Well, I see one that would categorically prevent me from being willing to enable MCP use with Supabase, namely the lack of sufficiently fine grained permissions.

And they've confirmed they're working on more fine grained permissions as one of several mitigations.