[D] MCP: expose granular FastMCP response-caching controls [superset]

["lhpaoletti (via GitHub)" <gi...@apache.org>]

GitHub user lhpaoletti created a discussion: MCP: expose granular FastMCP response-caching controls

## Problem

Superset's MCP cache adapter exposes TTLs and a tool exclusion list, but it does not expose FastMCP's full per-operation controls.

FastMCP supports enabling/disabling each cached operation and using allowlists or exclusion lists for individual items:

https://fastmcp.mintlify.app/servers/middleware#caching

Superset currently maps only TTL values and `excluded_tools` into `ResponseCachingMiddleware`:

https://github.com/apache/superset/blob/master/superset/mcp_service/caching.py#L30-L77

This makes a safe “cache only static MCP metadata” configuration difficult. In particular:

- there is no per-operation `enabled` setting;
- `included_tools` allowlists are not forwarded;
- `max_item_size` is declared in `MCP_CACHE_CONFIG`, but is not consumed by the adapter;
- when tool search is enabled, clients invoke the synthetic `call_tool` proxy, so excluding a target tool name alone may not reliably prevent caching of the
proxy invocation.

## Proposal

Expand `MCP_CACHE_CONFIG` to expose FastMCP's operation-level controls for:

- `tools/list`
- `resources/list`
- `prompts/list`
- `resources/read`
- `prompts/get`
- `tools/call`

The configuration should support each operation's `enabled`, `ttl`, and applicable `included_*` / `excluded_*` controls.

For tool search, cache policy should be evaluated against the resolved target tool, or `call_tool` caching should remain disabled by default.

`max_item_size` should either be wired to a supported implementation or removed from the documented configuration to avoid implying it is enforced.

## Why this is safer

This would allow a safe enabled profile that caches only static protocol metadata, for example `tools/list`, `resources/list`, and `prompts/list`, while
leaving `tools/call` disabled by default.

It avoids relying on a growing denylist of mutable or authorization-sensitive tools and gives operators an explicit, auditable way to opt in to narrow caching.

Related implementation points:

- https://github.com/apache/superset/blob/master/superset/mcp_service/mcp_config.py#L171-L187
- https://github.com/apache/superset/blob/master/superset/mcp_service/caching.py
- https://github.com/apache/superset/blob/master/superset/mcp_service/server.py#L422-L505

_Disclaimer: This discussion was prepared by an AI agent on behalf of Luis Paoletti (lh.paoletti@gmail.com)._

GitHub link: https://github.com/apache/superset/discussions/42198

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org