Using MCP with a limited read-only user

[tomikonio]

Hi,

I’m trying to use the MCP with a user that has read-only access to a specific index. However, I encounter the following error when I run the MCP server (using uvx opensearch-mcp-server-py):

Opensearch version: v 1.3.2

AuthorizationException(403, 'security_exception', 'no permissions for [cluster:monitor/main] and User [name=bobi, backend_roles=[], requestedTenant=null]')

Is there a way to run the MCP with such a limited-permission user? We only need access to that specific index and don’t require broader permissions.

UPDATE:
When I try to use it with a URL that points to the specific index (i.e. <URL>/<index_name>), I get the follwoing error:

opensearchpy.exceptions.AuthorizationException: AuthorizationException(403, 'security_exception', 'no permissions for [indices:admin/get] and User [name=bobi, backend_roles=[], requestedTenant=null]')

When trying to run it with this URL: <URL>/<index_name>-*/_search, we get the following error:

line 57, in get_opensearch_version
    return Version.parse(response['version']['number'])
                         ~~~~~~~~^^^^^^^^^^^
KeyError: 'version'

[rithin-pullela-aws]

Thanks for starting the discussion @tomikonio .

I found the root cause of the issue: https://github.com/opensearch-project/opensearch-mcp-server-py/blob/51cd164055852971f24b7e02349cff5723b61ad4/src/opensearch/helper.py#L59C1-L73C56

We are trying to perform client.info() operation to filter tools based on version. This operation requires cluster:monitor/main permissions.

This is a bug which needs to be addressed. Can you please create an issue for this?

Quick Fix for you:

• Add the permission to the user
• If you are doing POCs, you can overwrite the get_opensearch_version function to return 1.3.2 and create the server from code. Follow the developer guide to set it up.

Potential ways to resolve the bug:

• Find a way to get version which works for all the users without relying on client.info()
• Accept an env variable to skip version based tool filtering
• Gracefully fall back if the version check fails

[tomikonio]

Thanks, opened an issue: #72