You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "justinmclean (via GitHub)" <gi...@apache.org> on 2026/10/21 02:07:48 UTC
[PR] fix(mcp): require only read permission for consumer offsets [iggy]
justinmclean opened a new pull request, #4608:
URL: https://github.com/apache/iggy/pull/4608
## Which issue does this PR address?
Relates to #4589
## Rationale
A read-only MCP server could not keep an agent's place on a stream. Storing or deleting a consumer offset, and polling with `auto_commit` or `strategy = "next"`, needed `update` or `delete`, which also allow changes to streams, topics, users and permissions. The broker only asks for poll permission on offsets, and the MCP server always uses its own consumer.
## What changed?
`store_consumer_offset`, `delete_consumer_offset` and auto-committing `poll_messages` required the `update` or `delete` MCP permission. They now need only `read`, matching the broker's rule (`Permissioner::store_consumer_offset` and `delete_consumer_offset` both check poll permission).
The README permissions table and the `poll_messages` tool description are updated, and the README now warns not to give `iggy.consumer` the same name as an application's consumer, since `read` alone can move its offsets. `should_reject_mutating_tools_with_read_only_permissions` no longer expects these calls to be rejected, and now checks that store, delete, auto-commit and `next` work with read-only permissions.
## Local Execution
- Passed: `cargo fmt --all -- --check`, `cargo clippy -p iggy-mcp -p integration --tests -- -D warnings`, and the MCP integration tests (`cargo test -p integration --test mod mcp::`).
- Pre-commit hooks ran
## AI Usage
1. Claude (Claude Code).
2. Made the permission, README and test changes hubcio asked for in #4589.
3. Checked the broker's offset permission rules in `core/metadata/src/permissioner/permissioner_rules/consumer_offsets.rs`, and ran the checks listed above.
4. Yes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(mcp): require only read permission for consumer offsets [iggy]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #4608:
URL: https://github.com/apache/iggy/pull/4608#issuecomment-6306943741
## [Codecov](https://app.codecov.io/gh/apache/iggy/pull/4608?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `0%` with `2 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 89.77%. Comparing base ([`8b3b54c`](https://app.codecov.io/gh/apache/iggy/commit/8b3b54c554fb4ecbcddff0a7439197c5f9e3b465?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`5384768`](https://app.codecov.io/gh/apache/iggy/commit/5384768a4e2accc5f6b3a2eb034f85dacf1dc272?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/iggy/pull/4608?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [core/ai/mcp/src/service/mod.rs](https://app.codecov.io/gh/apache/iggy/pull/4608?src=pr&el=tree&filepath=core%2Fai%2Fmcp%2Fsrc%2Fservice%2Fmod.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9haS9tY3Avc3JjL3NlcnZpY2UvbW9kLnJz) | 0.00% | [0 Missing and 2 partials :warning: ](https://app.codecov.io/gh/apache/iggy/pull/4608?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
:x: Your patch check has failed because the patch coverage (0.00%) is below the target coverage (50.00%). You can increase the patch coverage or adjust the [target](https://docs.codecov.com/docs/commit-status#target) coverage.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #4608 +/- ##
============================================
+ Coverage 89.75% 89.77% +0.01%
Complexity 2145 2145
============================================
Files 1343 1343
Lines 291586 291580 -6
Branches 247820 247814 -6
============================================
+ Hits 261727 261753 +26
+ Misses 24131 24102 -29
+ Partials 5728 5725 -3
```
| [Components](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=components&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [Rust Core](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `91.01% <0.00%> (+0.01%)` | :arrow_up: |
| [Java SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `73.17% <ø> (ø)` | |
| [C# SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `81.41% <ø> (ø)` | |
| [Python SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.71% <ø> (ø)` | |
| [PHP SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `87.87% <ø> (ø)` | |
| [Node SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `95.15% <ø> (ø)` | |
| [Go SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `71.88% <ø> (ø)` | |
| [C++ SDK](https://app.codecov.io/gh/apache/iggy/pull/4608/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `84.69% <ø> (ø)` | |
| [Files with missing lines](https://app.codecov.io/gh/apache/iggy/pull/4608?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [core/ai/mcp/src/service/mod.rs](https://app.codecov.io/gh/apache/iggy/pull/4608?src=pr&el=tree&filepath=core%2Fai%2Fmcp%2Fsrc%2Fservice%2Fmod.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9haS9tY3Avc3JjL3NlcnZpY2UvbW9kLnJz) | `67.72% <0.00%> (-0.78%)` | :arrow_down: |
... and [21 files with indirect coverage changes](https://app.codecov.io/gh/apache/iggy/pull/4608/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(mcp): require only read permission for consumer offsets [iggy]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4608:
URL: https://github.com/apache/iggy/pull/4608#issuecomment-6306241039
<!-- iggy-pr-triage-welcome -->
Thanks for the PR. It is labeled `S-waiting-on-review` and queued for review.
Slash commands (own line, regular comment) move it around the queue:
- `/ready` - back to `S-waiting-on-review` after addressing feedback
- `/author` - flip to `S-waiting-on-author` while you finish changes
- `/request-review @user-or-team` - request a reviewer
- `/pin` - exempt the PR from the stale bot, `/unpin` to undo
See [CONTRIBUTING.md](https://github.com/apache/iggy/blob/master/CONTRIBUTING.md#pr-triage-commands) for details.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org