Supabase's MCP is vulnerable to "lethal trifecta" attacks where LLMs with elevated DB access, exposed to user input, can be tricked into leaking sensitive data. Read-only mode helps but doesn't eliminate risk.
https://simonwillison.net/2025/Jul/6/supabase-mcp-lethal-trifecta/
