Restrict interactive MCP picker to MCP services for consumer access - #474
Open
sunishsheth2009 wants to merge 3 commits into
Open
Restrict interactive MCP picker to MCP services for consumer access#474sunishsheth2009 wants to merge 3 commits into
sunishsheth2009 wants to merge 3 commits into
Conversation
sunishsheth2009
marked this pull request as ready for review
September 4, 2026 22:08
The interactive picker previously offered V2 AI Gateway sources (Vector Search, UC Functions, external connections, Genie, Databricks apps, all served under /api/2.0/mcp/*). Consumer-only identities lack the workspace-access entitlement and can't reach those, so the picker now offers only MCP services (the consumer-safe /ai-gateway/mcp-services path) and skips the source-selection step when it's the sole source. Workspace users still add a V2 server on request non-interactively by naming it in --services with a typed selector (vector-search:cat.schema, uc-functions:cat.schema, external:conn, genie-space:id, app:name). Consumer detection uses the authoritative signal: the AI Gateway's WorkspaceAccessGuard returns a 403 whose message names the `workspace-access` entitlement, which is the only thing distinguishing a consumer-only identity from a workspace user missing a specific grant. PermissionDeniedError carries consumer_only accordingly, discovery skips it gracefully, and the two cases get different, accurate error messages. Co-authored-by: Isaac <no-reply@databricks.com>
Verified against universe: the `workspace-access` entitlement 403 marker is emitted only by guarded AI Gateway / Model Serving inference + model-listing paths (which ucode already exercises at model setup) — NOT by the Apps / UC / Vector Search / ai-gateway-v2-endpoints listing calls the MCP flow uses, which return an empty list or a generic ACL denial for a consumer. So there is no reliable consumer signal at MCP-add time, and a consumer is gated upstream. Remove the marker-based detection that can't work here: drop consumer_access_reason (it probed an unguarded listing and never fired) and the preemptive block, and stop classifying PermissionDeniedError as consumer_only. Keep the graceful skip on any 403; an app: add that 403s now gives an actionable "needs workspace access" error without misattributing the cause. Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: Isaac <no-reply@databricks.com>
sunishsheth2009
force-pushed
the
consumer-access-v2-mcp
branch
from
September 4, 2026 22:11
0a63133 to
1ff3fcc
Compare
sunishsheth2009
marked this pull request as draft
September 4, 2026 22:12
sunishsheth2009
marked this pull request as ready for review
September 4, 2026 22:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What did you change, and why?
Change: The interactive MCP picker (
ucode configure mcp/ucode mcp add) no longer offers V2 AI Gateway sources — Vector Search, UC Functions, external connections, Genie spaces, and Databricks apps (everything under/api/2.0/mcp/*). It now offers only MCP services (the/ai-gateway/mcp-services/path) and skips the source-selection step since that's the sole source. Workspace users can still add a V2 server on request, non-interactively, by naming it in--serviceswith a typed selector:vector-search:<catalog>.<schema>uc-functions:<catalog>.<schema>external:<connection>genie-space:<space-id>app:<name>Why: Consumer-only identities lack the
workspace-accessentitlement and can't use the V2 AI Gateway, so offering those sources in the default flow leads to failures. MCP services is the consumer-safe path. This implements the team "Option 4" decision and the AIGTWY-4471 graceful-skip pattern.On consumer access (deliberately simple): I checked the server side — the
workspace-accessentitlement 403 is emitted only by guarded AI Gateway / Model Serving inference and model-listing paths, whichucodealready exercises when it sets up models. The listing calls this flow uses (GET /api/2.0/apps, UC catalogs, vector-search endpoints,ai-gateway/v2/endpoints) are not guarded — a consumer gets an empty list or a generic ACL denial, with no reliable, matchable signal. So this PR does not try to detect consumer-vs-missing-grant at MCP-add time (there's no sound signal, and a consumer is already gated upstream at model setup).PermissionDeniedErroris used only so discovery skips a 403 gracefully instead of aborting; anapp:add that 403s gives an actionable "needs workspace access" error.How do you know it works?
Testing:
uv run ruff check .,uv run ruff format --check, and thetest_mcp.py/test_databricks.pysuites all pass. Added tests cover: the picker offering only MCP services and skipping the source prompt (allow_back=False); the typed V2--servicesselectors registering the right server URL; V2 selectors rejected when combined with--location/plain names;list_databricks_appsraisingPermissionDeniedErroron a 403 (vs a generic error otherwise); discovery skippingPermissionDeniedErrorquietly while still warning on other errors; and anapp:add surfacing an actionable error on a permission failure.Notes
mcp.pyand the underlyinglist_*helpers indatabricks.py. It's interwoven — the VS/UC-Fn walk shares helpers with the retained mcp-services walk, and ~40 test monkeypatch stubs reference thediscover_*names — so it needs its own diff + test refactor.