Supabase's MCP server puts paid-resource creation behind an elicitation the model can't route around.

Version 0.12.0, September 4, adds branch and project cost confirmation elicitations and hides the legacy cost tools from form-capable clients, so an agent can't just call the old tool instead. Server instructions were rewritten to be intent-based rather than naming specific tools. That's a concrete answer to agents provisioning billable cloud resources with no human in the loop (GitHub).