The Goal
By the end of this blueprint you'll have a remote MCP server that any teammate can wire into Claude with one command. From then on:
"Save this prompt as 'incident postmortem template'."
"Pull up our
eval-rubricsnippet."
"What snippets has the team saved about RAG retrieval?"
…all just work — across machines and teammates — with the whole thing guarded by a single shared token you generate once and hand around.
The one decision that shapes everything
This blueprint is the easy sibling of Build a Shared-Skills MCP Server. That one wires up Supabase's full OAuth 2.1 server — dynamic client registration, a consent page you host, a JWT signing-key migration — so every request carries a specific user's identity and Postgres Row-Level Security decides who sees which snippet.
Here we make the opposite trade on purpose: one shared token, one shared library, no per-user identity.
| Aspect | OAuth version | This version |
|---|---|---|
| Auth | Supabase OAuth 2.1 + PKCE + consent page | One shared bearer token |
| Setup | Dashboard toggles, hosted consent page, key migration | Set three secrets, deploy |
| Identity | Per user (auth.uid()) | None — everyone is "the team" |
| Isolation | Private/workspace/public via RLS | One flat shared library |
| Revoke one person | Yes | No (rotate the token for everyone) |
| Time to live | An afternoon | ~15 minutes |
Be honest with yourself about the cost before you pick this: with a single token there are no private snippets, no "who wrote this," and no way to cut off one teammate without rotating the token for the whole team. Anyone holding the token can read, write, and delete everything. That's a perfectly good trade for a small trusting team, an internal tool, or a demo — and a bad one if you need real per-user boundaries. If you do, build the OAuth version instead.
Why "Snippets" and Not Real Claude Code Skills
A Claude Code skill is a directory with a SKILL file plus supporting files, loaded out of ~/.claude/skills/. Powerful, but the format is opinionated and pulls files from disk — awkward to model as a database row.
We store free-form prompt snippets: a title, a markdown body, tags, and an optional author label. Easy to author, search, and sync. Because the body is markdown, a thin script could later write each snippet to its own SKILL if you want them loaded as real skills.
The Stack
| Choice | Why |
|---|---|
| Supabase Edge Functions (Deno) | One supabase functions deploy, a Postgres database in the same project, free tier covers a small team. |
| TypeScript + Hono | Hono runs on Deno with clean middleware, and the MCP SDK ships TypeScript types. |
| Official MCP SDK | @modelcontextprotocol/sdk (pinned at 1.29.0) — handles the JSON-RPC plumbing and Streamable HTTP. |
| Postgres, one table | A single snippets table with RLS on and no policies, so only our function (via the service-role key) can reach it. |
Notice what's not in that list versus the OAuth build: no jose, no JWKS, no consent page, no auth server. That absence is the whole feature.
How the Pieces Fit Together
Every request is the same shape: Claude sends the shared token in a header (or on the URL), the function constant-time-compares it against the one it holds, and — if it matches — serves the request against the single snippets table. There's no discovery dance and no browser handoff, because there's no auth server to discover.
The MCP Surface We'll Expose
Tools (actions Claude can take):
list_snippets({ tag?, search?, limit? })— list the team's snippets.get_snippet({ id })— fetch one snippet's full body.save_snippet({ id?, title, body, tags?, author? })— create, or update whenidis given.delete_snippet({ id })— remove one.
Resources (data Claude can browse):
snippet://<id>— one snippet's full body as markdown.
Seven steps, end-to-end deployed.
What You'll Need Before Step 2
- A Supabase account (supabase.com — free tier is fine).
- The Supabase CLI:
brew install supabase/tap/supabase(or other install methods). - Docker Desktop, running —
supabase functions serveexecutes your function in a local container. - Node.js 18+ (Deno comes bundled with the Supabase CLI for the runtime).
- Claude Code or Claude Desktop installed.
Step 2 sets up the Supabase project and scaffolds the repo.