Runtime Defense Against Prompt Injection in Supabase MCP

Hacker News

I wrote this after studying the Supabase MCP prompt injection issue. The blog shows how I built a working defense using an open-source AI agent runtime I’ve been building called Tansive ( https://github.com/tansive/tansive ) Instead of just filtering malicious prompts, I implemented role-based policies with runtime input validation that can scale across combinations of different AI tools (GitHub, Stripe, Linear, etc.). All the code referenced in the blog is in the examples/supabase_demo folder. I welcome your feedback — especially from folks working with AI toolchains or security.

Visit product View on Hacker NewsJul 22, 2025

Share card

Actual performance

3points

3comments

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: agent, mcp, stripe · Missing: mac, agents, macos

88%88% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

52%52% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal

49%49% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

29%29% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: io · Missing: https docs, excited, just released

23%23% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

21%21% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

1%1% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

Merlin’s Defense. GPT-4 Prompt Attack CTF39%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Merlin’s Defense. GPT-4 Prompt Attack CTF

Hacker News1

Exploit farm for attack-defense CTF competitions47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Exploit farm for attack-defense CTF competitions

Hacker News1

Celestron – a tower defense submission to madewithreplit26%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Celestron – a tower defense submission to madewithreplit

Hacker News3

glc PromptGuard25%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Eight-layer prompt injection defense for AI agents

Indie Hackers

A container runtime implemented in x86_64 assembly55%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

A container runtime implemented in x86_64 assembly

Hacker News3

Subverting Go's Runtime System47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Subverting Go's Runtime System

Hacker News2

Toggle Methods and Endpoints at Runtime48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Toggle Methods and Endpoints at Runtime

Hacker News2

Mixing C++ with Angelscript for runtime introspection and debugging59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Mixing C++ with Angelscript for runtime introspection and debugging

Hacker News1

Restate, a Distributed Async Runtime55%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Restate, a Distributed Async Runtime

Hacker News2

AegisBPF – Deterministic Runtime Enforcement via eBPF LSM35%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

AegisBPF – Deterministic Runtime Enforcement via eBPF LSM

Hacker News2

Browse all products Analyze your launch