On Supabase, take the Supabase MCP server. It is the official surface, it covers more than the database, and the project-level permissions model is the right granularity for agent work. Pin it to a non-service-role token unless the work absolutely needs one.
On raw Postgres or RDS, the reference Postgres MCP is the cleanest answer. It is small, it is read-only by default, and it is the right base to fork from when you want a tenant-scoped variant.
The non-trivial answer: many teams run both. Supabase MCP for project work, Postgres MCP for analytical agents that should never write. Different servers, different scopes, different audit trails. The protocol is built for this composition.