Database

Your app runs on a Supabase database that Cofounder manages. Your agent queries it, changes its schema, deploys functions, and manages files, all through your Cofounder login. You never handle database passwords or keys.

Your agent works on the company's default database and on production unless you name another database or a branch.

Query It

Ask your agent a question about your data and it runs the query:

cofounder database query "select count(*) from profiles"

Queries are read-only. Anything that would change data is rejected. Changes go through migrations.

Change the Schema

Your agent writes migrations, commits them to your repository, and applies them. Only migrations committed to the repository run, never files on someone's machine. Production is the default target. Your agent can apply to staging first and preview a run without changing anything. Every deploy also runs migrations (see Deploy).

Try Changes on a Branch

A branch is a separate copy of your database for trying changes without touching production. A branch can be tied to a branch of your repository. Your agent can query, migrate, deploy functions, set secrets, and manage storage on a branch. Branches are billed under the company's existing database billing.

Deploy Functions and Their Secrets

Edge Functions are server code that runs next to your database. Your agent deploys the function committed to your repository under a given name, to staging or production. Local files aren't read. Deploys take a moment, and your agent waits for the result. A function with no committed source, or one Supabase rejects, fails with the reason. A function can be set to accept calls without an auth token.

Your agent can set function secrets, and listing them shows names only, never values.

To enter a secret yourself, open Settings → Secrets in the dashboard and use Edge Function secrets under the database. Your agent gives you the link, with the database already selected, and confirms the names after you save.

Set Up Social Sign-In

Let your app's users sign in with an account they already have. Supported providers: bitbucket, discord, facebook, figma, github, google, kakao, linkedin_oidc, notion, slack, slack_oidc, spotify, twitch, twitter, x, and zoom. Use x for X's current OAuth 2.0 sign-in. twitter is its legacy OAuth 1.0a one. LinkedIn uses linkedin_oidc and Slack's OIDC sign-in uses slack_oidc. Apple, Azure, GitLab, Keycloak, and WorkOS aren't supported yet.

1. Your agent checks which providers are on and which have credentials.
2. It sends you a setup link. The link opens sign-in setup on the Secrets page with the database, the provider, and any branch already selected.
3. You register the callback URL with your OAuth app and save the client ID and secret on that page. Never paste a secret into chat or put one in a link.
4. Your agent turns sign-in on. Saving credentials doesn't change whether sign-in is on, and your agent can turn it off again.

Changing one provider keeps saved credentials, other providers, and email/password and SMTP settings. Your agent sees whether a secret is set, never its value. It reads the settings back after a change but doesn't test a sign-in. Sign-in email redirects and SMTP are set up under cofounder email auth.

Move Files In and Out of Storage

Storage holds your app's files, organized in buckets. Paths look like ss:///<bucket>/<path>.

cofounder database storage cp ./logo.png ss:///public/brand/logo.png --content-type image/png
cofounder database storage ls ss:///public/brand

• Your agent copies one file at a time, up to 50 MiB, in either direction.
• An existing file isn't overwritten unless your agent asks for that.
• Moving a file stays within one bucket.

Commands

Pass --resource with a database's name or id to use another database, and --branch <name> to work on a branch. Check migrations list or branches get before retrying an apply or a branch delete with an unclear result. functions deploy --no-verify-jwt deploys a function that accepts calls without an auth token. Over MCP, database_storage_transfer returns a signed link to upload or download with.