You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "aminghadersohi (via GitHub)" <gi...@apache.org> on 2026/01/23 03:36:25 UTC
[PR] fix(mcp): tools not listed when JWT auth is enabled [superset]
aminghadersohi opened a new pull request, #37377:
URL: https://github.com/apache/superset/pull/37377
### SUMMARY
When `MCP_AUTH_ENABLED=True` with a custom `MCP_AUTH_FACTORY`, the MCP server would authenticate clients successfully but return zero tools. This is because `init_fastmcp_server()` was creating a **new** FastMCP instance (with auth but no tools) instead of configuring the existing global instance that has all tools registered via `@tool` decorators.
**Root cause:** In `app.py`, when any "custom parameter" (like `auth`) was provided, the code created a brand new `FastMCP` instance via `create_mcp_app()`. But all tools are registered on the module-level `mcp` instance during import — the new instance had none.
**Fix (3 parts):**
1. `init_fastmcp_server()` now applies auth/middleware/config directly to the global `mcp` instance instead of creating a new one
2. Uses `mcp._mcp_server.name` / `.instructions` since these are read-only properties in FastMCP 2.14.x
3. Replaces references to non-existent `BearerAuthProvider` with `JWTVerifier` (the actual class in fastmcp 2.14.x)
### TESTING INSTRUCTIONS
1. Configure JWT auth in `superset_config.py`:
```python
MCP_AUTH_ENABLED = True
def custom_mcp_auth_factory(app):
from fastmcp.server.auth.providers.jwt import JWTVerifier
return JWTVerifier(
public_key="dev_secret_for_mcp_tokens_change_in_production",
issuer="superset-mcp-dev",
audience="superset-mcp-api",
algorithm="HS256",
required_scopes=[],
)
MCP_AUTH_FACTORY = custom_mcp_auth_factory
MCP_DEV_USERNAME = "admin"
```
2. Start the MCP server: `superset mcp run --port 5008`
3. Generate a test token and call `tools/list`:
```bash
TOKEN=$(python -c "
import jwt
from datetime import datetime, timezone, timedelta
print(jwt.encode(
{'sub': 'admin', 'iss': 'superset-mcp-dev', 'aud': 'superset-mcp-api',
'exp': datetime.now(timezone.utc) + timedelta(hours=1)},
'dev_secret_for_mcp_tokens_change_in_production', algorithm='HS256'))
")
curl -s -X POST http://localhost:5008/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Authorization: Bearer $TOKEN" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```
4. Verify tools are returned (should see `generate_chart`, `list_dashboards`, etc.)
5. Verify request without token is rejected with `invalid_token`
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(mcp): tools not listed when JWT auth is enabled [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #37377:
URL: https://github.com/apache/superset/pull/37377#issuecomment-3788030753
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/37377?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `0%` with `22 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 66.12%. Comparing base ([`b7a5b24`](https://app.codecov.io/gh/apache/superset/commit/b7a5b24a54150695db9933a7f9ea4a7916b5468b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`a18f1cf`](https://app.codecov.io/gh/apache/superset/commit/a18f1cf3934e3d12856871e72bea7242dc693f97?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/37377?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/mcp\_service/app.py](https://app.codecov.io/gh/apache/superset/pull/37377?src=pr&el=tree&filepath=superset%2Fmcp_service%2Fapp.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvbWNwX3NlcnZpY2UvYXBwLnB5) | 0.00% | [18 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/37377?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [superset/mcp\_service/mcp\_config.py](https://app.codecov.io/gh/apache/superset/pull/37377?src=pr&el=tree&filepath=superset%2Fmcp_service%2Fmcp_config.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvbWNwX3NlcnZpY2UvbWNwX2NvbmZpZy5weQ==) | 0.00% | [4 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/37377?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #37377 +/- ##
===========================================
+ Coverage 0 66.12% +66.12%
===========================================
Files 0 642 +642
Lines 0 49008 +49008
Branches 0 5496 +5496
===========================================
+ Hits 0 32407 +32407
- Misses 0 15291 +15291
- Partials 0 1310 +1310
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.90% <0.00%> (?)` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.92% <0.00%> (?)` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `66.11% <0.00%> (?)` | |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `64.42% <0.00%> (?)` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/37377/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/37377?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(mcp): tools not listed when JWT auth is enabled [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #37377:
URL: https://github.com/apache/superset/pull/37377#issuecomment-3788010320
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(mcp): tools not listed when JWT auth is enabled [superset]
Posted by "Antonio-RiveroMartnez (via GitHub)" <gi...@apache.org>.
Antonio-RiveroMartnez merged PR #37377:
URL: https://github.com/apache/superset/pull/37377
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org