feat: support edge function runtime logs in get_logs

[barryroodt]

Problem

The get_logs MCP tool only exposes edge function invocation logs (function_edge_logs). Edge function runtime logs — console.log output, the dashboard's per-function "Logs" view (function_logs) — are unreachable via MCP. Reported independently by two users in April; confirmed as a gap in logs.ts (Linear: AI-651).

The tool also still queries the deprecated BigQuery logs.all endpoint (Linear: AI-890 / platform PR supabase/platform#35096 context).

Changes

• New edge-function-runtime service on get_logs, returning edge function console output. edge-function keeps meaning invocation logs (backward compatible).
• ClickHouse migration (cloud): getLogs now calls /v1/projects/{ref}/analytics/endpoints/logs with ClickHouse SQL against the unified logs table (new getClickHouseLogQuery builder). The endpoint already exists in the generated management API types — no type regen.
• BigQuery builder removed. The legacy getLogQuery had no production callers (only getClickHouseLogQuery is wired into getLogs), and self-hosted routes through Studio's own copy of these queries, not this package. Dropped the builder, its tests, and the stale logs.all MSW handler (thanks @mattrossman for the catch).
• Prompt-injection guardrails: all get_logs output is now wrapped in the same UUID-salted <untrusted-data> boundary as execute_sql, extracted into a shared wrapWithUntrustedDataBoundary helper (log content is arbitrary user text).
• Tool description now names both edge function log kinds, states the 24h default window, and advises correlate-don't-poll.
• Tests: MSW handler for the new endpoint, service iteration extended, untrusted-data boundary asserted, new logs.test.ts covering the ClickHouse builder for every service.

Notes for reviewers

• branch-action maps to source = 'workflow_run_logs' with log_attributes['workflow_run'] — matches platform PR #35096 (source added to the endpoint 2 Jul). It's not yet in shared-data/log-constants.ts; flagged to the observability team to confirm.
• Divergence from platform PR #35096: this PR uses source = 'edge_logs' for the api service (per the ClickHouse logs query reference) where #35096 uses 'api', and it does not repurpose the existing edge-function value. Both raised on the Linear tickets.

Verification

AI-assisted (Claude + Codex via verified-swarm harness); human-reviewed by @barryroodt. Evidence:

• pnpm typecheck — clean
• CI=true pnpm test:unit — 174/174 pass (11 files)
• pnpm format:check (biome) — clean
• Independent 3-lens code review (ClickHouse SQL correctness vs. query reference, guardrail parity with execute_sql, API shape/backward compat) — findings adjudicated and folded in

Linear: AI-651, AI-890

🤖 Generated with Claude Code

[coveralls]

Coverage Report for CI Build 29495866070

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage increased (+0.08%) to 96.325%

Details

• Coverage increased (+0.08%) from the base build.
• Patch coverage: 45 of 45 lines across 6 files are fully covered (100%).
• 35 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

35 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
packages/mcp-server-supabase/src/platform/api-platform.ts	35	93.34%

---

Coverage Stats

Relevant Lines:	2879
Covered Lines:	2794
Line Coverage:	97.05%
Relevant Branches:	359
Covered Branches:	325
Branch Coverage:	90.53%
Branches in Coverage %:	Yes
Coverage Strength:	42.62 hits per line

---

💛 - Coveralls

[sourman]

THANKS @barryroodt

would you mind adding edge func name resolution to the tool before merge?

that way an agent can ask for the logs of x func instead of first grabbing the UUID (changes per deployment)

I did a sample implementation here https://github.com/sourman/supabase-mcp/tree/feat/function-logs-nameres
also added text search and limit to cap matches

I ran your PR against my live supabase though and it looks good.

[mattrossman]

I added the publish-preview to the PR to deploy a test build of the package, and verified it works end to end against staging in Claude Code.

@supabase/mcp-server-supabase@https://pkg.pr.new/@supabase/mcp-server-supabase@66fd246

I used the preview MCP build to deploy an edge fn hitting all 5 console levels, invoked it, and confirmed new MCP's get_logs(service: edge-function-runtime) returns each console.* line correctly leveled. Then reverted to latest MCP version and verified it couldn't read those logs.

[mattrossman]

Re:

BigQuery builder retained (getLogQuery, extended with the runtime case) — self-hosted deployments cannot use the ClickHouse endpoint and must keep the legacy path.

I think we're clear to remove this old BigQuery branch, because self-hosted retains its own copy of these queries in the supabase repo, invoked here in its SupabasePlatform implementation.

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@supabase/mcp-server-postgrest@6ccd113

pnpm add https://pkg.pr.new/@supabase/mcp-server-supabase@6ccd113

pnpm add https://pkg.pr.new/@supabase/mcp-utils@6ccd113

commit: 6ccd113

[barryroodt]

THANKS @barryroodt

would you mind adding edge func name resolution to the tool before merge?

that way an agent can ask for the logs of x func instead of first grabbing the UUID (changes per deployment)

I did a sample implementation here https://github.com/sourman/supabase-mcp/tree/feat/function-logs-nameres also added text search and limit to cap matches

I ran your PR against my live supabase though and it looks good.

Thanks so much for this @sourman, and for running it against your live project, that end to end confirmation is really reassuring 🙏

I've tracked your request (name resolution) as its own follow-up, with your branch linked as the reference implementation.

One thing I want to confirm in the follow-up is which log attribute to filter on so we capture a function's logs across all of its deployments in the window (the query exposes both function_id and deployment_id), and how slug/name best resolves to it. Your sample is a great starting point for working that out. The text search and match limit are lovely extras too, noted on the ticket as nice-to-haves.

[barryroodt]

I added the publish-preview to the PR to deploy a test build of the package, and verified it works end to end against staging in Claude Code.

@supabase/mcp-server-supabase@https://pkg.pr.new/@supabase/mcp-server-supabase@66fd246

I used the preview MCP build to deploy an edge fn hitting all 5 console levels, invoked it, and confirmed new MCP's get_logs(service: edge-function-runtime) returns each console.* line correctly leveled. Then reverted to latest MCP version and verified it couldn't read those logs.

Thanks for validating the update!

[barryroodt]

Re:

BigQuery builder retained (getLogQuery, extended with the runtime case) — self-hosted deployments cannot use the ClickHouse endpoint and must keep the legacy path.

I think we're clear to remove this old BigQuery branch, because self-hosted retains its own copy of these queries in the supabase repo, invoked here in its SupabasePlatform implementation.

Done and pushed in c48d1e4