{{ message }}
feat(mcp): add show_chart MCP tool + chart-scoped guest tokens (POC)#39601
Draft
mistercrunch wants to merge 1 commit intoapache:masterfrom
Draft
feat(mcp): add show_chart MCP tool + chart-scoped guest tokens (POC)#39601mistercrunch wants to merge 1 commit intoapache:masterfrom
mistercrunch wants to merge 1 commit intoapache:masterfrom
Conversation
Introduces the `show_chart` MCP tool that mints a short-lived, chart- scoped guest token and returns an `explore_url` plus a `ui://superset/ chart-viewer` resource descriptor. MCP Apps clients (e.g. Claude Desktop) can use this to render live, interactive Superset charts inline via a sandboxed iframe, without the user needing a Superset session. Key changes: - New `show_chart` tool under `superset/mcp_service/chart/tool/` - New `ui://superset/chart-viewer` MCP resource (chart_viewer.py) - `GuestTokenResourceType` extended with a `CHART` member - Security manager: `validate_guest_token_resources` and `has_guest_chart_access` now accept chart resources; `ChartFilter` allows guest access scoped to a specific chart uuid/id - MCP middleware + core injection wiring updated to register the new tool and resource - Unit tests for the tool and the chart-scoped guest token paths Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #39601 +/- ##
==========================================
+ Coverage 64.58% 64.64% +0.06%
==========================================
Files 2564 2571 +7
Lines 133576 134396 +820
Branches 31033 31073 +40
==========================================
+ Hits 86271 86885 +614
- Misses 45813 46014 +201
- Partials 1492 1497 +5 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Adds a new
show_chartMCP tool and aui://superset/chart-viewerMCP resource that together let MCP Apps clients (e.g. Claude Desktop) render a live, interactive Superset chart inline via a sandboxed iframe — without the user needing an active Superset session in the host app.Mechanism:
show_chart(identifier)mints a short-lived (5 min), chart-scoped guest token and returnsexplore_url(/explore/?slice_id=…&standalone=1&guest_token=…) plus a resource descriptor for the MCP Apps UI mount point.GuestTokenResourceTypegains aCHARTmember so guest tokens can be scoped to a single chart (in addition to the existing dashboard-scoped path).SupersetSecurityManager.validate_guest_token_resourcesand a newhas_guest_chart_accessbranch honor chart-scoped tokens.ChartFiltergrants read access when the guest token's resource matches the requested chart (by id or uuid).ui://superset/chart-viewerresource holds the iframe shell the host client mounts.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
To be added after the client-side iframe is wired up end-to-end.
TESTING INSTRUCTIONS
Automated:
pytest tests/unit_tests/mcp_service/chart/tool/test_show_chart.py \ tests/unit_tests/security/chart_guest_token_test.pyManual (POC):
show_charttool with{"identifier": "<chart_id_or_uuid>"}.explore_urlin a browser — the chart should render standalone without a login redirect.ui://superset/chart-viewerresource descriptor so the client can embed the chart inline.ADDITIONAL INFORMATION
🤖 Generated with Claude Code