiding future broken releases (as stated in the PR description), consider pinning the peer dependencies to specific versions. Using the versions already present in the project's package.json (for zod) or the current stable major version (for the MCP SDK) ensures consistency and reliability. Additionally, the modern --package flag is preferred over the legacy -p flag for better compatibility with current npm versions.
"--package", "@modelcontextprotocol/sdk@^1.0.0",
"--package", "zod@^3.25.67",
"--package", "@supabase/mcp-server-supabase@0.8.1",
✅ Deploy Preview for familiarise ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughThe ChangesSupabase MCP Server Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.mcp.json.example:
- Around line 11-13: Update the peer dependency entries in .mcp.json.example to
pin specific tested versions for "`@modelcontextprotocol/sdk`" and "zod" instead
of leaving them unversioned; locate the lines with the "-p" flags (the entries
"-p", "`@modelcontextprotocol/sdk`" and "-p", "zod") and change them to include
the exact compatible versions you tested (e.g.,
"`@modelcontextprotocol/sdk`@x.y.z" and "zod@a.b.c") so they match the stability
intent of the already pinned "`@supabase/mcp-server-supabase`@0.8.1".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: dcd41639-6ef3-460e-98cc-1a25ab8cfa13
📒 Files selected for processing (1)
.mcp.json.example
| "-p", "@modelcontextprotocol/sdk", | ||
| "-p", "zod", | ||
| "-p", "@supabase/mcp-server-supabase@0.8.1", |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | ⚡ Quick win
Consider pinning peer dependency versions for reproducibility.
The peer dependencies @modelcontextprotocol/sdk and zod are installed without version constraints, which means npx will install the latest versions each time. This could lead to reproducibility issues if future versions introduce breaking changes or incompatibilities with @supabase/mcp-server-supabase@0.8.1.
Since the main package is pinned to 0.8.1 for stability, consider also pinning the peer dependency versions to match the versions that were tested and known to work with this release.
📌 Example with pinned peer dependency versions
If you determine the compatible versions (e.g., from testing or package documentation), you could pin them like this:
"args": [
"-y",
- "-p", "`@modelcontextprotocol/sdk`",
- "-p", "zod",
+ "-p", "`@modelcontextprotocol/sdk`@1.0.0",
+ "-p", "zod@3.22.0",
"-p", "`@supabase/mcp-server-supabase`@0.8.1",
"mcp-server-supabase"
],Replace 1.0.0 and 3.22.0 with the actual compatible versions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.mcp.json.example around lines 11 - 13, Update the peer dependency entries
in .mcp.json.example to pin specific tested versions for
"`@modelcontextprotocol/sdk`" and "zod" instead of leaving them unversioned;
locate the lines with the "-p" flags (the entries "-p",
"`@modelcontextprotocol/sdk`" and "-p", "zod") and change them to include the
exact compatible versions you tested (e.g., "`@modelcontextprotocol/sdk`@x.y.z"
and "zod@a.b.c") so they match the stability intent of the already pinned
"`@supabase/mcp-server-supabase`@0.8.1".
1 participant
Summary
@supabase/mcp-utils@0.5.0declares@modelcontextprotocol/sdkandzodas peerDependencies (not direct deps)npx's temp-install does not resolve peer dependencies of transitive packages, so the server always crashed at startup withERR_MODULE_NOT_FOUND: Cannot find package '@modelcontextprotocol/sdk'→ MCP error-32000npx -pto install all three packages into the same temp env, satisfying the peer dep at resolution time0.8.1instead of@latestto avoid picking up future broken releasesTest plan
.mcp.json.example→.mcp.json, fill inSUPABASE_ACCESS_TOKEN-32000/mcpto confirm supabase tools are listed🤖 Generated with Claude Code
Summary by CodeRabbit