From 708dc625e572a00a0820cc36c98874614519f330 Mon Sep 17 00:00:00 2001 From: Michael Valdron Date: Mon, 10 Aug 2026 17:07:27 -0400 Subject: [PATCH] feat(intelligent-assistant): apply behavior-linked MCP tools permissions model Rename MCP permissions to mcp.tools.use/manage, drop CRUD action attributes, and update RBAC docs. Assisted-by: Cursor Co-authored-by: Cursor Signed-off-by: Michael Valdron --- .../.changeset/mcp-tools-permissions.md | 18 +++++++++++++++++ .../intelligent-assistant-backend/README.md | 8 ++++---- .../src/service/router.ts | 6 +++--- .../report.api.md | 2 +- .../src/permissions.ts | 20 ++++++++----------- .../plugins/intelligent-assistant/README.md | 4 ++-- .../intelligent-assistant/rbac-policy.csv | 4 ++-- 7 files changed, 38 insertions(+), 24 deletions(-) create mode 100644 workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md diff --git a/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md new file mode 100644 index 00000000000..5cc585ff5a8 --- /dev/null +++ b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md @@ -0,0 +1,18 @@ +--- +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-backend': major +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-common': major +'@red-hat-developer-hub/backstage-plugin-intelligent-assistant': major +--- + +Breaking changes to MCP permissions using behavior-linked vocabulary rather than CRUD-linked vocabulary: + +| Before (Lightspeed) | Before (Intelligent Assistant) | After | +| ----------------------- | ---------------------------------- | ------------------ | +| `lightspeed.mcp.read` | `intelligent-assistant.mcp.read` | `mcp.tools.use` | +| `lightspeed.mcp.manage` | `intelligent-assistant.mcp.manage` | `mcp.tools.manage` | + +Removed permission CRUD action attributes; RBAC entries for these permission sets now use the generic `use` action. + +Permission variable renamed from `iaMcpReadPermission` to `iaMcpUsePermission`; `iaMcpManagePermission` keeps its name. + +Plugin documentation and example RBAC policy CSV updated to reflect the new MCP permission names. diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md index ad7f3015edf..efaa340669d 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md @@ -88,8 +88,8 @@ Update permission names in your `rbac-policy.csv`: | `lightspeed.chat.delete` | `intelligent-assistant.chat.manage` | | `lightspeed.chat.update` | `intelligent-assistant.chat.manage` | | `lightspeed.notebooks.use` | `intelligent-assistant.notebooks.use` | -| `lightspeed.mcp.read` | `intelligent-assistant.mcp.read` | -| `lightspeed.mcp.manage` | `intelligent-assistant.mcp.manage` | +| `lightspeed.mcp.read` | `mcp.tools.use` | +| `lightspeed.mcp.manage` | `mcp.tools.manage` | #### 5. OFS dynamic plugin configuration @@ -340,8 +340,8 @@ p, role:default/team_a, intelligent-assistant.chat.manage, use, allow p, role:default/team_a, intelligent-assistant.notebooks.use, update, allow # Required for MCP server management (if configured) -p, role:default/team_a, intelligent-assistant.mcp.read, read, allow -p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow +p, role:default/team_a, mcp.tools.use, use, allow +p, role:default/team_a, mcp.tools.manage, use, allow # Required for saved prompts p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts index db2e2aaad57..eb116558b9b 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts @@ -32,7 +32,7 @@ import { iaChatManagePermission, iaChatUsePermission, iaMcpManagePermission, - iaMcpReadPermission, + iaMcpUsePermission, iaPermissions, iaSavedPromptsManagePermission, iaSkillsAccessPermission, @@ -318,7 +318,7 @@ export async function createRouter( router.get( '/mcp-servers', generalRateLimiter, - requirePermission(iaMcpReadPermission), + requirePermission(iaMcpUsePermission), async (req, res) => { try { const { userEntityRef } = getIdentity(req); @@ -359,7 +359,7 @@ export async function createRouter( router.post( '/mcp-servers/validate', generalRateLimiter, - requirePermission(iaMcpReadPermission), + requirePermission(iaMcpUsePermission), async (req, res) => { try { const { url, token } = req.body; diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md index 466a1f56d24..d8a03f984e7 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md @@ -18,7 +18,7 @@ export const iaChatUsePermission: BasicPermission; export const iaMcpManagePermission: BasicPermission; // @public -export const iaMcpReadPermission: BasicPermission; +export const iaMcpUsePermission: BasicPermission; // @public export const iaNotebooksUsePermission: BasicPermission; diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts index 28d52a78b15..c9af4961551 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts @@ -40,24 +40,20 @@ export const iaChatManagePermission = createPermission({ attributes: {}, }); -/** This permission is used to list configured MCP servers +/** This permission is used to use MCP tooling * @public */ -export const iaMcpReadPermission = createPermission({ - name: 'intelligent-assistant.mcp.read', - attributes: { - action: 'read', - }, +export const iaMcpUsePermission = createPermission({ + name: 'mcp.tools.use', + attributes: {}, }); -/** This permission is used to add, update, delete, and validate MCP servers +/** This permission is used to manage MCP tooling * @public */ export const iaMcpManagePermission = createPermission({ - name: 'intelligent-assistant.mcp.manage', - attributes: { - action: 'update', - }, + name: 'mcp.tools.manage', + attributes: {}, }); /** This permission is used to access AI Notebooks features @@ -97,7 +93,7 @@ export const iaPermissions = [ iaChatAccessPermission, iaChatManagePermission, iaChatUsePermission, - iaMcpReadPermission, + iaMcpUsePermission, iaMcpManagePermission, iaNotebooksUsePermission, iaSavedPromptsManagePermission, diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md index 5bd48efb5b4..57d0a5900d0 100644 --- a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md +++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md @@ -45,8 +45,8 @@ p, role:default/team_a, intelligent-assistant.chat.manage, use, allow p, role:default/team_a, intelligent-assistant.notebooks.use, update, allow # Required for MCP server management (if configured) -p, role:default/team_a, intelligent-assistant.mcp.read, read, allow -p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow +p, role:default/team_a, mcp.tools.use, use, allow +p, role:default/team_a, mcp.tools.manage, use, allow # Required for saved prompts p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow diff --git a/workspaces/intelligent-assistant/rbac-policy.csv b/workspaces/intelligent-assistant/rbac-policy.csv index 8716e2eb586..b46552e8c3f 100644 --- a/workspaces/intelligent-assistant/rbac-policy.csv +++ b/workspaces/intelligent-assistant/rbac-policy.csv @@ -9,8 +9,8 @@ p, role:default/intelligent-assistant-user, intelligent-assistant.chat.access, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.chat.use, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.chat.manage, use, allow -p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.read, read, allow -p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.manage, update, allow +p, role:default/intelligent-assistant-user, mcp.tools.use, use, allow +p, role:default/intelligent-assistant-user, mcp.tools.manage, use, allow p, role:default/intelligent-assistant-user, intelligent-assistant.notebooks.use, update, allow p, role:default/intelligent-assistant-user, intelligent-assistant.skills.access, use, allow