[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article-preset-mcp-enterprise-controls-superset-en":3,"tags-preset-mcp-enterprise-controls-superset-en":30,"related-lang-preset-mcp-enterprise-controls-superset-en":41,"related-posts-preset-mcp-enterprise-controls-superset-en":45,"series-tools-ec020fa2-b9fa-49eb-b93f-1d080671e33e":82},{"id":4,"title":5,"content":6,"summary":7,"source":8,"source_url":9,"author":10,"image_url":11,"keywords":12,"language":18,"translated_content":10,"views":19,"is_premium":20,"created_at":21,"updated_at":21,"cover_image":11,"published_at":22,"rewrite_status":23,"rewrite_error":10,"rewritten_from_id":24,"slug":25,"category":26,"related_article_id":27,"status":28,"google_indexed_at":29,"x_posted_at":10,"tweet_text":10,"title_rewritten_at":10,"title_original":10,"key_takeaways":10,"topic_cluster_id":10,"embedding":10,"is_canonical_seed":20},"ec020fa2-b9fa-49eb-b93f-1d080671e33e","Preset MCP adds enterprise controls to Superset","\u003Cp>\u003Ca href=\"https:\u002F\u002Fpreset.io\u002Fblog\u002Fpreset-mcp-open-source-to-enterprise\u002F\" target=\"_blank\" rel=\"noopener\">Preset\u003C\u002Fa> is taking Apache Superset’s MCP service from a single-tenant demo into something a real company can run in production. The company says its setup keeps the open-source tools intact while adding workspace isolation, OAuth 2.0, and a built-in Chatbot on top.\u003C\u002Fp>\u003Cp>The interesting part is the architecture choice: Preset did not fork the open-source service. Instead, it wrapped it with middleware, identity checks, and Kubernetes plumbing so the same tool calls still work, but only inside the right workspace and permission boundary.\u003C\u002Fp>\u003Ch2>What Preset changed, and why it matters\u003C\u002Fh2>\u003Cp>Model Context Protocol has become a clean way to connect AI assistants to live tools. In analytics, that means an assistant can list charts, query datasets, or create dashboards instead of just summarizing static exports. The catch is that most MCP examples assume one database, one user group, and one happy-path deployment.\u003C\u002Fp>\n\u003Cfigure class=\"my-6\">\u003Cimg src=\"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1775164015640-ysxx.png\" alt=\"Preset MCP adds enterprise controls to Superset\" class=\"rounded-xl w-full\" loading=\"lazy\" \u002F>\u003C\u002Ffigure>\n\u003Cp>Preset’s version has to deal with a managed analytics platform that may host dozens or hundreds of isolated workspaces. That means every request needs the right database connection, the right user identity, and the right permissions before a tool runs.\u003C\u002Fp>\u003Cp>Preset’s blog lays out the contrast plainly. Open-source Superset MCP uses single-tenant JWT auth and a standalone process. Preset adds OAuth 2.0 with PKCE, per-workspace binding, a dedicated Kubernetes pod, and metrics collection.\u003C\u002Fp>\u003Cul>\u003Cli>Open-source MCP: single database, single tenant, standalone process\u003C\u002Fli>\u003Cli>Preset MCP: per-workspace isolation with request-level database binding\u003C\u002Fli>\u003Cli>Auth: JWT in OSS, JWT plus OAuth 2.0 in Preset\u003C\u002Fli>\u003Cli>Deployment: Docker or process in OSS, Kubernetes pod with autoscaling in Preset\u003C\u002Fli>\u003Cli>Observability: basic logging in OSS, Datadog metrics plus event logging in Preset\u003C\u002Fli>\u003C\u002Ful>\u003Cp>The design goal is simple: every open-source improvement should still flow into Preset. That matters for teams that care about upstream compatibility and do not want a private fork that drifts over time.\u003C\u002Fp>\u003Cp>That choice also keeps the tool surface consistent. Preset says the same MCP tools, DAO calls, and RBAC checks still run, but only after the platform injects the right workspace context.\u003C\u002Fp>\u003Ch2>The security model is doing most of the heavy lifting\u003C\u002Fh2>\u003Cp>The hardest part of this story is not the chatbot. It is the security model. Preset has to prove that a request from one workspace never leaks into another, even when the request comes from an AI client that may chain several tool calls together.\u003C\u002Fp>\u003Cp>The company’s middleware stack does the enforcement in layers. It strips the \u002Fmcp prefix, rewrites OAuth metadata, validates JWT access, checks workspace access through the Preset Manager API, then binds the workspace database before the open-source MCP code executes.\u003C\u002Fp>\u003Cp>That is a practical answer to a problem many teams gloss over. AI tool use is stateful, and state is where most multi-tenant mistakes happen.\u003C\u002Fp>\u003Cblockquote>“The answer: wrap, don’t fork.” — Amin Ghadersohi, Preset, in the company’s March 31, 2026 blog post\u003C\u002Fblockquote>\u003Cp>Preset also adds two auth modes for different workflows. JWT mode fits API integrations and server-to-server access. OAuth 2.0 mode fits interactive tools like \u003Ca href=\"https:\u002F\u002Fclaude.ai\u002Fdownload\" target=\"_blank\" rel=\"noopener\">Claude Desktop\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fwww.anthropic.com\u002Fclaude-code\" target=\"_blank\" rel=\"noopener\">Claude Code\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>The OAuth path uses Auth0 for identity, PKCE for browser-based login, and Redis-backed state so sessions survive across multiple MCP pods. Preset says it caches OAuth transactions for 10 minutes, authorization-code data for 30 days, and session validation for 5 minutes.\u003C\u002Fp>\u003Cul>\u003Cli>JWT mode: token issued by Preset Manager, validated through JWKS\u003C\u002Fli>\u003Cli>OAuth 2.0 mode: Authorization Code + PKCE with dynamic client registration\u003C\u002Fli>\u003Cli>Redis TTLs: 10 minutes for OAuth state, 30 days for DCR cache, 5 minutes for session validation\u003C\u002Fli>\u003Cli>Workspace access: checked before the MCP tool executes\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>The built-in Chatbot changes who can use MCP\u003C\u002Fh2>\u003Cp>External clients are great for power users, but they create friction. Someone has to install a client, configure a server URL, and understand enough of the protocol to get started. Preset’s built-in Chatbot removes that step by placing the same MCP capability inside the Superset UI.\u003C\u002Fp>\n\u003Cfigure class=\"my-6\">\u003Cimg src=\"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1775164018115-jq39.png\" alt=\"Preset MCP adds enterprise controls to Superset\" class=\"rounded-xl w-full\" loading=\"lazy\" \u002F>\u003C\u002Ffigure>\n\u003Cp>That matters because it turns MCP from an integration project into a product feature. A user can open Superset, click a floating chat bubble, and ask for sales trends or a dashboard for quarterly metrics. Under the hood, the same MCP tools still do the work.\u003C\u002Fp>\u003Cp>Preset says the Chatbot uses a \u003Ca href=\"https:\u002F\u002Fwww.langchain.com\u002Flanggraph\" target=\"_blank\" rel=\"noopener\">LangGraph\u003C\u002Fa> agent, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain-mcp-adapters\" target=\"_blank\" rel=\"noopener\">langchain-mcp-adapters\u003C\u002Fa> for tool discovery, and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fjonathanslenders\u002Fasyncpg\" target=\"_blank\" rel=\"noopener\">AsyncPostgresSaver\u003C\u002Fa> for checkpointing conversations. Responses stream back over SSE so users see tokens, tool calls, and status updates in \u003Ca href=\"\u002Fnews\u002Fai-music-streaming-labels-lawsuits-en\">real time\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>That is a much better fit for analytics teams than a pure external-client story. Analysts can stay inside the BI product they already use, while power users still get Claude Desktop or \u003Ca href=\"\u002Fnews\u002Fopenai-plugin-claude-code-workflow-cuts-four-steps-en\">Claude Code\u003C\u002Fa> if they want direct control.\u003C\u002Fp>\u003Cp>Preset also says the built-in Chatbot and the external MCP clients expose the same 20 tools, the same RBAC, and the same data. That consistency is the real selling point.\u003C\u002Fp>\u003Cul>\u003Cli>Built-in Chatbot: no setup inside Superset\u003C\u002Fli>\u003Cli>External MCP clients: Claude Desktop and Claude Code for advanced workflows\u003C\u002Fli>\u003Cli>Same toolset: 20 tools across both paths\u003C\u002Fli>\u003Cli>Same permissions: RBAC and row-level controls still apply\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>How Preset compares with the open-source service\u003C\u002Fh2>\u003Cp>Preset’s blog includes a helpful side-by-side view of what changes between the open-source service and the managed version. The differences are less about raw capability and more about operational maturity.\u003C\u002Fp>\u003Cp>Here is the practical comparison:\u003C\u002Fp>\u003Cul>\u003Cli>Authentication: OSS supports JWT; Preset adds OAuth 2.0 with PKCE and Auth0\u003C\u002Fli>\u003Cli>Multi-tenancy: OSS does not support it; Preset binds each request to a workspace\u003C\u002Fli>\u003Cli>User interface: OSS is external-client only; Preset adds an in-product Chatbot\u003C\u002Fli>\u003Cli>Deployment: OSS can run as a standalone process; Preset runs a dedicated Kubernetes service\u003C\u002Fli>\u003Cli>Monitoring: OSS has basic logging; Preset emits Datadog metrics and Superset event logs\u003C\u002Fli>\u003Cli>Feature control: OSS uses config flags; Preset uses split-based per-workspace flags\u003C\u002Fli>\u003C\u002Ful>\u003Cp>That last point matters more than it sounds. Workspace-level feature flags let Preset roll out MCP to internal teams, then beta customers, then broader groups without redeploying code. For a managed product, that is the difference between controlled adoption and a messy all-at-once launch.\u003C\u002Fp>\u003Cp>Preset also adds operational details that matter once traffic grows: a separate MCP pod, horizontal pod autoscaling, session affinity for OAuth flows, health probes, and tracing through Datadog. None of that is flashy, but all of it is what keeps a service alive after the demo is over.\u003C\u002Fp>\u003Cp>If you want the open-source version of the story, Preset points readers to its companion technical deep dive on the Apache Superset MCP service. For background on the project itself, see \u003Ca href=\"https:\u002F\u002Fsuperset.apache.org\u002F\" target=\"_blank\" rel=\"noopener\">Apache Superset\u003C\u002Fa> and the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fapache\u002Fsuperset\" target=\"_blank\" rel=\"noopener\">Apache Superset GitHub repository\u003C\u002Fa>.\u003C\u002Fp>\u003Ch2>What this says about enterprise AI tooling\u003C\u002Fh2>\u003Cp>Preset’s bet is pretty clear: the winning enterprise AI tools will feel like normal product features, while still keeping the protocol layer open and portable. That is a stronger pitch than a standalone agent demo, because it fits the way analytics teams actually work.\u003C\u002Fp>\u003Cp>It also hints at where MCP adoption may go next. The protocol itself solves tool discovery and transport. The real product work lives around it: identity, workspace isolation, observability, rollout controls, and a user experience that does not require a separate app.\u003C\u002Fp>\u003Cp>For teams thinking about similar deployments, the takeaway is straightforward. If your AI tool needs to touch real data, the question is not whether the model can call a function. The question is how you keep that function call tied to the right tenant, the right permissions, and the right audit trail.\u003C\u002Fp>\u003Cp>Preset’s answer is to keep the open-source core intact and add enterprise controls around it. If that pattern holds, the next wave of analytics copilots will look less like experiments and more like normal parts of the BI stack. The open question is which vendors can ship that experience without turning every upgrade into a fork maintenance exercise.\u003C\u002Fp>","Preset wraps Apache Superset MCP with OAuth 2.0, workspace isolation, Chatbot, and Kubernetes deployment for production use.","preset.io","https:\u002F\u002Fpreset.io\u002Fblog\u002Fpreset-mcp-open-source-to-enterprise\u002F",null,"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1775164015640-ysxx.png",[13,14,15,16,17],"Preset MCP","Apache Superset","Model Context Protocol","OAuth 2.0","multi-tenant analytics","en",1,false,"2026-04-02T21:06:37.799901+00:00","2026-04-02T21:06:37.766+00:00","done","e1095705-ffa1-4112-affb-3516ab17781e","preset-mcp-enterprise-controls-superset-en","tools","4c440055-5b31-4b39-8276-89d1abe4699b","published","2026-04-08T09:00:48.694+00:00",[31,33,35,37,39],{"name":13,"slug":32},"preset-mcp",{"name":15,"slug":34},"model-context-protocol",{"name":14,"slug":36},"apache-superset",{"name":16,"slug":38},"oauth-20",{"name":17,"slug":40},"multi-tenant-analytics",{"id":27,"slug":42,"title":43,"language":44},"preset-mcp-enterprise-controls-superset-zh","Preset 為 Superset MCP 加上企業控管","zh",[46,52,58,64,70,76],{"id":47,"slug":48,"title":49,"cover_image":50,"image_url":50,"created_at":51,"category":26},"a6c1d84d-0d9c-4a5a-9ca0-960fbfc1412e","why-gemini-api-pricing-is-cheaper-than-it-looks-en","Why Gemini API pricing is cheaper than it looks","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778869846824-s2r1.png","2026-05-15T18:30:26.595941+00:00",{"id":53,"slug":54,"title":55,"cover_image":56,"image_url":56,"created_at":57,"category":26},"8b02abfa-eb16-4853-8b15-63d302c7b587","why-vidhub-huiyuan-hutong-bushi-quan-shebei-tongyong-en","Why VidHub 会员互通不是“买一次全设备通用”","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778789439875-uceq.png","2026-05-14T20:10:26.046635+00:00",{"id":59,"slug":60,"title":61,"cover_image":62,"image_url":62,"created_at":63,"category":26},"abe54a57-7461-4659-b2a0-99918dfd2a33","why-buns-zig-to-rust-experiment-is-right-en","Why Bun’s Zig-to-Rust experiment is the right move","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778767895201-5745.png","2026-05-14T14:10:29.298057+00:00",{"id":65,"slug":66,"title":67,"cover_image":68,"image_url":68,"created_at":69,"category":26},"f0015918-251b-43d7-95af-032d2139f3f6","why-openai-api-pricing-is-product-strategy-en","Why OpenAI API pricing is a product strategy, not a footnote","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778749841805-uyhg.png","2026-05-14T09:10:27.921211+00:00",{"id":71,"slug":72,"title":73,"cover_image":74,"image_url":74,"created_at":75,"category":26},"7096dab0-6d27-42d9-b951-7545a5dddf33","why-claude-code-prompt-design-beats-ide-copilots-en","Why Claude Code’s prompt design beats IDE copilots","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778742651754-3kxk.png","2026-05-14T07:10:30.953808+00:00",{"id":77,"slug":78,"title":79,"cover_image":80,"image_url":80,"created_at":81,"category":26},"1f1bff1e-0ebc-4fa7-a078-64dc4b552548","why-databricks-model-serving-is-right-default-en","Why Databricks Model Serving is the right default for production infe…","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1778692290314-gopj.png","2026-05-13T17:10:32.167576+00:00",[83,88,93,98,103,108,113,118,123,128],{"id":84,"slug":85,"title":86,"created_at":87},"8008f1a9-7a00-4bad-88c9-3eedc9c6b4b1","surepath-ai-mcp-policy-controls-en","SurePath AI's New MCP Policy Controls Enhance AI Security","2026-03-26T01:26:52.222015+00:00",{"id":89,"slug":90,"title":91,"created_at":92},"27e39a8f-b65d-4f7b-a875-859e2b210156","mcp-standard-ai-tools-2026-en","MCP Standard in 2026: Integrating AI Tools","2026-03-26T01:27:43.127519+00:00",{"id":94,"slug":95,"title":96,"created_at":97},"165f9a19-c92d-46ba-b3f0-7125f662921d","rag-2026-transforming-enterprise-ai-en","How RAG in 2026 is Transforming Enterprise AI","2026-03-26T01:28:11.485236+00:00",{"id":99,"slug":100,"title":101,"created_at":102},"6a2a8e6e-b956-49d8-be12-cc47bdc132b2","mastering-ai-prompts-2026-guide-en","Mastering AI Prompts: A 2026 Guide for Developers","2026-03-26T01:29:07.835148+00:00",{"id":104,"slug":105,"title":106,"created_at":107},"d6653030-ee6d-4043-898d-d2de0388545b","evolving-world-prompt-engineering-en","The Evolving World of Prompt Engineering","2026-03-26T01:29:42.061205+00:00",{"id":109,"slug":110,"title":111,"created_at":112},"3ab2c67e-4664-4c67-a013-687a2f605814","garry-tan-open-sources-claude-code-toolkit-en","Garry Tan Open-Sources a Claude Code Toolkit","2026-03-26T08:26:20.245934+00:00",{"id":114,"slug":115,"title":116,"created_at":117},"66a7cbf8-7e76-41d4-9bbf-eaca9761bf69","github-ai-projects-to-watch-in-2026-en","20 GitHub AI Projects to Watch in 2026","2026-03-26T08:28:09.752027+00:00",{"id":119,"slug":120,"title":121,"created_at":122},"231306b3-1594-45b2-af81-bb80e41182f2","claude-code-vs-cursor-2026-en","Claude Code vs Cursor in 2026","2026-03-26T13:27:14.177468+00:00",{"id":124,"slug":125,"title":126,"created_at":127},"9f332fda-eace-448a-a292-2283951eee71","practical-github-guide-learning-ml-2026-en","A Practical GitHub Guide to Learning ML in 2026","2026-03-27T01:16:50.125678+00:00",{"id":129,"slug":130,"title":131,"created_at":132},"1b1f637d-0f4d-42bd-974b-07b53829144d","aiml-2026-student-ai-ml-lab-repo-review-en","AIML-2026 Is a Bare-Bones Student Lab Repo","2026-03-27T01:21:51.661231+00:00"]