feat(mcp): add show_chart MCP tool + chart-scoped guest tokens (POC)#39601
Draft
mistercrunch wants to merge 1 commit into
Draft
feat(mcp): add show_chart MCP tool + chart-scoped guest tokens (POC)#39601mistercrunch wants to merge 1 commit into
mistercrunch wants to merge 1 commit into
Conversation
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #39601 +/- ##
==========================================
+ Coverage 64.48% 64.57% +0.09%
==========================================
Files 2566 2573 +7
Lines 133926 134689 +763
Branches 31096 31123 +27
==========================================
+ Hits 86357 86975 +618
- Misses 46074 46214 +140
- Partials 1495 1500 +5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Introduces the `show_chart` MCP tool that mints a short-lived, chart- scoped guest token and returns an `explore_url` plus a `ui://superset/ chart-viewer` resource descriptor. MCP Apps clients (e.g. Claude Desktop) can use this to render live, interactive Superset charts inline via a sandboxed iframe, without the user needing a Superset session. Key changes: - New `show_chart` tool under `superset/mcp_service/chart/tool/` - New `ui://superset/chart-viewer` MCP resource (chart_viewer.py) - `GuestTokenResourceType` extended with a `CHART` member - Security manager: `validate_guest_token_resources` and `has_guest_chart_access` now accept chart resources; `ChartFilter` allows guest access scoped to a specific chart uuid/id - MCP middleware + core injection wiring updated to register the new tool and resource - Unit tests for the tool and the chart-scoped guest token paths Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Adds a new
show_chartMCP tool and aui://superset/chart-viewerMCP resource that together let MCP Apps clients (e.g. Claude Desktop) render a live, interactive Superset chart inline via a sandboxed iframe — without the user needing an active Superset session in the host app.Mechanism:
show_chart(identifier)mints a short-lived (5 min), chart-scoped guest token and returnsexplore_url(/explore/?slice_id=…&standalone=1&guest_token=…) plus a resource descriptor for the MCP Apps UI mount point.GuestTokenResourceTypegains aCHARTmember so guest tokens can be scoped to a single chart (in addition to the existing dashboard-scoped path).SupersetSecurityManager.validate_guest_token_resourcesand a newhas_guest_chart_accessbranch honor chart-scoped tokens.ChartFiltergrants read access when the guest token's resource matches the requested chart (by id or uuid).ui://superset/chart-viewerresource holds the iframe shell the host client mounts.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
To be added after the client-side iframe is wired up end-to-end.
TESTING INSTRUCTIONS
Automated:
pytest tests/unit_tests/mcp_service/chart/tool/test_show_chart.py \ tests/unit_tests/security/chart_guest_token_test.pyManual (POC):
show_charttool with{"identifier": "<chart_id_or_uuid>"}.explore_urlin a browser — the chart should render standalone without a login redirect.ui://superset/chart-viewerresource descriptor so the client can embed the chart inline.ADDITIONAL INFORMATION
🤖 Generated with Claude Code