feat: Add MCP elicitation for create project and branch tools #169

Rodriguespn · 2025-10-27T14:45:08Z

Summary

Implements MCP elicitation for the apply_migration tool to request user confirmation before applying database migrations.

Implementation

Uses a try-catch pattern to gracefully fallback when clients don't support elicitation:

Supporting clients: Show confirmation dialog with migration details and SQL preview
Non-supporting clients: Proceed with migration without confirmation (existing behavior)

Client Support

Currently supported: VS Code Copilot, Cursor, Postman, VT Code, fast-agent, mcp-use, MCPJam

Not yet supported: Claude Desktop, Claude.ai, GitHub Copilot coding agent

Pull Request Overview

This PR adds user confirmation prompts for database migrations using MCP's elicitation feature. When applying migrations, users will now be presented with the SQL to review and must explicitly confirm before the migration executes.

Key Changes:

Adds elicitation/create request to prompt users for confirmation before applying migrations
Passes server instance to database tools to enable elicitation requests
Maintains backwards compatibility by proceeding without confirmation if elicitation is not supported

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/mcp-server-supabase/src/tools/database-operation-tools.ts	Implements elicitation request for user confirmation with SQL review before migration execution
packages/mcp-server-supabase/src/server.ts	Passes server instance to getDatabaseTools to enable elicitation functionality

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/mcp-server-supabase/src/tools/database-operation-tools.ts

Copilot · 2025-10-27T14:47:39Z

packages/mcp-server-supabase/src/tools/database-operation-tools.ts

+                  },
+                },
+              },
+              // @ts-ignore - elicitation types might not be available


Using @ts-ignore suppresses all type checking for the next line. Consider using @ts-expect-error instead, which will fail if the error no longer exists, helping track when types become available.

Suggested change

// @ts-ignore - elicitation types might not be available

// @ts-expect-error - elicitation types might not be available

Rodriguespn · 2025-10-27T14:53:11Z

@mattrossman I've implemented elicitation on apply_migration as a POC. Would love to discuss the implementation and testing approach before rolling it out to the other high-priority tools (execute_sql, merge_branch, etc.).

packages/mcp-server-supabase/src/tools/database-operation-tools.ts

Rodriguespn · 2025-10-30T17:52:18Z

@mattrossman Added elicitation request to create_project and create_branch tools and hide the confirm_cost tool when the client supports elicitations.

You can check that the tool confirm_cost is not listed on a client that supports elicitation (VS Code) and is there for Claude Code (doesn't support elicitation.

VS Code Copilot (Supports Elicitation)

Claude Code (doesn't support elicitation)

packages/mcp-server-supabase/src/tools/branching-tools.ts

mattrossman · 2025-10-31T13:54:07Z

packages/mcp-server-supabase/src/tools/account-tools.ts

+export function getAccountTools({
+  account,
+  readOnly,
+  server,


Think this is unused now that it's accessing the server via ToolExecuteContext

mattrossman · 2025-10-31T15:57:08Z

packages/mcp-server-supabase/src/tools/account-tools.ts

          .enum(AWS_REGION_CODES)
          .describe('The region to create the project in.'),
        organization_id: z.string(),
-        confirm_cost_id: z


This parameter is what forces the agent to confirm cost prior to running create_project, I think we'd still need this at least for clients who don't support elicitation

- Implemented user confirmation dialog for apply_migration using MCP elicitation protocol - Added graceful fallback for clients that don't support elicitation - Tests pass with fallback behavior in test environment - Maintains backwards compatibility with all MCP clients

gregnr

Since elicitations are a major new feature, maybe it'd be best to implement them in just one place first and iterate in future PRs? e.g. this PR could only focus on apply_migration since that is relatively straightforward.

gregnr · 2025-11-03T17:10:31Z

packages/mcp-server-supabase/src/tools/account-tools.ts

-        'Gets the cost of creating a new project or branch. Never assume organization as costs can be different for each.',
+    get_and_confirm_cost: tool({
+      description: async () => {
+        const clientCapabilities = server?.getClientCapabilities();


getClientCapabilities() will not be reliable in our stateless http setup. Capabilities are sent on the init message, which will be lost on future messages. @mattrossman is capturing this in the session ID JWT though - do you have have thoughts on how we can inject this back into the server instance every request?

The SDK lets us populate it via ServerOptions in the server constructor as a fallback if no "initialize" message was received for the instance. That populates ._capabilities which is read in getClientCapabilities()

I figure we'd expose a capabilities option in our createMcpServer / createSupabaseMcpServer functions to forward to those server options.

Correct me if I'm wrong, but isn't server capabilities different from client capabilities? IIUC ServerOptions allows you to set server capabilities that are advertised to the client but not vice versa (_capabilities vs _clientCapabilities)

gregnr · 2025-11-03T17:14:49Z

packages/mcp-server-supabase/src/tools/account-tools.ts

-    get_cost: tool({
-      description:
-        'Gets the cost of creating a new project or branch. Never assume organization as costs can be different for each.',
+    get_and_confirm_cost: tool({


I was originally thinking:

If elicitations are supported, hide get_cost and confirm_cost tools, and run the elicitation directly on create_project and create_branch

If elicitations are not supported, keep both get_cost and confirm_cost as is

In practice having the elicitation in create_project felt odd to me because you have to approve a create_project tool call before knowing how much the project will cost or that a safety net will follow (Slack context).

@mattrossman pointed out that users might get confused and might even panic when they see create_project or create_branch running by the user without checking and confirming the cost (even hough that an elicitation request will prompt before creating the project/branch). I do agree with Matt on this because most users will be prompt to accept running create_project or create_branch

gregnr · 2025-11-03T17:19:40Z

packages/mcp-server-supabase/src/tools/database-operation-tools.ts

+            const result = await server.request(
+              {
+                method: 'elicitation/create',
+                params: {
+                  message: `You are about to apply migration "${name}" to project ${project_id}. This will modify your database schema.\n\nPlease review the SQL:\n\n${query}\n\nDo you want to proceed?`,
+                  requestedSchema: {
+                    type: 'object',
+                    properties: {
+                      confirm: {
+                        type: 'boolean',
+                        title: 'Confirm Migration',
+                        description:
+                          'I have reviewed the SQL and approve this migration',
+                      },
+                    },
+                    required: ['confirm'],
+                  },
+                },
+              },
+              ElicitResultSchema
+            );


I think we need to be careful about code flow with elicitations on stateless HTTP. Stateless HTTP is simulating bidirectional communication via requests and responses, but each new request has a brand new state so we need to make sure our mental model matches this in our implementations.

IIUC, elicitations are sent back via HTTP response? If yes, the result of the elicitation will be sent as a brand new request to the server and will never land back at this point in the code flow. Perhaps the best way to confirm this is to develop/test against a remote MCP server instead of stdio.

This comment suggests elicitations don't work with stateless :/

I'd think it run both requests in parallel (the outer tool call and the inner elicitation) but I guess keeping the tool call long-running w/o streaming isn't great.

Yup, looks like a blocker. From what I can piece together from the spec, server initiated requests need to come from the stateful SSE GET route (which we don't implement). The spec does say that POST responses can include server initiated requests, but only when responding with an SSE stream which always has to end with a server response anyways. I could be missing something but to me this means the only way to implement this is via SSE GET route + complex communication between multiple requests.

mattrossman · 2025-11-03T22:01:27Z

Tested in Cursor and Claude Code, the flow feels good in both.

Rodriguespn requested review from Copilot, gregnr and mattrossman October 27, 2025 14:46

Copilot AI reviewed Oct 27, 2025

View reviewed changes

mattrossman reviewed Oct 28, 2025

View reviewed changes

packages/mcp-server-supabase/src/tools/database-operation-tools.ts Outdated Show resolved Hide resolved

Rodriguespn force-pushed the pedrorodrigues/ai-142-explore-mcp-elicitations branch from 378ec95 to 9d0ff02 Compare October 30, 2025 17:48

Rodriguespn changed the title ~~feat: Add MCP elicitation for apply_migration tool~~ feat: Add MCP elicitation for create project and branch tools Oct 30, 2025

mattrossman reviewed Oct 31, 2025

View reviewed changes

packages/mcp-server-supabase/src/tools/branching-tools.ts Outdated Show resolved Hide resolved

mattrossman reviewed Oct 31, 2025

View reviewed changes

packages/mcp-server-supabase/src/tools/branching-tools.ts Outdated Show resolved Hide resolved

mattrossman reviewed Oct 31, 2025

View reviewed changes

packages/mcp-server-supabase/src/tools/branching-tools.ts Outdated Show resolved Hide resolved

mattrossman reviewed Oct 31, 2025

View reviewed changes

Rodriguespn and others added 5 commits October 31, 2025 17:55

add elicitation to create_project

65a5457

filter tools if client capabilities are not supported

681b453

elicitation support ot create_branch

0aed187

merge get_cost and confirm_cost tools

b739cfe

Rodriguespn force-pushed the pedrorodrigues/ai-142-explore-mcp-elicitations branch from ebc5843 to b739cfe Compare October 31, 2025 17:55

gregnr reviewed Nov 3, 2025

View reviewed changes

fix unit tests

9c65d6a

Rodriguespn marked this pull request as ready for review November 4, 2025 13:36

	// @ts-ignore - elicitation types might not be available
	// @ts-expect-error - elicitation types might not be available

feat: Add MCP elicitation for create project and branch tools #169

Are you sure you want to change the base?

feat: Add MCP elicitation for create project and branch tools #169

Uh oh!

Conversation

Rodriguespn commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation

Client Support

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Rodriguespn commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Rodriguespn commented Oct 30, 2025

VS Code Copilot (Supports Elicitation)

Claude Code (doesn't support elicitation)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gregnr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattrossman commented Nov 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Rodriguespn commented Oct 27, 2025 •

edited

Loading

Rodriguespn commented Oct 27, 2025 •

edited

Loading