@polymorphism-tech/morph-spec 4.11.1 → 4.13.0

package/framework/standards/infrastructure/supabase/mcp-setup.md

@@ -1,251 +1,141 @@
-# Supabase MCP Server Setup Guide
+# Supabase Local Development Guide
 
 > **Scope:** nextjs-supabase
 > **Layer:** 2 (on keyword)
-> **Keywords:** supabase, mcp, setup, model context protocol
-> **Load When:** supabase mcp setup keywords detected
+> **Keywords:** supabase, cli, local, docker, setup, migrations, psql
+> **Load When:** supabase setup keywords detected
 
-Direct database management from Claude Code via Model Context Protocol
-
-## What It Provides
-
-The Supabase MCP Server lets Claude Code interact directly with your Supabase project's database. This enables:
-
-- Running SQL queries and viewing results
-- Creating and managing database migrations
-- Inspecting table schemas, indexes, and RLS policies
-- Managing Supabase Auth, Storage, and Edge Functions
-- Schema diffing and migration generation
+Local-first database management via Supabase CLI and psql — always targeting the local Docker instance.
 
 ## CRITICAL WARNING
 
 ```
 ==========================================================
-  NEVER connect to a PRODUCTION Supabase project via MCP.
+  NEVER connect to a PRODUCTION Supabase project.
 
-  MCP provides direct database access. A single bad query
-  can DROP tables, DELETE data, or DISABLE RLS.
+  All database operations MUST target the local Docker
+  instance started via `npx supabase start`.
 
-  ONLY connect to:
-  - Local Supabase (supabase start)
-  - Development/staging projects
-  - Disposable test projects
+  Production schema may diverge from local (renamed tables,
+  columns, migrations). Local is the single source of truth
+  during development.
 ==========================================================
 ```
 
 ## Setup
 
-### 1. Get Your Supabase Connection Details
-
-From your Supabase Dashboard > Project Settings > API:
-- **Project URL**: `https://xxxxxxxxxxxx.supabase.co`
-- **Service Role Key**: `eyJhbGc...` (Settings > API > service_role key)
-
-For local Supabase (`supabase start`):
-- **Project URL**: `http://127.0.0.1:54321`
-- **Service Role Key**: Output from `supabase status`
-
-### 2. Configure Claude Desktop / Claude Code
-
-Add the Supabase MCP server to your configuration.
-
-**Claude Desktop** (`claude_desktop_config.json`):
-
-```json
-{
-  "mcpServers": {
-    "supabase": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@supabase/mcp-server-supabase@latest",
-        "--supabase-url",
-        "https://xxxxxxxxxxxx.supabase.co",
-        "--supabase-service-role-key",
-        "eyJhbGc...",
-        "--read-only"
-      ]
-    }
-  }
-}
-```
+### 1. Install Supabase CLI
 
-**Claude Code** (`.claude/settings.local.json`):
-
-```json
-{
-  "mcpServers": {
-    "supabase": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@supabase/mcp-server-supabase@latest",
-        "--supabase-url",
-        "https://xxxxxxxxxxxx.supabase.co",
-        "--supabase-service-role-key",
-        "eyJhbGc...",
-        "--read-only"
-      ]
-    }
-  }
-}
+```bash
+npm install -g supabase
+# or use npx (no global install needed)
+npx supabase --version
 ```
 
-### 3. Default: Read-Only Mode
-
-The `--read-only` flag is included by default. In this mode:
-
-| Operation | Allowed |
-|-----------|---------|
-| SELECT queries | Yes |
-| DESCRIBE / schema inspection | Yes |
-| LIST tables, policies, indexes | Yes |
-| INSERT / UPDATE / DELETE | No |
-| CREATE / ALTER / DROP | No |
-| Migration creation | No |
-
-To enable write access (development only), remove `--read-only`:
-
-```json
-{
-  "mcpServers": {
-    "supabase": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@supabase/mcp-server-supabase@latest",
-        "--supabase-url",
-        "http://127.0.0.1:54321",
-        "--supabase-service-role-key",
-        "your-local-service-role-key"
-      ]
-    }
-  }
-}
+### 2. Start Local Instance
+
+```bash
+npx supabase start
 ```
 
-Write mode should ONLY be used with local Supabase or disposable dev projects.
+This starts PostgreSQL, GoTrue (auth), Storage, and other services in Docker containers.
 
-## Available Tool Groups
+### 3. Get Connection Details
 
-The Supabase MCP Server exposes these tool groups:
+```bash
+npx supabase status
+```
 
-### Database Tools
+Output includes:
+- **DB URL**: `postgresql://postgres:postgres@127.0.0.1:54322/postgres` (port may vary)
+- **API URL**: `http://127.0.0.1:54321`
+- **anon key** and **service_role key** for local testing
 
-| Tool | Description |
-|------|-------------|
-| `list_tables` | List all tables in the project |
-| `list_extensions` | List installed PostgreSQL extensions |
-| `list_migrations` | List applied migrations |
-| `apply_migration` | Apply a new SQL migration |
-| `execute_sql` | Run arbitrary SQL (read-only by default) |
-| `get_migration_status` | Check pending vs applied migrations |
+> **Important:** The port (54322) may vary when running multiple Supabase instances. Always use `npx supabase status` to get the current DB URL — never hardcode it.
 
-### Auth Tools
+## Common CLI Commands
 
-| Tool | Description |
-|------|-------------|
-| `get_auth_config` | View auth provider configuration |
-| `list_auth_users` | List authenticated users |
+### Schema Inspection
 
-### Storage Tools
+```bash
+# Full schema dump
+npx supabase db dump --local --schema public
 
-| Tool | Description |
-|------|-------------|
-| `list_storage_buckets` | List storage buckets |
-| `get_storage_config` | View storage configuration |
+# List tables (from dump output)
+npx supabase db dump --local --schema public 2>/dev/null | grep "CREATE TABLE"
 
-### Project Tools
+# Detailed table schema via psql
+psql $DB_URL -c "SELECT column_name, data_type, is_nullable, column_default \
+  FROM information_schema.columns WHERE table_name = 'TABLE_NAME' ORDER BY ordinal_position"
 
-| Tool | Description |
-|------|-------------|
-| `get_project_config` | View project settings |
-| `get_project_api_keys` | View API keys |
+# Foreign key relationships
+psql $DB_URL -c "SELECT tc.table_name, kcu.column_name, ccu.table_name AS foreign_table, \
+  ccu.column_name AS foreign_column FROM information_schema.table_constraints tc \
+  JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name \
+  JOIN information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name \
+  WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = 'TABLE_NAME'"
 
-## Usage for Migrations and Schema Management
+# RLS policies
+psql $DB_URL -c "SELECT tablename, policyname, cmd, qual FROM pg_policies WHERE schemaname = 'public'"
 
-### Inspecting Current Schema
+# Indexes
+psql $DB_URL -c "SELECT indexname, indexdef FROM pg_indexes WHERE tablename = 'TABLE_NAME'"
+```
 
-Ask Claude Code to use the MCP tools:
+### Migrations
 
-```
-"Show me all tables and their RLS policies"
-"What indexes exist on the documents table?"
-"List all migrations applied so far"
-```
+```bash
+# Create a new migration
+npx supabase migration new add_status_to_leads
 
-### Creating Migrations
+# Apply pending migrations to local
+npx supabase migration up --local
 
-With write mode enabled on a local/dev project:
+# List applied migrations
+npx supabase migration list --local
 
-```
-"Create a migration to add a 'tags' column to the documents table"
-"Add an RLS policy so only tenant admins can delete documents"
-"Enable the pgvector extension and create the embedding column"
+# Reset local database (destructive — re-applies all migrations)
+npx supabase db reset
 ```
 
-The MCP server will generate and apply SQL migrations through Supabase's migration system.
+### Data Operations
 
-### Schema Diffing
+```bash
+# Run arbitrary SQL against local
+psql $DB_URL -c "SELECT * FROM leads LIMIT 5"
 
-```
-"Compare the current schema against the migration files"
-"Show me what would change if I apply the pending migration"
+# Seed data
+npx supabase db seed --local
 ```
 
 ## Usage with MORPH-SPEC Workflow
 
-During MORPH-SPEC phases, the MCP server is useful for:
+During MORPH-SPEC phases, the Supabase CLI is used for:
 
-| Phase | MCP Usage |
-|-------|-----------|
-| **Phase 2 (Design)** | Inspect existing schema to inform spec |
-| **Phase 4 (Tasks)** | Verify migration dependencies |
-| **Phase 5 (Implement)** | Apply migrations, verify RLS policies, test queries |
+| Phase | CLI Usage | Commands |
+|-------|-----------|----------|
+| **Phase 2 (Design)** | Inspect existing schema to inform spec | `npx supabase status` → `psql` queries |
+| **Phase 4 (Tasks)** | Verify migration dependencies | `npx supabase migration list --local` |
+| **Phase 5 (Implement)** | Apply migrations, verify RLS, test queries | `npx supabase migration up --local` + `psql` |
+| **Post-Implementation** | Verify RLS policies are correct | `psql` pg_policies queries |
 
 ### Example Workflow
 
 ```
-1. Design phase: "List current tables and extensions"
+1. Design phase: `npx supabase status` → `psql $DB_URL` to inspect schema
 2. Write migration SQL in supabase/migrations/
-3. Apply via MCP: "Apply migration 003_add_search_logs.sql"
-4. Verify: "Show RLS policies on search_logs table"
-5. Test: "Run SELECT * FROM search_logs LIMIT 5"
+3. Apply: `npx supabase migration up --local`
+4. Verify: `psql $DB_URL -c "SELECT policyname, cmd FROM pg_policies WHERE tablename = 'search_logs'"`
+5. Test: `psql $DB_URL -c "SELECT * FROM search_logs LIMIT 5"`
 ```
 
-## Security Best Practices
-
-1. **Always use `--read-only` unless actively running migrations**
-2. **Never store service_role keys in version control** -- use environment variables or a secrets manager
-3. **Use local Supabase for development** (`supabase start`) instead of cloud projects
-4. **Rotate keys if accidentally exposed** -- Supabase Dashboard > Settings > API > Regenerate
-5. **Restrict MCP to development machines only** -- never configure on CI/CD or shared servers
-6. **Review SQL before applying** -- the MCP server executes SQL with service_role privileges, bypassing all RLS
-
-### Environment Variable Alternative
-
-Instead of hardcoding keys in the config file:
-
-```json
-{
-  "mcpServers": {
-    "supabase": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@supabase/mcp-server-supabase@latest",
-        "--read-only"
-      ],
-      "env": {
-        "SUPABASE_URL": "${SUPABASE_URL}",
-        "SUPABASE_SERVICE_ROLE_KEY": "${SUPABASE_SERVICE_ROLE_KEY}"
-      }
-    }
-  }
-}
-```
+## Best Practices
 
-Set the environment variables in your shell profile or `.env` file (never committed).
+1. **Always use local Supabase** (`npx supabase start`) — never connect to remote/production
+2. **Use `npx supabase status`** to detect the DB URL dynamically — port may vary
+3. **Write migrations as SQL files** in `supabase/migrations/` — apply via CLI
+4. **Verify RLS after every table change** — missing policies are a CRITICAL security issue
+5. **Reset local DB when needed** — `npx supabase db reset` re-applies all migrations cleanly
 
 ---
 

package/framework/standards/integration/mcp/mcp-tools.md

@@ -10,9 +10,6 @@ Before using any MCP tool, check if it's available in the current session:
 // Pattern: Attempt the call — if the tool doesn't exist, Claude Code will report it
 // There is no "list MCPs" command; just try the most common operation
 
-// Supabase MCP
-await mcp__supabase__list_tables();
-
 // GitHub MCP
 await mcp__github__get_repo();
 
@@ -21,6 +18,10 @@ await mcp__context7__resolve_library_id({ libraryName: "react" });
 
 // Playwright (browser automation)
 await mcp__playwright__browser_navigate({ url: "https://example.com" });
+
+// Supabase — use CLI, not MCP (always target local Docker instance)
+// npx supabase status → get DB URL
+// psql <DB_URL> -c "SELECT ..."
 ```
 
 **Fallback rule:** If an MCP is not available, every phase has a manual alternative using Claude Code native tools (Read, Grep, Glob, Bash).
@@ -45,7 +46,7 @@ const repo = await mcp__github__get_repo();
 // Glob: "**/{package.json,*.csproj,*.sln,go.mod,Cargo.toml}"
 ```
 
-### Phase 1.5 (UI/UX) — Design References
+### Phase 2 (UI/UX) — Design References
 
 | MCP | Use Case | Example |
 |-----|----------|---------|
@@ -80,46 +81,41 @@ const docs = await mcp__context7__query_docs({
 // WebFetch for specific component API pages
 ```
 
-### Phase 2 (Design) — Schema & Architecture
+### Phase 3 (Design) — Schema & Architecture
 
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Supabase** | Database schema, tables, relationships, RLS | `mcp__supabase__get_table_schema({ table })` |
-| **Database MCPs** | PostgreSQL, MySQL, SQL Server schema | Provider-specific tools |
+| Tool | Use Case | Example |
+|------|----------|---------|
+| **Supabase CLI / psql** | Database schema, tables, relationships, RLS (local Docker) | `psql <DB_URL> -c "SELECT ..."` |
 | **Context7** | Library docs for architecture decisions | `mcp__context7__query_docs()` |
 | **GitHub** | Check existing code patterns, PRs | `mcp__github__search_code()` |
 
-```javascript
-// === SCHEMA ANALYSIS (Critical for contracts.cs) ===
+```bash
+# === SCHEMA ANALYSIS (Critical for contracts.cs) ===
+# Always target local Docker instance — never production.
 
-// 1. List all tables
-const tables = await mcp__supabase__list_tables();
+# 0. Get local DB URL (port may vary per instance)
+npx supabase status
+# → Extract "DB URL" line, e.g.: postgresql://postgres:postgres@127.0.0.1:54322/postgres
 
-// 2. Get schema for each relevant table
-const schema = await mcp__supabase__get_table_schema({ table: 'leads' });
-// → column_name, data_type, is_nullable, column_default
+# 1. List all tables
+npx supabase db dump --local --schema public 2>/dev/null | grep "CREATE TABLE"
 
-// 3. Get foreign key relationships
-const rels = await mcp__supabase__get_relationships({ table: 'leads' });
-// → foreign_table, foreign_column, constraint_type
+# 2. Get schema for each relevant table
+psql $DB_URL -c "SELECT column_name, data_type, is_nullable, column_default \
+  FROM information_schema.columns WHERE table_name = 'leads' ORDER BY ordinal_position"
 
-// 4. Run custom query for complex schema info
-const result = await mcp__supabase__query({
-  query: `SELECT column_name, data_type, is_nullable
-          FROM information_schema.columns
-          WHERE table_name = 'leads'
-          ORDER BY ordinal_position`
-});
+# 3. Get foreign key relationships
+psql $DB_URL -c "SELECT tc.table_name, kcu.column_name, ccu.table_name AS foreign_table, \
+  ccu.column_name AS foreign_column FROM information_schema.table_constraints tc \
+  JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name \
+  JOIN information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name \
+  WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = 'leads'"
 
-// 5. Check RLS policies (security-critical)
-const policies = await mcp__supabase__query({
-  query: `SELECT tablename, policyname, cmd, qual
-          FROM pg_policies
-          WHERE tablename = 'leads'`
-});
+# 4. Check RLS policies (security-critical)
+psql $DB_URL -c "SELECT tablename, policyname, cmd, qual FROM pg_policies WHERE tablename = 'leads'"
 ```
 
-**Fallback (no Supabase MCP):**
+**Fallback (local Supabase not running):**
 ```
 1. Grep: "\.from\(|\.select\(|SELECT |supabase\.|DbSet<" → find query files
 2. Read each query file → extract table/column names
@@ -127,7 +123,7 @@ const policies = await mcp__supabase__query({
 4. Read type files → map properties to database columns
 ```
 
-### Phase 3 (Clarify) — Validation & Research
+### Phase 4 (Clarify) — Validation & Research
 
 | MCP | Use Case | Example |
 |-----|----------|---------|
@@ -145,7 +141,7 @@ const docs = await mcp__context7__query_docs({
 // Fallback: WebSearch for library capabilities
 ```
 
-### Phase 4 (Tasks) — Planning & Organization
+### Phase 6 (Tasks) — Planning & Organization
 
 | MCP | Use Case | Example |
 |-----|----------|---------|
@@ -167,31 +163,36 @@ for (const task of tasks) {
 // gh issue create --title "T001: Create Entity Lead" --label "domain"
 ```
 
-### Phase 5 (Implement) — Build & Deploy
+### Phase 7 (Implement) — Build & Deploy
 
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Supabase** | Run migrations, create RLS policies | `mcp__supabase__query()` |
+| Tool | Use Case | Example |
+|------|----------|---------|
+| **Supabase CLI / psql** | Run migrations, create RLS policies (local Docker) | `npx supabase migration up --local` |
 | **GitHub** | Create PR, push branches | `mcp__github__create_pull_request()` |
 | **Context7** | Look up API usage during coding | `mcp__context7__query_docs()` |
 | **Playwright** | Smoke test deployed features, verify UI | `mcp__playwright__browser_navigate()` |
 | **Vercel** | Deploy, check logs, manage env vars | `mcp__vercel__list_projects()` |
-| **Azure** | Provision resources, check deployment status | Provider-specific |
-| **Docker** | Build images, manage containers | Provider-specific |
+| **Azure CLI** | Resource management, deployments | `az` commands |
+| **Docker CLI** | Build, run, compose, logs (local) | `docker` commands |
 
-```javascript
-// Run migration after implementing data model
-await mcp__supabase__query({
-  query: `ALTER TABLE leads ADD COLUMN status varchar(20) DEFAULT 'new'`
-});
+```bash
+# === SUPABASE (Migrations & RLS — local Docker) ===
 
-// Create RLS policy for new feature
-await mcp__supabase__query({
-  query: `CREATE POLICY "Users can view own leads"
-          ON leads FOR SELECT
-          USING (auth.uid() = user_id)`
-});
+# Create migration file
+npx supabase migration new add_status_to_leads
+# → Edit the generated SQL file in supabase/migrations/
 
+# Apply migration to local instance
+npx supabase migration up --local
+
+# Verify schema after migration
+psql $DB_URL -c "SELECT column_name, data_type FROM information_schema.columns WHERE table_name = 'leads'"
+
+# Verify RLS policies
+psql $DB_URL -c "SELECT policyname, cmd, qual FROM pg_policies WHERE tablename = 'leads'"
+```
+
+```javascript
 // Lookup API during implementation
 const docs = await mcp__context7__query_docs({
   libraryId: "/dotnet/efcore",
@@ -228,7 +229,7 @@ await mcp__vercel__manage_env_vars({
   target: ['production', 'preview']
 });
 
-// Fallback: Bash for migrations, gh CLI for PRs, vercel CLI for deployments
+// Fallback: Bash for gh CLI for PRs, vercel CLI for deployments
 ```
 
 ---
@@ -237,18 +238,18 @@ await mcp__vercel__manage_env_vars({
 
 | Need | MCP Tool | Native Alternative |
 |------|----------|--------------------|
-| Database schema | Supabase/DB MCP | Grep queries + Read types |
+| Database schema | Supabase CLI / psql (local Docker) | Grep queries + Read types |
 | Repo metadata | GitHub MCP | Bash `gh` CLI |
 | Library docs | Context7 | WebSearch + WebFetch |
 | Live page preview | Playwright MCP | WebFetch URL |
 | Page interaction (click, type, navigate) | Playwright MCP | Manual testing |
 | Responsive layout testing | Playwright MCP (`browser_resize`) | Manual testing |
 | Console error checking | Playwright MCP (`browser_console_messages`) | Browser DevTools |
-| Container ops | Docker MCP | Bash `docker` CLI |
-| Cloud resources | Azure MCP | Bash `az` CLI |
+| Container ops | Docker CLI (`docker ps`, `docker logs`, `docker compose`) | — |
+| Cloud resources | Azure CLI (`az resource`, `az deployment`) | — |
 | Vercel deployments | Vercel MCP | Bash `vercel` CLI |
 
-**Rule:** MCP tools provide structured data (JSON responses). Native tools require manual parsing. **Always prefer MCP when available** — fall back to native when not.
+**Rule:** MCP tools provide structured data (JSON responses). Native tools require manual parsing. **Always prefer MCP when available** — fall back to native when not. **Exceptions:** Supabase, Docker, and Azure always use their respective CLIs directly — never MCP.
 
 ---
 
@@ -333,30 +334,43 @@ await mcp__playwright__browser_file_upload({ ref: "s1e20", paths: ["/path/to/fil
 
 | Phase | Use Case | Tool |
 |-------|----------|------|
-| UI/UX (1.5) | Screenshot reference pages for design | `browser_navigate` + `browser_take_screenshot` |
-| UI/UX (1.5) | Inspect existing app structure | `browser_navigate` + `browser_snapshot` |
-| UI/UX (1.5) | Test responsive layouts | `browser_resize` + `browser_take_screenshot` |
-| Clarify (3) | Verify existing UI behavior | `browser_navigate` + `browser_snapshot` |
-| Implement (5) | Smoke test deployed features | `browser_navigate` + `browser_click` + `browser_snapshot` |
-| Implement (5) | Verify form flows end-to-end | `browser_fill_form` + `browser_click` + `browser_snapshot` |
-| Implement (5) | Check console errors after deploy | `browser_navigate` + `browser_console_messages` |
-| Implement (5) | Screenshot for recap.md | `browser_take_screenshot` |
+| UI/UX (2) | Screenshot reference pages for design | `browser_navigate` + `browser_take_screenshot` |
+| UI/UX (2) | Inspect existing app structure | `browser_navigate` + `browser_snapshot` |
+| UI/UX (2) | Test responsive layouts | `browser_resize` + `browser_take_screenshot` |
+| Clarify (4) | Verify existing UI behavior | `browser_navigate` + `browser_snapshot` |
+| Implement (7) | Smoke test deployed features | `browser_navigate` + `browser_click` + `browser_snapshot` |
+| Implement (7) | Verify form flows end-to-end | `browser_fill_form` + `browser_click` + `browser_snapshot` |
+| Implement (7) | Check console errors after deploy | `browser_navigate` + `browser_console_messages` |
+| Implement (7) | Screenshot for recap.md | `browser_take_screenshot` |
 
 ---
 
-### Supabase: Full Schema Discovery
+### Supabase: Full Schema Discovery (Local Docker via CLI)
 
-> **v4 config:** Remote OAuth — `{ "type": "http", "url": "https://mcp.supabase.com/mcp" }`. Authenticate via `/mcp` in Claude Code.
+> **Primary:** Supabase CLI + psql targeting local Docker instance (`npx supabase start`).
+> **Port detection:** Always use `npx supabase status` to get the DB URL — port may vary across instances.
 
-```javascript
-// Complete workflow for Phase 2 schema analysis
-const tables = await mcp__supabase__list_tables();
+```bash
+# Complete workflow for Phase 3 schema analysis
 
-for (const table of tables.filter(t => isRelevant(t))) {
-  const schema = await mcp__supabase__get_table_schema({ table: table.name });
-  const rels = await mcp__supabase__get_relationships({ table: table.name });
-  // → Write findings to schema-analysis.md
-}
+# 1. Get local DB URL
+npx supabase status  # → extract "DB URL" line
+
+# 2. List all tables
+npx supabase db dump --local --schema public 2>/dev/null | grep "CREATE TABLE"
+
+# 3. For each relevant table:
+psql $DB_URL -c "SELECT column_name, data_type, is_nullable, column_default \
+  FROM information_schema.columns WHERE table_name = 'TABLE_NAME' ORDER BY ordinal_position"
+
+# 4. Get relationships
+psql $DB_URL -c "SELECT tc.table_name, kcu.column_name, ccu.table_name AS foreign_table \
+  FROM information_schema.table_constraints tc \
+  JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name \
+  JOIN information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name \
+  WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = 'TABLE_NAME'"
+
+# → Write findings to schema-analysis.md
 ```
 
 ### Context7: Library Research
@@ -393,9 +407,9 @@ const results = await mcp__github__search_code({
 ## Security Considerations
 
 - **Never pass secrets** in MCP tool parameters (API keys, tokens, passwords)
-- **Supabase MCP** uses project-level auth — queries run with service role by default
+- **Supabase** uses CLI/psql targeting local Docker — never connect to production
 - **GitHub MCP** inherits the configured token's permissions
-- **Always validate MCP responses** before using in contracts or code generation
+- **Always validate tool responses** before using in contracts or code generation
 
 ---
 

package/framework/templates/IDE-SNIPPETS.md

@@ -72,7 +72,6 @@ Snippets will be available in the "MORPH Templates" group. Type the prefix and p
 |--------|----------|----------------|
 | `morph-service` | Service class (business logic) | `.cs` |
 | `morph-repository` | Repository class (data access) | `.cs` |
-| `morph-component` | Blazor component | `.razor` |
 | `morph-migration` | EF Core migration | `.cs` |
 | `morph-job` | Hangfire background job | `.cs` |
 
@@ -127,8 +126,8 @@ Snippets will be available in the "MORPH Templates" group. Type the prefix and p
 
 ```handlebars
 // Type: morph-if-else → Tab
-{{#if (eq STACK "Blazor")}}
-  // Blazor-specific code
+{{#if (eq STACK "Nextjs")}}
+  // Next.js-specific code
 {{else}}
   // Generic code
 {{/if}}
@@ -207,9 +206,6 @@ Edit `framework/templates/.vscode/morph-templates.code-snippets`:
 **3. Use Conditional Blocks for Stack-Specific Code**
 
 ```handlebars
-{{#if (eq STACK "Blazor")}}
-  @inject NavigationManager Navigation
-{{/if}}
 {{#if (eq STACK "Nextjs")}}
   import { useRouter } from 'next/navigation';
 {{/if}}