fix: pass exposedSchemas to getLints in MCP advisor operations

The MCP `getSecurityAdvisors` and `getPerformanceAdvisors` operations
called `getLints` without `exposedSchemas`, causing all schema-filtered
lints to return empty results in local/self-hosted environments.

Extracts `DEFAULT_EXPOSED_SCHEMAS` constant shared between the MCP
handler and the `run-lints` API route.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Rodriguespn

apps/studio/lib/api/self-hosted/constants.ts

@@ -1,5 +1,12 @@
 // Constants specific to self-hosted environments
 
+// Schemas exposed via PostgREST Data API.
+// In hosted Supabase, PostgREST sets the `pgrst.db_schemas` GUC on its own connections.
+// In self-hosted/local environments this GUC isn't available to other services (e.g. Studio),
+// so we hardcode the default here until a dynamic config source is wired up.
+// See: https://github.com/supabase/supabase/blob/master/docker/docker-compose.yml#L183
+export const DEFAULT_EXPOSED_SCHEMAS = 'public, storage'
+
 export const ENCRYPTION_KEY = process.env.PG_META_CRYPTO_KEY || 'SAMPLE_KEY'
 export const POSTGRES_PORT = parseInt(process.env.POSTGRES_PORT || '5432', 10)
 export const POSTGRES_HOST = process.env.POSTGRES_HOST || 'db'

apps/studio/lib/api/self-hosted/mcp.ts

@@ -9,6 +9,7 @@ import {
   GetLogsOptions,
 } from '@supabase/mcp-server-supabase/platform'
 import { ResponseError } from 'types'
+import { DEFAULT_EXPOSED_SCHEMAS } from './constants'
 import { generateTypescriptTypes } from './generate-types'
 import { getLints } from './lints'
 import { getLogQuery, retrieveAnalyticsData } from './logs'
@@ -128,7 +129,10 @@ export function getDebuggingOperations({
       return data
     },
     async getSecurityAdvisors(_projectRef) {
-      const { data, error } = await getLints({ headers })
+      const { data, error } = await getLints({
+        headers,
+        exposedSchemas: DEFAULT_EXPOSED_SCHEMAS,
+      })
 
       if (error) {
         throw error
@@ -137,7 +141,10 @@ export function getDebuggingOperations({
       return data.filter((lint) => lint.categories.includes('SECURITY'))
     },
     async getPerformanceAdvisors(_projectRef) {
-      const { data, error } = await getLints({ headers })
+      const { data, error } = await getLints({
+        headers,
+        exposedSchemas: DEFAULT_EXPOSED_SCHEMAS,
+      })
 
       if (error) {
         throw error

apps/studio/pages/api/platform/projects/[ref]/run-lints.ts

@@ -2,6 +2,7 @@ import { NextApiRequest, NextApiResponse } from 'next'
 
 import { constructHeaders } from 'lib/api/apiHelpers'
 import apiWrapper from 'lib/api/apiWrapper'
+import { DEFAULT_EXPOSED_SCHEMAS } from 'lib/api/self-hosted/constants'
 import { getLints } from 'lib/api/self-hosted/lints'
 
 export default (req: NextApiRequest, res: NextApiResponse) => apiWrapper(req, res, handler)
@@ -22,7 +23,7 @@ async function handler(req: NextApiRequest, res: NextApiResponse) {
        */
       const { data, error } = await getLints({
         headers: constructHeaders(req.headers),
-        exposedSchemas: 'public, storage',
+        exposedSchemas: DEFAULT_EXPOSED_SCHEMAS,
       })
 
       if (error) {

apps/studio/tests/unit/lints/enrichLintsQuery.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { enrichLintsQuery } from 'lib/api/self-hosted/lints'
+
+describe('enrichLintsQuery', () => {
+  const dummyQuery = 'SELECT 1'
+
+  it('should include SET LOCAL pgrst.db_schemas when exposedSchemas is provided', () => {
+    const result = enrichLintsQuery(dummyQuery, 'public, storage')
+    expect(result).toContain("set local pgrst.db_schemas = 'public, storage';")
+  })
+
+  it('should NOT include SET LOCAL pgrst.db_schemas when exposedSchemas is undefined', () => {
+    const result = enrichLintsQuery(dummyQuery, undefined)
+    expect(result).not.toContain('pgrst.db_schemas')
+  })
+
+  it('should NOT include SET LOCAL pgrst.db_schemas when exposedSchemas is empty string', () => {
+    const result = enrichLintsQuery(dummyQuery, '')
+    expect(result).not.toContain('pgrst.db_schemas')
+  })
+
+  it('should always include the query', () => {
+    const result = enrichLintsQuery(dummyQuery)
+    expect(result).toContain(dummyQuery)
+  })
+})

apps/studio/tests/unit/lints/mcp-advisors.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { DEFAULT_EXPOSED_SCHEMAS } from 'lib/api/self-hosted/constants'
+
+// Mock getLints to capture what arguments the MCP operations pass
+const mockGetLints = vi.fn()
+vi.mock('lib/api/self-hosted/lints', () => ({
+  getLints: (...args: unknown[]) => mockGetLints(...args),
+}))
+
+// Mock getProjectSettings to avoid assertSelfHosted() check
+vi.mock('lib/api/self-hosted/settings', () => ({
+  getProjectSettings: () => ({
+    app_config: {
+      db_schema: 'public',
+      endpoint: 'localhost',
+      protocol: 'http',
+    },
+    service_api_keys: [{ api_key: 'test', name: 'anon key', tags: 'anon' }],
+  }),
+}))
+
+// Must import after mock setup
+import { getDebuggingOperations } from 'lib/api/self-hosted/mcp'
+
+describe('MCP advisor operations pass exposedSchemas to getLints', () => {
+  const headers = { Authorization: 'Bearer test' }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetLints.mockResolvedValue({
+      data: [
+        {
+          name: 'rls_disabled_in_public',
+          title: 'RLS Disabled in Public',
+          level: 'ERROR',
+          categories: ['SECURITY'],
+          description: 'test',
+          detail: 'test',
+          remediation: 'test',
+          metadata: {},
+          cache_key: 'test',
+        },
+        {
+          name: 'unindexed_foreign_keys',
+          title: 'Unindexed foreign keys',
+          level: 'INFO',
+          categories: ['PERFORMANCE'],
+          description: 'test',
+          detail: 'test',
+          remediation: 'test',
+          metadata: {},
+          cache_key: 'test',
+        },
+      ],
+      error: undefined,
+    })
+  })
+
+  it('getSecurityAdvisors should pass exposedSchemas to getLints', async () => {
+    const ops = getDebuggingOperations({ headers })
+    await ops.getSecurityAdvisors('test-project')
+
+    expect(mockGetLints).toHaveBeenCalledOnce()
+    const callArgs = mockGetLints.mock.calls[0][0]
+    expect(callArgs).toHaveProperty('exposedSchemas')
+    expect(callArgs.exposedSchemas).toBeTruthy()
+  })
+
+  it('getPerformanceAdvisors should pass exposedSchemas to getLints', async () => {
+    const ops = getDebuggingOperations({ headers })
+    await ops.getPerformanceAdvisors('test-project')
+
+    expect(mockGetLints).toHaveBeenCalledOnce()
+    const callArgs = mockGetLints.mock.calls[0][0]
+    expect(callArgs).toHaveProperty('exposedSchemas')
+    expect(callArgs.exposedSchemas).toBeTruthy()
+  })
+
+  it('should use DEFAULT_EXPOSED_SCHEMAS constant', async () => {
+    const ops = getDebuggingOperations({ headers })
+    await ops.getSecurityAdvisors('test-project')
+
+    const callArgs = mockGetLints.mock.calls[0][0]
+    expect(callArgs.exposedSchemas).toBe(DEFAULT_EXPOSED_SCHEMAS)
+  })
+
+  it('getSecurityAdvisors should filter to SECURITY category', async () => {
+    const ops = getDebuggingOperations({ headers })
+    const result = await ops.getSecurityAdvisors('test-project')
+
+    expect(result).toHaveLength(1)
+    expect((result as Array<{ name: string }>)[0].name).toBe('rls_disabled_in_public')
+  })
+
+  it('getPerformanceAdvisors should filter to PERFORMANCE category', async () => {
+    const ops = getDebuggingOperations({ headers })
+    const result = await ops.getPerformanceAdvisors('test-project')
+
+    expect(result).toHaveLength(1)
+    expect((result as Array<{ name: string }>)[0].name).toBe('unindexed_foreign_keys')
+  })
+})