Database

The company's app runs on a Supabase database that Cofounder manages. These commands work through your Cofounder login, so you never handle database passwords or keys yourself.

Every command targets the company's default database. Pass --resource with a database's name or id to pick another one, and --branch to work on a branch instead of production. cofounder database refs list shows the databases the company can use.

MCP	CLI	API
`database_refs_list`	`cofounder database refs list`	`GET /cofounder-cli/v1/company/database/refs`

Query it

cofounder database query "select count(*) from profiles"

MCP	CLI	API
`database_query`	`cofounder database query <sql>`	`POST /cofounder-cli/v1/company/database/query`

Queries are read-only: the database rejects anything that would change data. Make changes with migrations instead.

Change the schema

MCP	CLI	API
`database_migrations_list`	`cofounder database migrations list`	`GET /cofounder-cli/v1/company/database/migrations`
`database_migrations_apply`	`cofounder database migrations apply --environment staging --dry-run`	`POST /cofounder-cli/v1/company/database/migrations/up`

apply runs the migrations committed to the company repository, not files on your machine, so push them first. It targets production unless you pass --environment staging, and --dry-run previews it without changing anything. list shows which migrations the database has already run; check it before retrying an apply that didn't report a clear result.

Try changes on a branch

A branch is a separate copy of the database for trying changes without touching production.

MCP	CLI	API
`database_branches_list`	`cofounder database branches list`	`GET /cofounder-cli/v1/company/database/branches`
`database_branches_get`	`cofounder database branches get --branch <name>`	`GET /cofounder-cli/v1/company/database/branches/{branch}`
`database_branches_create`	`cofounder database branches create --branch-name <name> --git-branch <git-branch>`	`POST /cofounder-cli/v1/company/database/branches`
`database_branches_delete`	`cofounder database branches delete --branch <name>`	`DELETE /cofounder-cli/v1/company/database/branches/{branch}`

Branches are billed under the company's existing database billing. --git-branch ties the branch to a branch of the company repo. Pass --branch <name> to query, migrations list, functions list, secrets, or storage to work on it. If a delete doesn't report a clear result, check with branches get before trying again.

Functions and their secrets

For human secret entry, use the company's Secrets page in the CLI dashboard, select Database Edge Functions, and choose the managed database. An agent gets the canonical company-scoped link from the database_secrets destination in company_get().dashboard.destinations. It selects database mode; append an URL-encoded resource=<resource-name-or-id> query parameter to preselect the database. Include only company and resource selectors in the link. The user enters values there, and database_secrets_list confirms the configured names afterward. database_secrets_set is excluded from the OpenAI and Claude plugin catalogs. General /mcp, CLI, and API secret setting remain available.

MCP	CLI	API
`database_functions_list`	`cofounder database functions list`	`GET /cofounder-cli/v1/company/database/functions`
`database_functions_deploy`	`cofounder database functions deploy --environment prod --function-slug <name>`	`POST /cofounder-cli/v1/company/database/functions/deploy`
`database_functions_deploys_get`	`cofounder database functions deploys get --job-id <id>`	`GET /cofounder-cli/v1/company/database/functions/deploys/{job_id}`
`database_secrets_list`	`cofounder database secrets list`	`GET /cofounder-cli/v1/company/database/secrets`
`database_secrets_set`	`cofounder database secrets set --secrets-file <file>`	`POST /cofounder-cli/v1/company/database/secrets`

functions deploy ships the Edge Function committed to the company repository under that name, to staging or prod; local files are not read. It starts a deploy job and returns at once; in a terminal the CLI waits for it to finish (--wait forces this under --json, --no-wait skips it). Check a deploy later with functions deploys get. A deploy with no checked-in source, or one Supabase rejects, fails with the reason and exits 1. Use --no-verify-jwt for a function that should accept calls without an auth token. secrets set reads a JSON object of names and values from --secrets-file; secrets list returns names only, never values.

Storage

Storage paths look like ss:///<bucket>/<path>. Run ls with no path to list buckets.

cofounder database storage cp ./logo.png ss:///public/brand/logo.png --content-type image/png
cofounder database storage ls ss:///public/brand

MCP	CLI	API
`database_storage_buckets_list`	`cofounder database storage ls`	`GET /cofounder-cli/v1/company/database/storage/buckets`
`database_storage_objects_list`	`cofounder database storage ls ss:///<bucket>/<folder> --limit <n> --cursor <cursor>`	`GET /cofounder-cli/v1/company/database/storage/objects`
`database_storage_transfer`	`cofounder database storage cp <source> <destination> --upsert`	`POST /cofounder-cli/v1/company/database/storage/transfer`
`database_storage_move`	`cofounder database storage mv ss:///<bucket>/<from> ss:///<bucket>/<to>`	`POST /cofounder-cli/v1/company/database/storage/move`
`database_storage_remove`	`cofounder database storage rm ss:///<bucket>/<path>`	`POST /cofounder-cli/v1/company/database/storage/remove`

cp copies one file of up to 50 MiB in either direction: one side is a local path, the other a storage path. It won't overwrite an existing file unless you pass --upsert. The file goes straight between your machine and Supabase; over MCP, database_storage_transfer returns a signed link to upload or download with instead. ls returns one page at a time; pass the returned cursor to --cursor for the next. mv stays within one bucket.