fix(mcp): postgres-meta parameters binding for list_tables (#40499)

* add params to executeQuery

* revert env change

* chore: upgrade "supabase" to v2.58.5

---------

Co-authored-by: Matt Rossman <22670878+mattrossman@users.noreply.github.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>

apps/studio/lib/api/self-hosted/mcp.ts

@@ -31,8 +31,9 @@ export function getDatabaseOperations({
 }: GetDatabaseOperationsOptions): DatabaseOperations {
   return {
     async executeSql<T>(_projectRef: string, options: ExecuteSqlOptions) {
-      const { query, read_only: readOnly } = options
-      const { data, error } = await executeQuery<T>({ query, headers, readOnly })
+      const { query, parameters, read_only: readOnly } = options
+
+      const { data, error } = await executeQuery<T>({ query, parameters, headers, readOnly })
 
       if (error) {
         throw error

apps/studio/lib/api/self-hosted/query.ts

@@ -5,6 +5,7 @@ import { assertSelfHosted, encryptString, getConnectionString } from './util'
 
 export type QueryOptions = {
   query: string
+  parameters?: unknown[]
   readOnly?: boolean
   headers?: HeadersInit
 }
@@ -16,6 +17,7 @@ export type QueryOptions = {
  */
 export async function executeQuery<T = unknown>({
   query,
+  parameters,
   readOnly = false,
   headers,
 }: QueryOptions): Promise<WrappedResult<T[]>> {
@@ -24,6 +26,11 @@ export async function executeQuery<T = unknown>({
   const connectionString = getConnectionString({ readOnly })
   const connectionStringEncrypted = encryptString(connectionString)
 
+  const requestBody: { query: string; parameters?: unknown[] } = { query }
+  if (parameters !== undefined) {
+    requestBody.parameters = parameters
+  }
+
   const response = await fetch(`${PG_META_URL}/query`, {
     method: 'POST',
     headers: constructHeaders({
@@ -31,7 +38,7 @@ export async function executeQuery<T = unknown>({
       'Content-Type': 'application/json',
       'x-connection-encrypted': connectionStringEncrypted,
     }),
-    body: JSON.stringify({ query }),
+    body: JSON.stringify(requestBody),
   })
 
   try {

package.json

@@ -48,7 +48,7 @@
     "prettier-plugin-sql-cst": "^0.11.0",
     "rimraf": "^6.0.0",
     "sass": "^1.72.0",
-    "supabase": "^2.51.0",
+    "supabase": "^2.58.5",
     "supports-color": "^8.0.0",
     "turbo": "2.3.3",
     "typescript": "catalog:"