Skip to main content

Connect an MCP server

This recipe connects to an MCP server for AI applications using GitHub as an example and Unity Catalog HTTP connections for secure and governed access.

Code snippets​

OAuth User to Machine Per User (On-behalf-of-user)​

app.py
import reflex as rx
from databricks.sdk import WorkspaceClient
from databricks.sdk.service.serving import ExternalFunctionRequestHttpMethod
import json

def get_client_obo(headers) -> WorkspaceClient:
    """Build a WorkspaceClient using the OBO token forwarded by Databricks Apps."""
    token = getattr(headers, "x_forwarded_access_token", "")
    host = getattr(headers, "x_forwarded_host", "")
    return WorkspaceClient(host=host, token=token, auth_type="pat")

def init_mcp_session(w: WorkspaceClient, connection_name: str):
    init_payload = {
        "jsonrpc": "2.0",
        "id": "init-1",
        "method": "initialize",
        "params": {}
    }
    response = w.serving_endpoints.http_request(
        conn=connection_name,
        method=ExternalFunctionRequestHttpMethod.POST,
        path="/",
        json=init_payload,
    )
    return (response.headers.get("mcp-session-id") or response.headers.get("Mcp-Session-Id"))

class McpState(rx.State):
    response_data: str = ""
    error_message: str = ""

    @rx.event(background=True)
    async def send_request(self):
        async with self:
            self.response_data = ""
            self.error_message = ""
            headers = self.router.headers

        w = get_client_obo(headers)
        if not getattr(headers, "x_forwarded_access_token", ""):
            async with self:
                self.error_message = (
                    "No OBO token found. Enable on-behalf-of-user authentication for this Databricks App."
                )
            return

        connection_name = "github_u2m_connection"
        http_method = ExternalFunctionRequestHttpMethod.POST
        path = "/"
        req_headers = {"Content-Type": "application/json"}
        payload = {"jsonrpc": "2.0", "id": "list-1", "method": "tools/list"}

        session_id = init_mcp_session(w, connection_name)
        if session_id:
            req_headers["Mcp-Session-Id"] = session_id

        response = w.serving_endpoints.http_request(
            conn=connection_name,
            method=http_method,
            path=path,
            headers=req_headers,
            json=payload,
        )
        resp_data = response.as_dict() if hasattr(response, "as_dict") else response
        async with self:
            self.response_data = json.dumps(resp_data, indent=2)

Bearer token​

app.py
# Reflex (Databricks) version for a simple GET using a bearer/token-auth HTTP connection.
import reflex as rx
from databricks.sdk import WorkspaceClient
from databricks.sdk.service.serving import ExternalFunctionRequestHttpMethod
import json

w = WorkspaceClient()

response = w.serving_endpoints.http_request(
    conn="github_u2m_connection",
    method=ExternalFunctionRequestHttpMethod.GET,
    path="/",
    headers={"Accept": "application/vnd.github+json"},
    json={
        "jsonrpc": "2.0",
        "id": "init-1",
        "method": "initialize",
        "params": {}
    },
)

rx.code_block(json.dumps(response.as_dict(), indent=2), language="json")

Resources​

Permissions​

Your app service principal needs the following permissions:

  • USE CONNECTION permission on the HTTP Connection

When using OAuth User to Machine Per User (On-behalf-of-user), you need to configure User authorization by adding the Unity Catalog connection or other scopes.

Dependencies​

requirements.txt
databricks-sdk
reflex
mcp[cli]