Restrict interactive MCP picker to MCP services for consumer access - #474
Draft
sunishsheth2009 wants to merge 1 commit into
Draft
Restrict interactive MCP picker to MCP services for consumer access#474sunishsheth2009 wants to merge 1 commit into
sunishsheth2009 wants to merge 1 commit into
Conversation
The interactive picker previously offered V2 AI Gateway sources (Vector Search, UC Functions, external connections, Genie, Databricks apps, all served under /api/2.0/mcp/*). Consumer-only identities lack the workspace-access entitlement and can't reach those, so the picker now offers only MCP services (the consumer-safe /ai-gateway/mcp-services path) and skips the source-selection step when it's the sole source. Workspace users still add a V2 server on request non-interactively by naming it in --services with a typed selector (vector-search:cat.schema, uc-functions:cat.schema, external:conn, genie-space:id, app:name). Consumer detection uses the authoritative signal: the AI Gateway's WorkspaceAccessGuard returns a 403 whose message names the `workspace-access` entitlement, which is the only thing distinguishing a consumer-only identity from a workspace user missing a specific grant. PermissionDeniedError carries consumer_only accordingly, discovery skips it gracefully, and the two cases get different, accurate error messages. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What did you change, and why?
Change: The interactive MCP picker (
ucode configure mcp/ucode mcp add) no longer offers V2 AI Gateway sources — Vector Search, UC Functions, external connections, Genie spaces, and Databricks apps (everything under/api/2.0/mcp/*). It now offers only MCP services (the/ai-gateway/mcp-services/path), and skips the source-selection step since that's the sole source. Workspace users can still add a V2 server on request, non-interactively, by naming it in--serviceswith a typed selector:vector-search:<catalog>.<schema>uc-functions:<catalog>.<schema>external:<connection>genie-space:<space-id>app:<name>Why: Consumer-only identities lack the
workspace-accessentitlement and can't reach the V2 AI Gateway, so offering those sources in the default flow leads to failures. MCP services is the consumer-safe path. This implements the team "Option 4" decision (and the AIGTWY-4471 graceful-skip pattern).Consumer detection: The AI Gateway's
WorkspaceAccessGuardreturns an HTTP 403 whose message names theworkspace-accessentitlement — the only signal that distinguishes a consumer-only identity from a workspace user who merely lacks a grant on a specific resource (both are otherwise the same 403 / JsonRpc FORBIDDEN).PermissionDeniedErrornow carriesconsumer_onlyset from that marker; discovery skips it gracefully, and a consumer vs. a missing-grant get different, accurate error messages. The server-side guard is gated by theblockInferenceWithoutWorkspaceAccessSAFE flag (default off), so the preemptive block is best-effort and deliberately conservative (never blocks a workspace user on a non-marker 403).How do you know it works?
Testing:
uv run ruff check .,uv run ruff format --check, and thetest_mcp.py/test_databricks.pysuites all pass. Added tests cover: the picker offering only MCP services and skipping the source prompt (allow_back=False); the typed V2--servicesselectors registering the right server URL; a consumer identity being blocked before any config write; V2 selectors rejected when combined with--location/plain names;PermissionDeniedError.consumer_onlyclassification from theworkspace-accessmarker (consumer) vs a resource 403 (not consumer);consumer_access_reasonfiring only on the marker; and discovery skippingPermissionDeniedErrorquietly while still warning on other errors.Notes
mcp.pyand the underlyinglist_*helpers indatabricks.py. It's interwoven — the VS/UC-Fn walk shares helpers with the retained mcp-services walk, and ~40 test monkeypatch stubs reference thediscover_*names — so it needs its own diff + test refactor.