A support ticket tells the agent to dump secret tables
With Supabase MCP running as service_role, injected text in a customer message could make Cursor's agent read and leak private tables.
- Agents
- Cursor, Supabase MCP
- Reported
- Source checked
- Tags
- mcp, database, rls, exfiltration
Symptom
Sensitive rows such as integration tokens show up in a customer-visible support thread after a developer asked the agent to list recent tickets.
Cause
The agent used the service_role key, which bypasses row-level security, and it read attacker-controlled ticket text as input, so the attacker's instructions ran with admin access.
Fix
Never connect agents with service_role or production credentials. Use a read-only, project-scoped MCP setup against non-production data, and approve every SQL call.
// MCP config: read-only, one project, dev data only
{
"mcpServers": {
"supabase": {
"url": "https://mcp.supabase.com/mcp?project_ref=DEV_REF&read_only=true"
}
}
}