Supabase MCP can leak your entire SQL database

> They imagine a scenario where a developer asks Cursor, running the Supabase MCP, to "use cursor’s agent to list the latest support tickets"

What was ever wrong with select title, description from tickets where created_at > now() - interval '3 days'? This all feels like such a pointless house of cards to perform extremely basic searching and filtering.

I think the idea is the manager can just use AI instead of hiring competent developers to write CRUD operations.

This is clearly just an object example... it's doubtless that there are actual applications where this could be used. For example, "filter all support tickets where the user is talking about an arthropod".