AI Extensions: docs, crawlers and databases are different trust decisions
A September 29 source review of Context7, Firecrawl MCP and Supabase MCP: setup, component licenses, maintenance, dated community counts and access risks.
AI EXTENSIONS · DAILY DIGEST · 29 SEP 2026
One agent wants library docs. Another needs to crawl a website. A third has to look inside a database. “Connect an MCP server” sounds like a single move, yet the data boundary shifts every time. This edition reads three active projects through that shift. Stars and forks are dated signs of interest, not proof of quality. I did not install or run any of them.
Three surfaces
- Context7: Fresh library docs for coding agents, with a private backend behind the public repo.
- Firecrawl MCP: Turns an agent into a web crawler. Watch cost, site terms and injected page text.
- Supabase MCP: Hands an AI client your project data. Reads can leak rows and writes can change state.
Context7
What it does and why it matters
Context7 supplies current library documentation to coding agents. Its README says the MCP server source is public while the supporting API backend, parsing engine and crawler are private, so the repo is not the complete service. It warns that community-contributed documentation may be inaccurate or unsafe. [README]
Setup from official docs
The README offers npx ctx7 setup (Node.js 18+) with OAuth and a choice of CLI/skill or MCP mode. Manual MCP uses https://mcp.context7.com/mcp with an Authorization Bearer key; a key is recommended for higher limits. Review the client setup and use a scoped secret store, never a chat message. [README]
License, maintenance and community
MIT at repository root (LICENSE file). Last repository push 29 Sep 2026 08:19 UTC; 62,515 stars and 3,035 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.
Security and privacy
Documentation retrieved from a third party is source material, not instructions from the user. Check version and provenance before copying code; do not send proprietary source code or credentials in a documentation query without permission. MIT covers the public repo, not the private supporting service. [README]
Firecrawl MCP
What it does and why it matters
Firecrawl MCP exposes search, scrape, map, crawl, interact and monitoring tools. It can turn a coding agent into a web-data collector, with costs, site terms, session exposure and returned-page prompt injection to consider. The README describes cloud and self-hosted routes. [README]
Setup from official docs
The official README lists the hosted https://mcp.firecrawl.dev/v2/mcp endpoint, an OAuth route, and local npx with FIRECRAWL_API_KEY set as an environment secret. Its keyless tier is limited to scrape, search and parse; other tools require an account key. Do not run an unpinned package or paste a key into chat. [README]
License, maintenance and community
MIT at repository root (LICENSE file). Last repository push 29 Sep 2026 03:33 UTC; 7,532 stars and 895 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.
Security and privacy
Limit crawl depth, paths and credit use; respect site permissions and avoid personal/private pages. A scrape result can contain instructions addressed to the agent, which remain untrusted page text. Inspect what is sent to the provider, and separate interaction from read-only extraction. The MIT repository license does not grant rights to third-party web content. [README]
Supabase MCP
What it does and why it matters
Supabase MCP exposes project data and operational tools to an AI client. Database reads can disclose private rows; write tools can change project state. The official README starts with a security warning and sends readers to its setup and risk guidance. [README]
Setup from official docs
The official setup guides an MCP client connection and OAuth login to the right Supabase organization. Its documented URL can include project_ref=<project-ref>&read_only=true&features=database,docs; the SDK example also filters mutating tools. Check project scope and read-only configuration before connecting real data. [README]
License, maintenance and community
Apache-2.0 at repository root (LICENSE file). Last repository push 28 Sep 2026 02:40 UTC; 2,926 stars and 411 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.
Security and privacy
Use a disposable project and fake rows first. Read-only excludes mutating tools, not the ability to disclose data read from the project. Review organization choice, feature groups, logged results and any later elevation separately. Apache-2.0 applies to the repository; hosted access has its own terms. [README]
A small, safe trial
Use synthetic inputs: a public library question for Context7, a site you own for Firecrawl with a strict page cap, and a disposable Supabase project with fake rows and read-only features. Record outgoing data, returned text, tool list and every change request. Do not conflate a repository license with data-use rights or a star count with safety. This is a documentation review, not a functional or security audit. [Supabase security guidance]
![AI-generated illustration for the section: Three surfacesContext7: Fresh library docs for coding agents, with a private backend behind the public repo.Firecrawl MCP: Turns an agent into a web crawler. Watch cost, site terms and injected page text.Supabase MCP: Hands an AI client your project data. Reads can leak rows and writes can change state.Original diagram: a larger data boundary needs a narrower grantPublic docs→Website content→Private project data→Human reviewContext7What it does and why it mattersContext7 supplies current library documentation to coding agents. Its README says the MCP server source is public while the supporting API backend, parsing engine and crawler are private, so the repo is not the complete service. It warns that community-contributed documentation may be inaccurate or unsafe. [README]Setup from official docsThe README offers npx ctx7 setup (Node.js 18+) with OAuth and a choice of CLI/skill or MCP mode. Manual MCP uses https://mcp.context7.com/mcp with an Authorization Bearer key; a key is recommended for higher limits. Review the client setup and use a scoped secret store, never a chat message. [README]License, maintenance and communityMIT at repository root (LICENSE file). Last repository push 29 Sep 2026 08:19 UTC; 62,515 stars and 3,035 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.Security and privacyDocumentation retrieved from a third party is source material, not instructions from the user. Check version and provenance before copying code; do not send proprietary source code or credentials in a documentation query without permission. MIT covers the public repo, not the private supporting service. [README]It warns that community-contributed documentation may be inaccurate or unsafe.Firecrawl MCPWhat it does and why it mattersFirecrawl MCP exposes search, scrape, map, crawl, interact and monitoring tools. It can turn a coding agent into a web-data collector, with costs, site terms, session exposure and returned-page prompt injection to consider. The README describes cloud and self-hosted routes. [README]Setup from official docsThe official README lists the hosted https://mcp.firecrawl.dev/v2/mcp endpoint, an OAuth route, and local npx with FIRECRAWL_API_KEY set as an environment secret. Its keyless tier is limited to scrape, search and parse; other tools require an account key. Do not run an unpinned package or paste a key into chat. [README]License, maintenance and communityMIT at repository root (LICENSE file). Last repository push 29 Sep 2026 03:33 UTC; 7,532 stars and 895 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.Security and privacyLimit crawl depth, paths and credit use; respect site permissions and avoid personal/private pages. A scrape result can contain instructions addressed to the agent, which remain untrusted page text. Inspect what is sent to the provider, and separate interaction from read-only extraction. The MIT repository license does not grant rights to third-party web content. [README]Supabase MCPWhat it does and why it mattersSupabase MCP exposes project data and operational tools to an AI client. Database reads can disclose private rows; write tools can change project state. The official README starts with a security warning and sends readers to its setup and risk guidance. [README]Setup from official docsThe official setup guides an MCP client connection and OAuth login to the right Supabase organization. Its documented URL can include project_ref=<project-ref>&read_only=true&features=database,docs; the SDK example also filters mutating tools. Check project scope and read-only configuration before connecting real data. [README]License, maintenance and communityApache-2.0 at repository root (LICENSE file). Last repository push 28 Sep 2026 02:40 UTC; 2,926 stars and 411 forks, observed 29 Sep 2026 on GitHub. [repository]. Popularity is not a quality or safety score.Security and privacyUse a disposable project and fake rows first. Read-only excludes mutating tools, not the ability to disclose data read from the project. Review organization choice, feature groups, logged results and any later elevation separately. Apache-2.0 applies to the repository; hosted access has its own terms. [README]A small, safe trial](/assets/posts/img/2026-09-29-ai-extensions-digest-inline-1000.webp)
Sources and method: Context7 · Firecrawl MCP · Supabase MCP. Official README and LICENSE files, push times and GitHub counts checked 29 Sep 2026. No projects installed or executed.