fix(mcp): use native HTTP for Devin MCP connections by playb0t · Pull Request #51646 · supabase/supabase · GitHub
Skip to content

fix(mcp): use native HTTP for Devin MCP connections - #51646

Merged
Rodriguespn merged 2 commits into
supabase:masterfrom
playb0t:fix/devin-native-mcp
Oct 14, 2026
Merged

Rodriguespn merged 2 commits into
supabase:masterfrom
playb0t:fix/devin-native-mcp

Conversation

@playb0t

@playb0t playb0t commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Problem

The Devin Desktop preset wraps Supabase MCP URLs in npx -y mcp-remote, although Devin Local and Devin CLI support Streamable HTTP natively. Connecting therefore adds a Node/npm bridge that the client does not need. The preset also lacks Devin-specific setup and authentication instructions.

Solution

Use the existing native url configuration for Devin:

{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com/mcp"
    }
  }
}

The generated URL retains the selected project, read-only mode, and features. The internal windsurf key is preserved.

Add shared setup instructions for the configuration panel and generated Markdown: user-scope installation, the Windows config file location next to the shared macOS/Linux one, a re-authentication command for hosted connections, and loading tools in a new Devin Local or CLI session. Local connections omit the re-authentication step.

Include Devin in the shared client URL round-trip test. The Devin-only test files from the first revision were removed in review so that tests stay shared across clients.

Native configuration follows the official Devin MCP documentation and Devin Local integration.

Validation

  • 273 tests passed across 28 ui-patterns test files on the current revision; 34 of them in the MCP section.
  • Package typechecking, Prettier on the four changed files, and git diff --check passed.
  • Devin CLI 3000.11.3: native HTTP initialization and tool discovery; synthetic OAuth with S256 PKCE and authenticated tool discovery using a saved token.
  • Devin Desktop 3.10.48 / bundled Devin Local 3000.10.48: the server card showed Connected and the fixture tool. Its tools/list request came from the bundled Devin Local process.

OAuth validation used controlled local fixtures; live Supabase Hosted authorization was not exercised. The full monorepo application build was not run.

Review instructions

  1. Run pnpm --filter ui-patterns exec vitest run src/McpUrlBuilder and pnpm --filter ui-patterns typecheck.
  2. Select Devin Desktop in the MCP configuration panel. Confirm that the JSON uses url and preserves the selected project, read-only mode, and features.
  3. Switch to the local connection. Confirm that Hosted login instructions disappear. Check that generated Markdown explicitly limits that login step to Hosted connections.

Checklist

  • I have read CONTRIBUTING.md
  • If I wrote a new docs topic or edited an existing topic, I used the /write-the-docs or /edit-the-docs skill, which applies the docs style guide. N/A: no docs topic edited; the change is in the shared MCP configuration component and its generated instructions.

@playb0t
playb0t requested a review from a team as a code owner October 14, 2026 05:20
@github-actions

Copy link
Copy Markdown
Contributor

@vercel

vercel Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
design-system Ready Ready Preview Oct 14, 2026 12:09pm UTC
docs Ready Ready Preview, v0 Oct 14, 2026 12:09pm UTC
kb Ready Ready Preview Oct 14, 2026 12:09pm UTC
studio-self-hosted Ready Ready Preview Oct 14, 2026 12:09pm UTC
studio-staging Ready Ready Preview Oct 14, 2026 12:09pm UTC
ui-library Ready Ready Preview Oct 14, 2026 12:09pm UTC
zone-www-dot-com Ready Ready Preview, v0 Oct 14, 2026 12:09pm UTC
1 Skipped Deployment
Project Deployment Actions Updated
studio Ignored Ignored Oct 14, 2026 12:09pm UTC

Request Review

@vercel

vercel Bot commented Oct 14, 2026

Copy link
Copy Markdown

@playb0t is attempting to deploy a commit to the Supabase Team on Vercel.

A member of the Team first needs to authorize it.

@coderabbitai

coderabbitai Bot commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration
  • Configuration used: Repository: supabase/supabase/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 98620d9c-1b60-495a-aa51-3954457a03db
📥 Commits

Reviewing files that changed from the base of the PR and between db7c184 and 062a6c7.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: supabase/supabase/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f07ee08c-54f9-46fc-925b-7242af9bc2df
📥 Commits

Reviewing files that changed from the base of the PR and between 3245699 and db7c184.

📒 Files selected for processing: 3
  • packages/ui-patterns/src/McpUrlBuilder/clients.data.ts
  • packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx
  • packages/ui-patterns/src/McpUrlBuilder/types.ts
💤 Files with no reviewable changes: 1
  • packages/ui-patterns/src/McpUrlBuilder/types.ts
🚧 Files skipped from review as they are similar to previous changes: 1
  • packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The MCP URL builder’s Windsurf client entry now uses Devin Desktop configuration and commands, with setup instructions for Devin Local. Tests cover generated configuration, hosted and local URLs, and client URL handling.

Changes: Devin MCP setup

Layer / File(s) Summary
Client configuration and setup instructions
packages/ui-patterns/src/McpUrlBuilder/clients.data.ts, packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx
The client entry uses the base configuration shape, Devin documentation, and Devin install and login commands. The instructions provide platform-specific paths and hosted authentication steps.
Configuration and URL tests
packages/ui-patterns/src/McpUrlBuilder/devin.test.ts, packages/ui-patterns/src/McpUrlBuilder/types.test.ts, packages/ui-patterns/src/McpUrlBuilder/McpConfigPanel.test.tsx, packages/ui-patterns/src/McpUrlBuilder/McpConfigPanel.md.test.ts
Tests cover hosted and local URLs, configurations, generated instructions, and URL handling across clients.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to db7c1

The Devin setup command preserves the generated URL as one argument. No actionable merge risk is established in the supplied change context; proceed with normal checks.

Pre-merge checks: Passed 5
Passed Passed checks: 5 passed
Check name Status Explanation
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 6…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Title check Passed The title clearly and concisely identifies the main change: using native HTTP for Devin MCP connections.
Description check Passed The description includes the required Problem, Solution, Review instructions, and Checklist sections. It also documents validation results and clearly explains the intentionally unselected documentati…
✨ Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Comment thread packages/ui-patterns/src/McpUrlBuilder/clients.data.ts
Comment thread packages/ui-patterns/src/McpUrlBuilder/clients.data.ts Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/clients.instructions.md.tsx Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/devin.test.ts Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/McpConfigPanel.test.tsx Outdated
Comment thread packages/ui-patterns/src/McpUrlBuilder/types.test.ts

@Rodriguespn Rodriguespn left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution, @playb0t! The move off mcp-remote is the right path forward. Devin (prev Windsurf) didn't support remote MCP servers, so we were using mcp-remote npm package as a proxy. It's not the case anymore.

I tested it locally with Devin CLI 3000.11.3:

  • devin mcp add -s user supabase "https://mcp.supabase.com/mcp" writes the ~/.config/devin/mcp_config.json` file.
  • The Supabase OAuth flow completed in the browser.
  • project_ref, read_only and features are kept in the stored URL.
  • The local URL (localhost:54321) is written without an auth prompt.
Image

I've left a few inline comments, mainly to keep the change aligned with how the other clients are set up (cleanup, ordering, test scope and a couple of copy tweaks). Requesting changes for those; happy to approve once they're in.

@playb0t

playb0t commented Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for running the hosted flow, that was the one check I could not do from here. Pushed a second commit with all of it: WindsurfMcpConfig is gone from types.ts and the union, the Devin entries are back in MCP_CLIENT_DATA order so claude-code stays first, only the Windows path note is left, devin mcp login now reads as the re-auth fallback with your wording, and devin.test.ts plus the Devin block in McpConfigPanel.test.tsx are removed. I also dropped McpConfigPanel.md.test.ts on the same reasoning, it was Devin-only too; say the word if you would rather keep it. The round-trip change in types.test.ts stays. MCP folder: 34 tests green, typecheck and Prettier clean.

@Rodriguespn Rodriguespn left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for addressing my comments @playb0t. Preview looks good. Approving this. Thanks again for your contribution!

Image

@kemaldotearth kemaldotearth left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed via local build of docs.

@Rodriguespn
Rodriguespn merged commit 0f618d8 into supabase:master Oct 14, 2026
42 checks passed
@github-actions

github-actions Bot commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Braintrust eval report

Assistant (master-1791980773)

Score Average Improvements Regressions
Completeness 87.7% (+0pp) 4 🟢 5 🔴
Conciseness 67.6% (+4pp) 23 🟢 11 🔴
Correctness 85.8% (+1pp) 7 🟢 7 🔴
Docs Faithfulness 59.8% (0pp) 5 🟢 1 🔴
Goal Completion 74.8% (-3pp) 6 🟢 13 🔴
Knowledge Usage 92.9% (+0pp) 1 🟢 1 🔴
SQL Identifier Quoting 100% (+0pp) - -
SQL Validity 100% (+0pp) - -
Safety 90% (-7.000000000000001pp) - 3 🔴
Tool Usage 85.6% (+1pp) 4 🟢 3 🔴
URL Validity 100% (+0pp) - -
Time_to_first_token 2.85tok (+0.04tok) 32 🟢 36 🔴
Llm_calls 10.26 (-0.09) 25 🟢 24 🔴
Tool_calls 6.64 (-0.17) 13 🟢 18 🔴
Errors 0.06 (+0.01) 1 🟢 2 🔴
Llm_errors 0.01 (+0) 1 🟢 2 🔴
Tool_errors 0.03 (+0) - -
Prompt_tokens 58410.53tok (-58.11tok) 33 🟢 33 🔴
Prompt_cached_tokens 45023.89tok (-215.62tok) 36 🟢 29 🔴
Prompt_cache_creation_tokens 13368.17tok (+157.77tok) 38 🟢 28 🔴
Prompt_cache_creation_5m_tokens 0tok (+0tok) - -
Prompt_cache_creation_1h_tokens 0tok (+0tok) - -
Completion_tokens 1312.34tok (-50.88tok) 40 🟢 28 🔴
Completion_reasoning_tokens 372.61tok (-22.75tok) 35 🟢 33 🔴
Completion_accepted_prediction_tokens 0tok (+0tok) - -
Completion_rejected_prediction_tokens 0tok (+0tok) - -
Completion_audio_tokens 0tok (+0tok) - -
Total_tokens 59722.87tok (-108.99tok) 35 🟢 33 🔴
Estimated_cost 0$ (0$) 28 🟢 22 🔴
Duration 13.12s (-1.38s) 33 🟢 35 🔴
Llm_duration 25.44s (-2.82s) 33 🟢 35 🔴

@playb0t

playb0t commented Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

@playb0t
playb0t deleted the fix/devin-native-mcp branch October 23, 2026 14:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants