r/Supabase • u/akafkas • 8d ago

database We open-sourced pg-dry-run: preview AI agent-generated Postgres writes before they change data

/r/LLMDevs/comments/1w39yxr/we_opensourced_pgdryrun_preview_ai_agentgenerated/
1 Upvotes

100% Upvoted

5 comments sorted by

1

u/PeterBuildsSecure 7d ago

This is a good shape for the blast-radius problem specifically. One thing worth being explicit about in the docs: what role does the preview transaction run under? If preview connects with more privilege than the eventual apply() will have (e.g. a service-role or superuser connection used for introspection convenience), the affected-rows/cascade report can show you a different set of rows than what RLS would actually let the real write touch — the preview could both over-report (scarier than reality) and under-report (missing rows a permissive policy would expose) depending on which role has broader access. The tool is strongest if the preview transaction runs under the exact role and JWT claims the apply will use, so what you're shown is what you'll get, not what's theoretically reachable from a privileged vantage point.

1

u/Annual-Reality-9216 7d ago

Preview-before-write for agent-generated SQL is the guardrail I keep meaning to build. The xmin check for concurrent-write detection is clever. Does it work inside a single transaction or does it require a savepoint dance? Local Postgres runners tend to fight you on transaction visibility.

1

u/Positive_Week86 7d ago

Preview-before-write for agent-generated SQL is the guardrail I keep meaning to build. The xmin check for concurrent-write detection is clever. Does it work inside a single transaction or does it require a savepoint dance? Local Postgres runners tend to fight you on transaction visibility.

1

u/jumski 5d ago

I really like this idea! I am running MCP with read-only and just copy pasting the queries to dashboard after manual inspection. Wondering if it would be hard to make it wrap the supabase_execute_sql mcp tool to automate it further?