←back to thread

Supabase MCP can leak your entire SQL database

(www.generalanalysis.com)
780 points rexpository | 1 comments | 08 Jul 25 17:46 UTC | HN request time: 0.197s | source
Show context
mvdtnz ◴[08 Jul 25 19:15 UTC] No.44503093[source]▶
> They imagine a scenario where a developer asks Cursor, running the Supabase MCP, to "use cursor’s agent to list the latest support tickets"

What was ever wrong with select title, description from tickets where created_at > now() - interval '3 days'? This all feels like such a pointless house of cards to perform extremely basic searching and filtering.

replies(2): >>44503175 #>>44503522 #
1. achierius ◴[08 Jul 25 20:01 UTC] No.44503522[source]▶
This is clearly just an object example... it's doubtless that there are actual applications where this could be used. For example, "filter all support tickets where the user is talking about an arthropod".