Agents get their own Postgres, and Supabase's CLI splits into a platform

Databases that provision themselves

The week's biggest shift is that Postgres now expects an agent, not a human, to be the first caller. Neon's Claimable Neon lets an agent spin up a temporary project with scoped credentials — no signup, no email verification, no payment details — and hand ownership back to a person later with neon claim accept. Lakebase Postgres, the Data API, and Managed Better Auth are covered already. Paired with the new @neon/tools package, which re-exports typed function-calling tools from the SDK with adapters for MCP, Mastra, and Eve, the hosted Neon MCP server now carries over 70 tools. If you're wiring an agent into a database, the signup wall that used to break the loop is gone; the practical change is that provisioning becomes a tool call, and credential scope becomes part of your prompt design. Neon also expanded shared buffers for large fixed-size computes at 18 CU and up, using up to 75% of available memory — a quiet but real win for memory-hungry workloads on big instances.

Sharding without the shard tax

PlanetScale's Neki arrived in platform preview, and it's the more architecturally interesting of the two launches. Neki is horizontally sharded Postgres where every shard remains real Postgres — routing, resharding, online schema changes, and version upgrades are handled for you behind a single connection string. That's an explicit answer to the usual objection that sharded Postgres means either giving up Postgres semantics or owning a bespoke routing layer. Admins can opt in from the organization dashboard or Settings → Platform Preview, after which Neki shows up as a database engine. The PlanetScale CLI picked up Neki support the same day, including fixes to restore sizing and cluster size, so the tooling is usable from the start. Separately, PlanetScale Managed was re-certified for PCI DSS v4.0.1 as a Level 1 Service Provider — relevant if compliance was the thing keeping you off a managed Postgres.

Supabase's CLI becomes a control plane

Supabase's CLI work this week reads as one long arc rather than 30-odd separate events. CLI v2.117.0 landed the headline features: config diff and config pull, plus a full workers management suite (new, push, list, status, delete), a slim ghcr image flag, and shadow baseline caching on by default. Then a rapid beta run under v2.118.0 rewrote the managed local stack runtime, added experimental stack start and stack stop, and introduced a supabase pull orchestrator, with the config package following along — the experimental workers replaced by gated compute commands and stack environment overrides and encrypted secrets resolving correctly. Read together, config pull plus supabase pull plus start/stop means the CLI is turning into a two-way sync surface against a remote project instead of a local scaffolding tool.

The same run also tightened path handling in a way worth noting if you script the CLI: content_path is now confined to the project root for every consumer, an explicit --workdir no longer climbs to a parent project, and db push now honors deletion of extension-managed objects. On the auth side, Auth v2.197.0 added MFA recovery codes end to end — crypto primitives, factor model, schema, and generate/status/verify/regenerate/delete endpoints — alongside SCIM users and tokens tables. The JS client SDK v2.116.0 surfaced that as a recovery-code API and added bucket lifecycle configuration and versionId on create-URL methods, making signed storage URLs version-aware.

Also shipped

Prisma's 8.0 release candidates continued their grind, with rc.10 finishing the Prisma Next → Prisma 8 rename in visible identifiers — note that the NEXT_ infix is gone from the environment variables, which will break configs — and adding named model types plus language-server attribute completion. A round of lower-priority releases rounded out the week: minor PlanetScale CLI work like disk autoscaling settings in keyspace commands, and a long tail of Supabase CLI beta and canary builds covering dependency bumps, port reservation ordering, and Management API client syncs.