Use cases / Agents with database access
The tool that reads your database can also delete it.
Give an agent a database tool and it can run any query its access allows, including the ones that delete. Here is what you can switch off in Supabase, and how Stackduke makes a person check first.
Why it goes wrong
A read and a delete use the same tool.
To your agent, looking up one order and deleting every order are the same tool with different words in it. Allow the tool, and you allow both.
One tool does everything
A SQL tool runs any query your database allows. Reading, changing and deleting all go through it.
“Don’t touch production” is only a request
An agent can misread an instruction in its prompt, or ignore it. A real stop has to sit outside the agent.
Text in your data can steer the agent
What a query returns goes back to the agent, and text saved in your database can carry instructions. Supabase wraps results to make this harder, and says that is not foolproof.
Source: Supabase's MCP documentation
What was reported
It deleted the database during a code freeze.
Reported in July 2025 by the founder of SaaStr, about Replit’s coding agent, in his own words.
Source: heise online, July 2025
- 01
He told it to change nothing
Jason Lemkin, the founder of SaaStr, asked Replit’s coding agent for a code and action freeze.
- 02
The agent deleted the database
It deleted his production database anyway. He said it had also covered up problems with made-up data and reports.
- 03
It said the data was gone
The agent told him there was no way to roll back.
- 04
A backup brought it back
In fact a backup could be restored. The app was a demo, but real data was deleted.
- 05
Replit split the two databases
Replit’s CEO, Amjad Masad, announced that development and production databases would be kept apart automatically.
With Stackduke
A person sees the delete before it runs.
Say your data agent tries to run DROP TABLE orders on your production project. Stackduke checks the call before it reaches the database. Your rule says any SQL on production waits for a person, so the exact statement goes to someone on your team. They approve that one call, or turn it down.
What it covers
What Stackduke covers.
Stackduke
Each MCP call is checked against your rules before it runs.
- Your agent’s MCP calls go through Stackduke, so each one is checked before it reaches the database.
- Your rules decide each call by agent, tool, project and what the call contains: let it through, hold it for a person, or block it.
- A person approves the exact call they saw, and only that call runs.
Free tools
Open source or public, and free to use.
- The tracker lists the tools official database MCP servers offer, such as Firestore’s and Bigtable’s, and shows what changes.
- The open-source scanner labels each tool a server offers, so you can see which ones can change or delete data.
Not covered
Stackduke does not do these. Plan for them another way.
- Commands an agent runs in its own workspace. Replit’s agent deleted the database that way, and Stackduke only sees MCP calls.
- Telling a safe query from a harmful one. A rule can hold every SQL call on a project, but Stackduke does not read the SQL to judge it.
- Backups. Stackduke does not copy or restore your data.
What you can do now
Lock it down in Supabase too.
Supabase has its own settings for this, set in the server’s address. We recommend starting read-only and on one project, and connecting to production only when the job needs it.
https://mcp.supabase.com/mcp?read_only=trueAdd read_only=true to the address, so every query runs as a read-only Postgres user.
&project_ref=<your-project>Add project_ref to tie the server to one project, which also turns off the account tools.
&features=databaseTurn on only the tool groups the agent needs with features, and connect to production only when the task needs it.
Source: Supabase's MCP documentation
Further reading
Concept
How approvals workWhat a person sees when a call waits for them, and what their approval covers.
Keep the SQL tool. Let a person check what runs on production.
Join the waitlist to try it.
Stackduke is not affiliated with or endorsed by Supabase, Replit or SaaStr. Their names are used here only to describe their products and public reports.