codeant-ai-for-open-source[bot] commented on code in PR #40473:
URL: https://github.com/apache/superset/pull/40473#discussion_r3328101600
##########
superset/mcp_service/dashboard/tool/get_dashboard_info.py:
##########
@@ -247,6 +248,10 @@ async def get_dashboard_info(
result.is_permalink_state,
)
)
+ return result.model_dump(
+ mode="json",
+ context={"select_columns": request.select_columns},
+ )
Review Comment:
**Suggestion:** This unconditional serialization with
`request.select_columns` still propagates the request default set, and the
current default includes `filter_state`; when `permalink_key` is used, that can
be very large and can still trigger response truncation. Ensure `filter_state`
is excluded from the effective default projection unless explicitly requested,
or strip it before dumping when not explicitly selected. [performance]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ `get_dashboard_info` responses can exceed ResponseSizeGuard limits.
- ❌ Dashboards with large permalink filter_state may return unusable
payloads.
- ⚠️ MCP clients relying on permalink context can see truncated data.
- ⚠️ Size guard errors reduce reliability of dashboard inspection tools.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. An MCP client calls the `get_dashboard_info` FastMCP tool (entrypoint
`get_dashboard_info()` in
`superset/mcp_service/dashboard/tool/get_dashboard_info.py:116`)
via the MCP core (`run_tool()` in `superset/mcp_service/mcp_core.py:808`),
passing a
payload that includes `identifier` and a `permalink_key`, but no explicit
`select_columns`
field.
2. The request is parsed into `GetDashboardInfoRequest`
(`superset/mcp_service/dashboard/schemas.py:74-111`). Because
`select_columns` is omitted,
the `_parse_select_columns` validator at lines 112-120 receives
`value=None`, returns
`list(DEFAULT_GET_DASHBOARD_INFO_COLUMNS)` at line 118, and that default
list (defined at
lines 47-71) includes `"filter_state"` by default.
3. Inside `get_dashboard_info()`
(`superset/mcp_service/dashboard/tool/get_dashboard_info.py:152-224`), when
`request.permalink_key` is set, `_get_permalink_state()` and
`_apply_permalink_state()`
are invoked (lines 183-223). `_apply_permalink_state()`
(`_apply_permalink_state()` at
lines 75-89) injects a sanitized but potentially very large `filter_state`
structure into
the `DashboardInfo` model.
4. On successful retrieval, `get_dashboard_info()` logs success and then
serializes with
`result.model_dump(mode="json", context={"select_columns":
request.select_columns})` at
lines 251-254. Because `request.select_columns` still contains
`"filter_state"` from the
default, the full permalink `filter_state` is included in the response. For
dashboards
with large permalink states this can push the response past the token/size
limit enforced
by `ResponseSizeGuardMiddleware` (see
`tests/unit_tests/mcp_service/test_middleware.py:40-89`, where large
responses are blocked
with `ToolError`), causing the dashboard-info response to be truncated or
rejected for MCP
clients.
```
</details>
[Fix in
Cursor](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=a788c7b2b5bd4e738f160742788dc624&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
| [Fix in VSCode
Claude](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=a788c7b2b5bd4e738f160742788dc624&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/mcp_service/dashboard/tool/get_dashboard_info.py
**Line:** 251:254
**Comment:**
*Performance: This unconditional serialization with
`request.select_columns` still propagates the request default set, and the
current default includes `filter_state`; when `permalink_key` is used, that can
be very large and can still trigger response truncation. Ensure `filter_state`
is excluded from the effective default projection unless explicitly requested,
or strip it before dumping when not explicitly selected.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40473&comment_hash=676be9420bd2429b449a1cbc86d0a8b5bc3741fb7d985aad051890ad018a258d&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40473&comment_hash=676be9420bd2429b449a1cbc86d0a8b5bc3741fb7d985aad051890ad018a258d&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
