Run your Supabase project locally, with its real data

dbplex is a Mac app that copies your Supabase project to localhost: the database with its rows, the auth users, the storage files, the edge functions and the auth settings. It runs on the Supabase CLI with Studio and a mailbox for the emails your app sends. Production is only read.

Download for Mac Try it in your browser

For Apple Silicon Macs. 7 days free with every feature. No card and no account.

Runs on: The Supabase CLI 3.0, in Docker
Download: 51 MB, then about 6 GB of images
Needs: Docker Desktop and an Apple Silicon Mac
Production: Only read, never written to

What comes with a Supabase copy

Copied to your Mac

Your dataEvery table and row of your own schemas, masked where you choose.Needs the Database Password
Auth usersSign-in accounts and their identities, so your test logins still work.Needs the Secret Key
StorageYour buckets and their files, or the buckets alone, empty, with their access rules.Needs the Secret Key
Edge functionsFunction code and its settings.Needs the Access Token
Auth settingsEmail templates, sign-in providers and redirect URLs.Needs the Access Token

Left behind, and why

Vault secretsThey are encrypted with a key only your project has.
Function and OAuth secretsSupabase does not hand them back, so you set them again locally.
Role passwordsA dump holds none, so local roles have no password.
Rows of Supabase's own schemasThe services make them again when they start.
Storage files, on a masked pullA file could hold the personal data the masking hides.

After each pull the Connect tab lists what was left out.

What you paste

Four fields, all from your Supabase dashboard. Only the first two are needed for the data.

Project URLRequired

https://abcdefgh.supabase.coIn your project, choose Connect at the top.

Database PasswordRequired

••••••••••••The password of your project's Postgres database.

Secret KeyOptional

sb_secret_…For auth users and storage files. The legacy service_role key works too.

Access TokenOptional

sbp_…For edge functions and auth settings. It also reaches the database when your network has no IPv6.

Read only. Nothing is ever written to production.

You can also start from a dump file, or from an empty project.

Then point your app at the copy

The Connect tab gives the database URL, the API URL, the publishable and secret keys, and the anon and service keys, or all of them as a .env file.

Why not supabase start and db pull?

The Supabase CLI gives you the stack. dbplex runs the same stack and fills it with your project.

	The Supabase CLI	dbplex
Data	supabase start gives you an empty stack. You dump and restore the rows yourself.	Your real rows come with the first pull.
Schema	supabase db pull writes it into a migration file.	It comes with the data, and the Changes tab compares it with production.
Auth users and storage	A script of your own, through the API or a dump of the auth schema.	Copied, with a Secret Key.
Edge functions	Downloaded one at a time.	Copied, with an Access Token.
Fresh data	Dump and restore again.	One Refresh button.

What you can do with a Supabase copy

Browse tables and run SQLOn real rows, in the app, in Studio or with any Postgres client.
See the schema graphEvery table and the keys between them, drawn from the copy.
Get the migration scriptThe Changes tab compares the copy with production and writes the script in the order it must run. In beta.
Mask personal columnsEmails, names and other personal columns are masked as the copy is pulled. You confirm each one.
Read caught emailsSign-up and reset emails stop in the mailbox, not in a real inbox.
Browse storage filesEvery bucket and file, in the Storage tab.
Back up productionDaily or weekly, read-only, to a folder you choose. Each backup opens as a new copy.
Refresh from productionOne button replaces the copy with today's data.
Read the logsThe log of each service, in the Logs tab.

Saved states, branches and rehearsing a migration are not available for Supabase yet: its data is in Docker volumes that cannot be cloned. To go back, open a backup as a new copy.

A Supabase sandbox for your AI agent

Give Claude Code, Cursor, Codex or Windsurf a copy of production to test on, and let it break things. dbplex's built-in MCP server hands the agent your local Supabase copy, never production: it never sees your production credentials, and every tool it gets acts on local copies only.

Add it from the app's Settings. A copy is not walled off from the internet: cron jobs, webhooks and edge functions that come with it can still call outside services. dbplex lists each one it finds after a pull.

Run SQL on real rowsReads, writes and schema changes, on the copy only.
Get the migration scriptIt compares the copy with production, read-only, and gets the SQL for what changed. Nothing in dbplex runs it.
Personal columns maskedMasked as the copy is pulled, where you choose, before the agent reads a row.
Read the emails your app sentThe mailbox catches them, and the agent can read each one.
List storage filesEvery bucket, with its file counts and sizes.
Start over with today's dataIt can refresh the copy from production, and never sees the credentials.
Read the logsThe newest lines of the server log.

When agents had production instead

Questions about Supabase in dbplex

Can dbplex change my Supabase production database?

No. It only reads production to make your copy, and it has no push, sync or way to write anything back. The credentials stay in your Mac's Keychain.

Do I need Docker Desktop for Supabase?

Yes. A Supabase copy is the Supabase CLI's stack of containers, so Docker Desktop has to be running. The first pull downloads about 6 GB of images.

Do I need the Secret Key?

Only for auth users and storage files. With the project URL and the database password alone you get every table and row.

Can I save a state of a Supabase copy and roll back?

Not yet: its data is in Docker volumes that cannot be cloned. Make a backup instead, and open it as a new copy when you want to go back.

Does it copy Vault secrets and function secrets?

No. Vault secrets are encrypted with a key only your project has, and Supabase does not hand back function or OAuth secrets. The Connect tab lists what was left out so you can set it again.

Can I get the migration script for my Supabase changes?

Yes. The Changes tab compares your copy with production and writes the script in the order it must run. It is in beta, and dbplex never runs it on production.

Can my AI agent use the Supabase copy?

Yes. Add dbplex's MCP server to Claude Code, Cursor, Codex or Windsurf from the app's Settings. It can run SQL, read the emails your app sent, list storage files, get the migration script and refresh the copy. It cannot branch a Supabase copy yet. Every tool acts on local copies only, and the agent never sees your production credentials.