Automic Vault Fork Notes

This repository is the Automic Vault fork of Supabase CLI.

Automic Vault is a macOS-first secret and execution control system that keeps sensitive credentials behind explicit human approval in the Automic Vault GUI app instead of exposing them directly to terminal tools.

This fork currently adds the following behavior on top of upstream supabase/cli:

• An isotope:supabase-cli package recipe that builds and signs both the Bun/TypeScript supabase launcher and the Go supabase-go helper.
• Direct macOS Keychain access from the signed supabase-go binary instead of github.com/zalando/go-keyring shelling out to /usr/bin/security, so Keychain trust is attached to the Supabase executable.
• A macOS-only automicvault Go build tag for the secure credential backend, while default upstream builds continue to use go-keyring.
• A hazard detector for insecure Supabase CLI installs, including the plaintext fallback token at ~/.supabase/access-token and Keychain ACLs that allow /usr/bin/security to read Supabase secrets.
• Test seams that keep the credential tests deterministic without touching the user's real Keychain.

The remainder of this README is the original upstream Supabase CLI README.

---

Supabase CLI

Supabase is an open source Firebase alternative. We're building the features of Firebase using enterprise-grade open source tools.

This repository contains all the functionality for Supabase CLI.

• Running Supabase locally
• Managing database migrations
• Creating and deploying Supabase Functions
• Generating types directly from your database schema
• Making authenticated HTTP requests to Management API

Getting started

Install the CLI

Available via NPM as dev dependency. To install:

npm i supabase --save-dev

To install the beta release channel:

npm i supabase@beta --save-dev

When installing with yarn 4, you need to disable experimental fetch with the following nodejs config.

NODE_OPTIONS=--no-experimental-fetch yarn add supabase

Note For Bun versions below v1.0.17, you must add supabase as a trusted dependency before running bun add -D supabase.

macOS

Available via Homebrew. To install:

brew install supabase/tap/supabase

To install the beta release channel:

brew install supabase/tap/supabase-beta
brew link --overwrite supabase-beta

To upgrade:

brew upgrade supabase

Beta channel:

brew upgrade supabase-beta

Windows

Available via Scoop. To install:

scoop bucket add supabase https://github.com/supabase/scoop-bucket.git
scoop install supabase

To install the beta release channel:

scoop install supabase-beta

To upgrade:

scoop update supabase

Beta channel:

scoop update supabase-beta

Linux

Available via Homebrew and Linux packages.

via Homebrew

To install:

brew install supabase/tap/supabase

To install the beta release channel:

brew install supabase/tap/supabase-beta
brew link --overwrite supabase-beta

To upgrade:

brew upgrade supabase

Beta channel:

brew upgrade supabase-beta

via Linux packages

Linux packages are provided in Releases. To install, download the .apk/.deb/.rpm/.pkg.tar.zst file depending on your package manager and run the respective commands.

sudo apk add --allow-untrusted <...>.apk

sudo dpkg -i <...>.deb

sudo rpm -i <...>.rpm

sudo pacman -U <...>.pkg.tar.zst

Other Platforms

You can also install the CLI via go modules without the help of package managers.

go install github.com/supabase/cli@latest

Add a symlink to the binary in $PATH for easier access:

ln -s "$(go env GOPATH)/bin/cli" /usr/bin/supabase

This works on other non-standard Linux distros.

Community Maintained Packages

Available via pkgx. Package script here. To install in your working directory:

pkgx install supabase

Available via Nixpkgs. Package script here.

Run the CLI

supabase bootstrap

Or using npx:

npx supabase bootstrap

The bootstrap command will guide you through the process of setting up a Supabase project using one of the starter templates.

Docs

Command & config reference can be found here.

Breaking changes

We follow semantic versioning for changes that directly impact CLI commands, flags, and configurations.

However, due to dependencies on other service images, we cannot guarantee that schema migrations, seed.sql, and generated types will always work for the same CLI major version. If you need such guarantees, we encourage you to pin a specific version of CLI in package.json.

Developing

To run from source:

# Go >= 1.22
go run . help