vaquar khan created FLINK-40287:
-----------------------------------
Summary: Provide a first-party, governed MCP server for Apache
Flink
Key: FLINK-40287
URL: https://issues.apache.org/jira/browse/FLINK-40287
Project: Flink
Issue Type: New Feature
Reporter: vaquar khan
As a platform operator, I want a first-party MCP server that exposes Flink's
control and observability plane (jobs, SQL Gateway, savepoints, metrics,
exceptions, JARs) to agents through a secure-by-default governance layer, so
that agents can operate and observe Flink safely without me trusting an
ungoverned third-party process against production JobManagers.
{*}Description{*}: The server runs as a standalone process outside the
JobManager and TaskManagers, consistent with the FLIP-577 engine non-goal. It
wraps the existing JobManager REST API and SQL Gateway, and applies a
fail-closed governance pipeline (adapted from the KIP-1318 control model) to
every tool call. It complements FLIP-531 and FLIP-548, which make Flink an MCP
client; this makes Flink an MCP server. Full design in FLIP-XXXX (My Confluance
access not enabled once get access will add details here) .
*Acceptance criteria (Given / When / Then):*
Given the server is running, when a client sends initialize, tools/list, and
resources/list over stdio or authenticated HTTP, then it completes the MCP
handshake and advertises the read-only tools and resources; HTTP without valid
credentials is rejected.
Given default configuration, when a client lists tools, then no tool classified
mutate or destructive is present (secure-by-default).
Given any tool call, when it is processed, then it passes an ordered
fail-closed pipeline (exposure, scope, policy, approval, rate limit, breaker)
where the first denial wins and every denial is audited.
Given read-only tools (list_jobs, get_job, get_job_exceptions, get_job_metrics,
list_checkpoints, list_jars), when called, then they return data mapped from
the corresponding REST endpoints, and responses are size-bounded with secrets
and PII redacted.
Given the audit resource flink://audit/recent, when read, then it returns a
tamper-evident record of calls and denials.
Given existing Flink users, then nothing changes: the server is additive and
optional, with no modification to the engine, runtime, REST API, or SQL Gateway.
*Definition of Done:* unit and integration tests passing; additive only;
secure-by-default preserved; audit produced for every call and denial;
documentation updated including which capabilities remain intentionally absent.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
