As far as I am concerned, this is not a serious security hole if the human developer exercises common sense and uses widely recognized security precautions while developing their system.
As a platform, where do you draw the line between offering a product vs not because a developer could do something stupid with it?
edit: keeping in mind the use cases they are pushing in their documentation are for local development
MCP's goal is to make it easy for end user developers to impulsively wire agentically running LLM chats to multiple tools. That very capability fundamentally causes the problem.
Supabase's response (in the top comment in this post) of making it read-only or trying to wrap with an LLM to detect attacks... Neither of those help the fundamental problem at all. Some other tool probably has write capabilities, and the wrapping isn't reliable.
That's exactly the problem here: the ability for end users to combine MCP tools means that those end users are now responsible for avoiding insecure tool combinations. That's a really hard thing for end users to do - they have to understand the lethal trifecta risk in order to make those decisions.
Just like SQL injection attacks aren't something to worry about, right?
Have we learned nothing from three decades of internet security experience? Really? Yes. It seems we've learned nothing. I weep for the future.
We know this is how this works. We lived through it. Why on earth do you think the results will be any different this time?
If you are the person using the LLM tool, a prompt injection attack in a database row that you are allowed to view could trick your LLM tool into taking actions that you don't want it to take, including leaking other data you are allowed to see via writing to other tables or using other MCP tools.