From 41bb9219aba922cafe9659c09af039c5e08327e4 Mon Sep 17 00:00:00 2001 From: Michael Valdron Date: Mon, 10 Aug 2026 17:07:27 -0400 Subject: [PATCH] feat(intelligent-assistant): apply behavior-linked MCP tools permissions model Rename MCP permissions to mcp.tools.use/manage, drop CRUD action attributes, and update RBAC docs. Assisted-by: Cursor Co-authored-by: Cursor Signed-off-by: Michael Valdron --- .../.changeset/mcp-tools-permissions.md | 18 +++++++++++++++++ .../intelligent-assistant-backend/README.md | 8 ++++---- .../src/service/router.ts | 6 +++--- .../report.api.md | 2 +- .../src/permissions.ts | 20 ++++++++----------- .../plugins/intelligent-assistant/README.md | 4 ++-- .../intelligent-assistant/rbac-policy.csv | 4 ++-- 7 files changed, 38 insertions(+), 24 deletions(-) create mode 100644 workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md diff --git a/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md new file mode 100644 index 00000000000..5cc585ff5a8 --- /dev/null +++ b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md @@ -0,0 +1,18 @@ +--- +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-backend': major +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-common': major +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant': major +--- + +Breaking changes to MCP permissions using behavior-linked vocabulary rather than CRUD-linked vocabulary: + +| Before (Lightspeed) | Before (Intelligent Assistant) | After | +| ----------------------- | ---------------------------------- | ------------------ | +| `lightspeed.mcp.read` | `intelligent-assistant.mcp.read` | `mcp.tools.use` | +| `lightspeed.mcp.manage` | `intelligent-assistant.mcp.manage` | `mcp.tools.manage` | + +Removed permission CRUD action attributes; RBAC entries for these permission sets now use the generic `use` action. + +Permission variable renamed from `iaMcpReadPermission` to `iaMcpUsePermission`; `iaMcpManagePermission` keeps its name. + +Plugin documentation and example RBAC policy CSV updated to reflect the new MCP permission names. diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md index 350b9e11e87..bf127d55a03 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md @@ -89,8 +89,8 @@ Update permission names in your `rbac-policy.csv`: | `lightspeed.chat.update` | `intelligent-assistant.chat.manage` | | `lightspeed.notebooks.use` | `intelligent-assistant.notebooks.use` | | | `intelligent-assistant.notebooks.manage` | -| `lightspeed.mcp.read` | `intelligent-assistant.mcp.read` | -| `lightspeed.mcp.manage` | `intelligent-assistant.mcp.manage` | +| `lightspeed.mcp.read` | `mcp.tools.use` | +| `lightspeed.mcp.manage` | `mcp.tools.manage` | #### 5. OFS dynamic plugin configuration @@ -342,8 +342,8 @@ p, role:default/team_a, intelligent-assistant.notebooks.use, use, allow p, role:default/team_a, intelligent-assistant.notebooks.manage, use, allow # Required for MCP server management (if configured) -p, role:default/team_a, intelligent-assistant.mcp.read, read, allow -p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow +p, role:default/team_a, mcp.tools.use, use, allow +p, role:default/team_a, mcp.tools.manage, use, allow # Required for saved prompts p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts index df96f3745c3..099e9bc032b 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts @@ -32,7 +32,7 @@ import { iaChatManagePermission, iaChatUsePermission, iaMcpManagePermission, - iaMcpReadPermission, + iaMcpUsePermission, iaNotebooksUsePermission, iaPermissions, iaSavedPromptsManagePermission, @@ -319,7 +319,7 @@ export async function createRouter( router.get( '/mcp-servers', generalRateLimiter, - requirePermission(iaMcpReadPermission), + requirePermission(iaMcpUsePermission), async (req, res) => { try { const { userEntityRef } = getIdentity(req); @@ -360,7 +360,7 @@ export async function createRouter( router.post( '/mcp-servers/validate', generalRateLimiter, - requirePermission(iaMcpReadPermission), + requirePermission(iaMcpUsePermission), async (req, res) => { try { const { url, token } = req.body; diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md index ad0e5d6e34f..230ad31e4f2 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md @@ -18,7 +18,7 @@ export const iaChatUsePermission: BasicPermission; export const iaMcpManagePermission: BasicPermission; // @public -export const iaMcpReadPermission: BasicPermission; +export const iaMcpUsePermission: BasicPermission; // @public export const iaNotebooksManagePermission: BasicPermission; diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts index 8cd4fafae1c..abbefda9058 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts @@ -40,24 +40,20 @@ export const iaChatManagePermission = createPermission({ attributes: {}, }); -/** This permission is used to list configured MCP servers +/** This permission is used to use MCP tooling * @public */ -export const iaMcpReadPermission = createPermission({ - name: 'intelligent-assistant.mcp.read', - attributes: { - action: 'read', - }, +export const iaMcpUsePermission = createPermission({ + name: 'mcp.tools.use', + attributes: {}, }); -/** This permission is used to add, update, delete, and validate MCP servers +/** This permission is used to manage MCP tooling * @public */ export const iaMcpManagePermission = createPermission({ - name: 'intelligent-assistant.mcp.manage', - attributes: { - action: 'update', - }, + name: 'mcp.tools.manage', + attributes: {}, }); /** This permission is used to access, create, and query intelligent-assistant notebooks @@ -103,7 +99,7 @@ export const iaPermissions = [ iaChatAccessPermission, iaChatManagePermission, iaChatUsePermission, - iaMcpReadPermission, + iaMcpUsePermission, iaMcpManagePermission, iaNotebooksManagePermission, iaNotebooksUsePermission, diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md index 322445c2364..ca488ae5bba 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md @@ -46,8 +46,8 @@ p, role:default/team_a, intelligent-assistant.notebooks.use, use, allow p, role:default/team_a, intelligent-assistant.notebooks.manage, use, allow # Required for MCP server management (if configured) -p, role:default/team_a, intelligent-assistant.mcp.read, read, allow -p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow +p, role:default/team_a, mcp.tools.use, use, allow +p, role:default/team_a, mcp.tools.manage, use, allow # Required for saved prompts p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow diff --git a/workspaces/intelligent-assistant/rbac-policy.csv b/workspaces/intelligent-assistant/rbac-policy.csv index 7bc4abbeacb..a34fbf3b794 100644 --- a/workspaces/intelligent-assistant/rbac-policy.csv +++ b/workspaces/intelligent-assistant/rbac-policy.csv @@ -9,8 +9,8 @@ p, role:default/intelligent-assistant-user, intelligent-assistant.chat.access, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.chat.use, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.chat.manage, use, allow -p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.read, read, allow -p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.manage, update, allow +p, role:default/intelligent-assistant-user, mcp.tools.use, use, allow +p, role:default/intelligent-assistant-user, mcp.tools.manage, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.notebooks.use, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.notebooks.manage, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.skills.access, use, allow