ug mcp login: per-service sign-in status + login for agents' MCP services - #654
Draft
sunishsheth2009 wants to merge 1 commit into
Draft
sunishsheth2009 wants to merge 1 commit into
sunishsheth2009 wants to merge 1 commit into
Conversation
sunishsheth2009
force-pushed
the
mcp-login-command
branch
from
September 16, 2026 16:53
1bb2513 to
9248915
Compare
`ug mcp login` shows which of the connection-backed AI Gateway MCP services the coding agents are configured to use are already signed in vs. still need a per-user connection sign-in, and runs the sign-in for the ones you pick (interactive picker) or name with `--services` / scope with `--agents`. Reuses databricks#679's building blocks: the developer + workspace-managed server enumeration is extracted from `list_mcp_command` into a shared `configured_mcp_servers_by_name` (behavior-preserving) that both `ug mcp list` and `ug mcp login` call, and the status is rendered with the same rich Table + `status_badge` styling from `ucode.ui`. Per-service status comes from the existing Unity Catalog REST APIs (the ones the `/mcp-service-login` page uses); sign-in is `databricks auth login --resource` (RFC 8707, databricks/cli#6621), so it works for any connection-backed MCP service, not just `system.ai.*`. The credential is per-user and shared across agents, so signing in once unblocks the service for every agent. Co-authored-by: Isaac <no-reply@databricks.com>
sunishsheth2009
force-pushed
the
mcp-login-command
branch
from
September 17, 2026 17:10
9248915 to
037d746
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
ug mcp login— a command to sign in to the connection-backed AI Gateway MCP services the coding agents are configured to use. Shows which are already signed in vs. need a per-user connection sign-in, and runs the sign-in for the ones you pick (interactive picker) or name with--services/ scope with--agents.Why
Non-native agents (codex, gemini, opencode) reach connection-backed MCP services (e.g.
system.ai.github) viaug mcp-proxy, which vends tools only after a per-user connection login. Rather than block inside an agent-spawned proxy (fragile — agents stripBROWSER/env, hide the auth URL, hit MCP-startup timeouts), this is an explicit, decoupled login the user runs in their own shell. It also works for Claude/Cursor — the credential is per-user and shared across all agents, so signing in once unblocks the service everywhere.Reuses #679's machinery
ug mcp list, help on bareug mcp, and MCP counts inug status#679's developer + workspace-managed server merge out oflist_mcp_commandinto a sharedconfigured_mcp_servers_by_name(state, agents)inmcp.py; bothug mcp listandug mcp loginnow call it (behavior-preserving for list — a newTestConfiguredMcpServersByNamecovers it directly). Soug mcp logincovers workspace-managed connection mcp-services too, matching whatug mcp listshows.Table+status_badgestyling fromucode.uithat Addug mcp list, help on bareug mcp, and MCP counts inug status#679's list uses (signed in / needs sign-in / no sign-in needed / unknown), plus the agents each service is on.ug mcp list— that stays Databricks-login-free, whereas the credential-status API needs a token.How it works (existing UC REST APIs — no unshipped deps)
GET /mcp-services/<full-name>→ id +source_connection(name +securable_kind)GET /connections/<conn>/user-credentials/<user>?dependent.mcp_service.id=<id>→provisioning_info.state(ACTIVE= signed in; HTTP 404 = needs login)Works for any connection-backed MCP service — not just
system.ai.*(source connection resolved from the service's own config).UX (symmetric with
ug mcp add)ug mcp login→ status table + picker (needs-sign-in pre-checked)--services system.ai.github[,github]→ targeted, non-interactive--agents claude,codex→ scope to those agents' servicesSign-in is
databricks auth login --resource <mcp-url>(databricks/cli#6621), with a clear "upgrade your CLI" error if--resourceis missing.Testing
tests/test_mcp_login.py— status classification, the--resourceinvocation incl. the old-CLI clear error,--services/--agentsscoping, and workspace-managed inclusion; plusTestConfiguredMcpServersByNamefor the extracted shared helper.ruff+tyclean; the full mcp/login/cli suite (564) is green after the extraction. README documents the command.This pull request and its description were written by Isaac.