feat: support MCP Server resource (CREATE MCP SERVER) and MCP server grants#35
Open
GClunies wants to merge 1 commit into
Open
feat: support MCP Server resource (CREATE MCP SERVER) and MCP server grants#35GClunies wants to merge 1 commit into
GClunies wants to merge 1 commit into
Conversation
Snowflake managed MCP servers (CREATE MCP SERVER ... FROM SPECIFICATION) previously had to be managed with hand-run SQL, where re-running CREATE OR REPLACE silently drops all USAGE grants on the server. Add a schema-scoped mcp_server resource (mcp_servers: YAML key) with a specification property. Because Snowflake has no ALTER MCP SERVER, the specification is canonicalized (sorted keys, version defaulted, JSON/YAML representation-independent, tools sorted by name) so an unchanged spec produces a no-op plan; only a real change emits a single CREATE OR REPLACE, and the plan warns that grants on the server will be dropped - on both the one-step apply and the plan-file two-step workflow. Renames raise a clear error instead of emitting invalid ALTER SQL. GRANT USAGE ON MCP SERVER works via on_mcp_server: and the multi-word on: string form with no grant.py changes; MCPServerPriv registers MODIFY/USAGE. fetch_mcp_server reads SHOW + DESC (server_spec) with an existence_only fast path; list_mcp_servers enables sync/export sweeps. Closes datacoves#26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a schema-scoped
mcp_serverresource so Snowflake managed MCP servers can be managed declaratively instead of with hand-run SQL — where re-runningCREATE OR REPLACE MCP SERVERsilently drops every USAGE grant on the server. Snowflake has noALTER MCP SERVER, so the resource diffs a canonicalized specification: an unchanged spec is a no-op plan, and only a real change emits a singleCREATE OR REPLACE, with a plan-time warning that grants will be dropped (snowcap-managed grants come back on the next apply).Closes #26
Changes
MCPServerresource (mcp_servers:YAML key) with aspecificationproperty rendered asCREATE MCP SERVER <fqn> FROM SPECIFICATION $$...$$(reusesStringProp, no new prop machinery)DESC MCP SERVER's JSONserver_spec(sorted keys,versiondefaulted to 1, YAML-only scalar types collapsed, tools sorted by name) — unit-tested against YAML 1.1 gotchas and all five tool typesupdate_mcp_serverlifecycle: spec change → oneCREATE OR REPLACE; rename → clear error (no ALTER exists); plan warning fires on bothsnowcap applyand thesnowcap plan -o/apply --plantwo-step workflowGRANT { USAGE | MODIFY } ON MCP SERVERviaon_mcp_server:oron: mcp server <fqn>(generic — zerogrant.pychanges);MCPServerPriv+CREATE MCP SERVERschema priv registeredfetch_mcp_server(SHOW + DESC,existence_onlyfast path) andlist_mcp_serversdocs/resources/mcp_server.md, SUMMARY entry, MCP examples ingrant.mdTestMCPServer, grant tests, lifecycle/warning tests — full unit suite green (1560)Notes
SHOW/DESCround-trip) needs a Snowflake account with MCP servers; the normalizer'sversion-stamping assumption should be verified there before relying on no-op plans in productionCREATE OR REPLACE MCP SERVER ... COPY GRANTSis supported