Trust Card · Static snapshot

supabase-community__supabase-mcp D

55/100 · 3 findings (1 critical) · scope excessive · Ranked #36 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream supabase-community/supabase-mcp @ 02ca542 (2026-09-08)

Score breakdown

security 45

permissions 20

provenance 80

reliability 85

stability 90

Score constrained by 1 critical and 2 high-severity findings.

Fix first (3 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `scripts/dev-http.mjs:10` Evidence: `const child = spawn(cmd, args, { cwd, stdio: 'inherit' });`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `packages/mcp-server-postgrest/src/server.ts:90` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `packages/mcp-server-supabase/src/content-api/graphql.ts:164` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).

Permissions

Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: Apache-2.0 · Lockfile: yes · Security policy: no · Signals: unverified origin

Independently scanned by the AgentTrust registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @eulogik/agenttrust scan https://github.com/supabase-community/supabase-mcp. Scores move with every upstream commit; pages refresh weekly. How scoring works.