MCP Server for DQX

.github/workflows/mcp.yml

@@ -0,0 +1,93 @@
+# MCP server integration tests.
+#
+# Runs the tests/integration_mcp suite via the shared acceptance harness (same workspace,
+# auth, and Model Serving endpoint as the anomaly/integration suites). The suite deploys an
+# isolated MCP app from the bundle, drives it as an agent would, and tears it down — see
+# tests/integration_mcp/conftest.py. No MCP-specific secrets are needed; auth comes from the
+# acceptance action exactly like the other integration workflows.
+name: mcp
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review]
+    paths:
+      - "mcp-server/**"
+      - "src/databricks/labs/dqx/**" # the runner installs the in-repo DQX wheel
+      - "tests/integration_mcp/**"
+      - ".github/workflows/mcp.yml"
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false # let teardown finish so the isolated app/bundle is removed
+
+jobs:
+  # Gate downstream work: fork PRs (no access to the tool environment) and drafts do not run.
+  not-a-fork:
+    runs-on:
+      group: databrickslabs-protected-runner-group
+      labels: linux-ubuntu-latest
+    if: github.event_name == 'pull_request' && !github.event.pull_request.draft && !github.event.pull_request.head.repo.fork
+    steps:
+      - run: echo "Not a fork PR, proceeding"
+
+  mcp-tests:
+    needs: not-a-fork
+    environment: tool
+    runs-on:
+      group: larger-runners
+      labels: larger
+    permissions:
+      id-token: write
+      pull-requests: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+
+      - name: Pre-build DQX wheel
+        uses: ./.github/actions/prebuild-wheel
+
+      - name: Prepare code coverage configuration for MCP tests
+        run: |
+          cat > tests/integration_mcp/.coveragerc << EOF
+          [run]
+          source = ../../src
+          relative_files = true
+          parallel = true
+          EOF
+
+      # Required for the DAB (Databricks Asset Bundle) deploy the MCP suite runs (ci_deploy.sh).
+      # The CLI lands on PATH (via GITHUB_PATH) for the acceptance action's test subprocess.
+      - name: Install Databricks CLI
+        uses: databricks/setup-cli@596b0a354ba14aa59921aca1b02bd67c2b0a81a5 # v0.297.2
+
+      - name: Run MCP integration tests
+        uses: databrickslabs/sandbox/acceptance@83461e5dd7021feabb1a9ca3ee10d6f46b72092a # acceptance/v0.4.6
+        with:
+          vault_uri: ${{ secrets.VAULT_URI }}
+          timeout: 1h
+          codegen_path: tests/integration_mcp/.codegen.json
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
+          ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
+          COVERAGE_FILE: ${{ github.workspace }}/.coverage  # make sure the coverage report is preserved
+
+      - name: Merge coverage reports and convert them to XML
+        run: make combine-coverage
+
+      - name: Publish test coverage
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+        with:
+          use_oidc: true
+          files: coverage-combined.xml
+          flags: mcp

.github/workflows/push.yml

@@ -158,3 +158,20 @@ jobs:
       - name: Run app backend tests
         run: make app-test
         working-directory: .
+
+  mcp:
+    needs: not-a-fork
+    name: Build and Check MCP Server
+    runs-on:
+      group: databrickslabs-protected-runner-group
+      labels: linux-ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+
+      - name: Run MCP server tests
+        run: make mcp-test

Makefile

@@ -68,6 +68,9 @@ perf: ## Run performance benchmarks (long timeout)
 anomaly: ## Run anomaly integration tests (long timeout, with reruns)
 	$(UV_RUN) pytest tests/integration_anomaly/ -v -n 10 --timeout 1200 --durations 20 --reruns 2 --reruns-delay 5
 
+mcp-integration: ## Run MCP server integration tests (deploys an isolated app; requires workspace auth + Databricks CLI)
+	$(UV_RUN) pytest tests/integration_mcp/ -v --timeout 1800 --durations 10
+
 coverage: ## Run all tests (excl. e2e/perf) and open HTML coverage report
 	$(UV_TEST) --ignore=tests/e2e --ignore=tests/perf --cov --cov-report=html tests/
 	open htmlcov/index.html
@@ -177,6 +180,36 @@ app-test: ## Run app backend pytest suite (K=<expr> filter, COV=1 for coverage)
 	  $(if $(K),-k "$(K)") \
 	  $(if $(COV),--cov=src/databricks_labs_dqx_app/backend --cov-report=term-missing --cov-report=xml:coverage-app.xml)
 
+# Run the MCP server's unit-test suite (pytest, no Databricks/Spark dependencies).
+# Usage:  make mcp-test           # run everything
+#         make mcp-test K=expr    # forward -k filter to pytest
+#
+# pytest is not declared in mcp-server's pyproject/uv.lock — the suite only
+# needs anyio, which ships transitively. With UV_FROZEN=1 we can't add pytest
+# to the lock from here, so inject it ephemerally with ``uv run --with pytest``
+# over the synced runtime env (anyio's pytest plugin handles the async tests).
+mcp-test: ## Run MCP server pytest suite (K=<expr> filter)
+	cd mcp-server && uv run --with pytest pytest tests/ \
+	  $(if $(K),-k "$(K)")
+
+# One-command MCP server deploy (parity with app-deploy). Deploys the bundle (app + runner
+# job + setup job), runs the one-time setup job (UC grants + temp-schema ownership), then
+# deploys & starts the app via ``bundle run``. The catalog-name secret must already be set
+# (see the deploy guide) — the setup job and app read it from the secret scope.
+#
+# Usage: make mcp-deploy PROFILE=my-profile
+#        make mcp-deploy PROFILE=my-profile BUNDLE_VARS='--var catalog_name=main'
+# TARGET defaults to the bundle's default target (dev); override with TARGET=<t>.
+# The bundle artifact build runs `uv build ../` from inside mcp-server/, so the global
+# relative UV_BUILD_CONSTRAINT (.build-constraints.txt) would resolve against the wrong
+# directory. Pin it to the absolute repo-root path so the wheel build finds it.
+mcp-deploy: export UV_BUILD_CONSTRAINT := $(CURDIR)/.build-constraints.txt
+mcp-deploy: ## Deploy the MCP server bundle, run setup, and (re)deploy + start the app
+	@test -n "$(PROFILE)" || (echo "Usage: make mcp-deploy PROFILE=<databricks-profile> [TARGET=<bundle-target>] [BUNDLE_VARS=...]"; exit 1)
+	cd mcp-server && databricks bundle deploy -p $(PROFILE) $(if $(TARGET),-t $(TARGET)) $(BUNDLE_VARS)
+	cd mcp-server && databricks bundle run dqx_setup -p $(PROFILE) $(if $(TARGET),-t $(TARGET)) $(BUNDLE_VARS)
+	cd mcp-server && databricks bundle run mcp-dqx -p $(PROFILE) $(if $(TARGET),-t $(TARGET)) $(BUNDLE_VARS)
+
 ##@ App deploy (require PROFILE=<databricks-profile>; most also need TARGET=<bundle-target>)
 
 # Grant Unity Catalog permissions after bundle deploy.
@@ -273,6 +306,14 @@ lock-app-dependencies: ## Regenerate app/uv.lock, app/yarn.lock, app/.build-cons
 	  uv pip compile --generate-hashes --universal --no-header - > app/build-constraints-new.txt
 	mv app/build-constraints-new.txt app/.build-constraints.txt
 
+# Regenerate the MCP server lockfile and scrub private-proxy URLs so the
+# committed file resolves against whatever registry the install environment
+# is configured for (JFrog in CI, public in fork PRs).
+lock-mcp-dependencies: export UV_FROZEN := 0
+lock-mcp-dependencies: ## Regenerate mcp-server/uv.lock
+	cd mcp-server && uv lock --exclude-newer "7 days"
+	perl -pi -e 's|registry = "https://[^"]*"|registry = "https://pypi.org/simple"|g' mcp-server/uv.lock
+
 lock-dependencies: export UV_FROZEN := 0
 lock-dependencies: ## Regenerate top-level uv.lock and .build-constraints.txt
 	uv lock --exclude-newer "7 days"