# Reported issues for fabric-dw

Pod holds 23 of 352 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [fabric-dw](/mcp/fabric-dw).

## Most discussed

### feat(observability): add opt-out telemetry (OpenTelemetry traces + metrics)

## Goal

Add **opt-out, anonymous, privacy-respecting usage telemetry** to the CLI and MCP server so the project maintainers can understand how the tool is actually used — which commands are run, what errors occur, and where. Telemetry is enabled by default but must be trivially disable-able.

This is **not** about local observability (traces, spans, metrics for the operator's own infrastructure) — that is a separate concern. This issue is strictly about **project-level usage telemetry** sent fr

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/339) · 2026-06-15 · closed · 5 comments

### feat(permissions): dynamic data masking (column masks + UNMASK), depends on #916

> DESIGN ONLY. Depends on #916 (the `permissions` group, for the UNMASK permission). Do not implement until #916 has shipped and this design is approved.

## Summary

Dynamic data masking (DDM) in Fabric has two parts: (1) managing the mask on a column via `ALTER TABLE ... ALTER COLUMN ... ADD/DROP MASKED`, and (2) the `UNMASK` permission that lets a principal see unmasked values (reuses the #916 `permissions sql` plane). Supported on Warehouse and SQL analytics endpoint.

Docs: https://learn.mi

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/920) · 2026-06-29 · closed · 3 comments

### feat(permissions): row-level security (security policies + predicates), depends on #916

> DESIGN ONLY. Depends on #916 (the `permissions` group). Do not implement until #916 has shipped and this design is approved.

## Summary

Row-level security (RLS) in Fabric restricts which rows a principal can read/write via a SECURITY POLICY that attaches filter and/or block predicates (inline table-valued functions) to a table. This is a NEW surface that manages the POLICY lifecycle and references an EXISTING predicate function; it does NOT author the predicate function body (that is a user-

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/919) · 2026-06-29 · closed · 3 comments

### feat(permissions): column-level security (column-scoped GRANT/DENY), extends #916

> DESIGN ONLY. Depends on #916 (the `permissions sql` plane). Do not implement until #916 has shipped and this design is approved.

## Summary

Column-level security (CLS) in Fabric is implemented entirely through column-scoped object permissions: `GRANT` / `DENY` / `REVOKE` of `SELECT` (and a few other permissions) on a comma-delimited column list of a table. There is no separate CLS object; it is a thin extension of the #916 `permissions sql` commands, not a new group.

Docs: https://learn.mic

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/918) · 2026-06-29 · closed · 3 comments

### feat(permissions)!: new 'permissions' group for T-SQL granular permissions + relocate Fabric item-level permissions

> DESIGN ONLY. This issue proposes the command/tool structure for review. No implementation should start until the maintainer approves the design (and the open questions at the bottom are decided).

## Goal

Add a new top-level `permissions` command group that gives full CRUD over **T-SQL granular (in-database) permissions** on all warehouse securables (database, schema, table, view, function, procedure) via `GRANT` / `REVOKE` / `DENY`, plus reads of the current grants. Relocate the existing **F

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/916) · 2026-06-29 · closed · 3 comments

### Track: set SQL connection program_name to fdw.debruyn.dev (blocked on mssql-python#649)

Queries issued by this tool show up in the warehouse query history / sys.dm_exec_sessions with program_name = "MSSQL-Python", which is the mssql_python driver default. build_connection_string (src/fabric_dw/sql.py) augments the API connection string with Authentication, Encrypt, TrustServerCertificate and Database, but never sets an Application Name, so the driver default leaks through.

We want our connections to be identifiable as this tool: program_name should read "fdw.debruyn.dev".

## Fix

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/892) · 2026-06-27 · open · 3 comments

### docs(restore): document Fabric warehouse restore-points REST endpoints

**Coordinator-driven doc PR.** No public v1 REST is documented for restore points (verified again on 2026-06-07 — Microsoft Learn still only describes the Fabric portal flow). Block on a quick DevTools capture from Sam, then a small \`docs/internal/restore-api.md\` lands in the repo and unblocks issue #27 (the restore service).

## What Sam needs to do (≈10 min)

1. Open the Fabric portal on a test warehouse in Edge/Chrome, **F12 → Network**.
2. Filter on \`restore\`.
3. Perform each action and 

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/25) · 2026-06-07 · closed · 3 comments

### research: is the GPU query acceleration workspace toggle reachable through an API?

## What this is

GPU query acceleration (CoddSpeed) has moved from "Coming Soon" to Early Access Preview. It is switched on per workspace through the Fabric portal: Workspace settings > Data Warehouse > Query acceleration (Preview), and it applies to every warehouse and SQL analytics endpoint in that workspace. It is real enough to have a published capacity rate: one Data Warehouse core with query acceleration enabled counts as 3.446 CUs ([Fabric operations](https://learn.microsoft.com/fabric/en

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1031) · 2026-08-23 · closed · 2 comments

## Most recent

### refactor: remove all product telemetry and unwind telemetry-driven architecture

## Decision

Remove product usage telemetry from `fabric-dw` completely.

This is a removal, not a default-off switch, dormant implementation, reduced event set, exporter swap, or abstraction kept for possible future reuse. The usage snapshot has already answered the useful directional questions: the project has real external use, SQL execution is the dominant workflow, and discovery/error UX is the useful product follow-up. The ongoing code, dependency, privacy, review, and runtime cost is not 

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1057) · 2026-08-25 · closed · 0 comments

### docs: move protocol and transport detail off the README and install page

## Problem

The README and `docs/install.md` carry protocol and transport detail that belongs neither on a landing page nor in an installation guide. Both sections were added with the SDK v2 migration (#1043) and describe things almost no reader needs.

### The 4 MiB body limit

The same paragraph now exists in four places:

- `README.md:186`
- `docs/install.md:481`
- `docs/reference/hosting-mcp-server.md:20`
- `docs/troubleshooting.md:189` (as a proper symptom-first entry, which is the right sh

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1055) · 2026-08-25 · closed · 0 comments

### security(telemetry): undocumented hourly control-plane poll from the Azure exporter

## What happens

`BaseExporter.__init__` in `azure-monitor-opentelemetry-exporter` starts a `ConfigurationWorker` daemon thread that polls

```
https://settings.sdk.monitor.azure.com/AzMonSDKDynamicConfigurationChanges
```

roughly hourly, sending the operating system, `rp`, `attach`, component, version, region and the instrumentation key. It also acts as a remote kill switch for the exporter's offline storage.

This is shared by the log exporter, so it is live on `main` today. It does not come 

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1053) · 2026-08-24 · closed · 1 comment

### chore(telemetry): clean up the loose ends from the #1051 review

## Context

Review of #1051 surfaced a set of small items that were deliberately kept out of that PR to keep the fix round focused. None is a defect that matters on its own; together they are worth one pass.

## 1. Losing the provider race now builds and discards a real Azure exporter

`install_mcp_span_pipeline` was changed to build the exporter and processor before claiming the global provider, which was the right fix for the ordering bug. The side effect is that an embedded-host process, wher

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1052) · 2026-08-24 · closed · 1 comment

### feat(telemetry): collect MCP protocol spans from the SDK

## What

Collect the MCP SDK's OpenTelemetry protocol spans into the project's Application Insights, stripping request-supplied free-text values on the way out.

## Why this is the cheap option

The SDK already produces this instrumentation. It covers every protocol message, it is maintained upstream, and it keeps covering new message types as the protocol evolves without anyone here remembering to add a field. Hand-rolled telemetry is the opposite: every new thing worth measuring is a code chan

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1049) · 2026-08-24 · closed · 0 comments

### security(mcp): non-loopback binds lose Host and Origin validation under SDK v2

## What changes

Under the MCP SDK v2 migration (#1043 / PR #1045), a server started with a non-loopback host loses Host and Origin validation entirely. The default loopback path is unaffected.

This is not a change anyone made deliberately. It falls out of where the two SDK versions compute the setting.

**v1**: `FastMCP.__init__` derived `transport_security` from the *constructor's* `host` argument, which this project never passed, so it defaulted to `127.0.0.1` and froze a loopback-only allow

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1046) · 2026-08-24 · closed · 0 comments

### chore(deps)!: migrate to MCP Python SDK v2

## Summary

Migrate from MCP Python SDK 1.28.1 to 2.0.0. This is a real migration, not a version bump: the module tree `mcp.server.fastmcp` does not exist in v2. There is no alias, no shim and no deprecation period, so every module importing it fails at import time. That is why the dependabot PR #1039, which only widens the constraint to `<3`, fails Type check, Unit tests, Runtime smoke and Slow tests at once. #1039 is closed in favour of this.

#1042 has landed (`cacc7b8`). The shared test help

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1043) · 2026-08-23 · closed · 0 comments

### test(mcp): extract a shared tool-call helper for the MCP test suite

## Why

The MCP test suite calls the SDK's private tool manager directly in roughly 590 places across 24 test files:

```python
result = await mcp._tool_manager.call_tool("list_tables", {...})
```

Two problems. It reaches into a private SDK internal from 590 separate places, and in MCP SDK v2 the signature changes: `context` becomes a required positional argument, so every one of those sites breaks at once.

Extracting a single helper now removes the private-API dependency from the whole suite 

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1042) · 2026-08-23 · closed · 0 comments

### chore(cli): clean up result renderer inconsistencies found reviewing #1036

## Context

Three independent reviews of #1036 (zero-row `SELECT` rendering) surfaced a cluster of smaller inconsistencies in the result renderer that were deliberately left out of that PR to keep it focused. Collecting them here.

## 1. Inverted default for `prune_null_columns`

`_render_positional_table` in `src/fabric_dw/cli/_render.py` defaults `prune_null_columns=True`, while its only public wrapper, `render_result_rows`, defaults the same parameter to `False`. Reading either signature in i

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1041) · 2026-08-23 · closed · 0 comments

### chore(deps): bump mssql-python 1.9.0 to 1.13.0 (ODBC driver moves to a companion package)

## What this is

`uv.lock` pins `mssql-python` at 1.9.0 (released 2026-06-12). Four minor releases have shipped since: 1.10.0 (2026-06-26), 1.11.0 (2026-07-10), 1.12.0 (2026-07-24), 1.13.0 (2026-08-07). This is the driver every SQL path in the tool runs on, so sitting two months behind is not a neutral state.

Dependabot has filed nothing for it, and that is expected given the setup: `pyproject.toml` declares `mssql-python>=1.9.0`, which already permits 1.13.0, so the `pip` ecosystem sees no con

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1032) · 2026-08-23 · closed · 0 comments

### fix(cli): zero-row SELECT in `sql exec` prints the DDL/DML success banner

## Problem

`sql exec` decides how to render a result by looking at `result.rows`, not at `result.columns`:

```python
if ctx.json_output:
    render(...)
elif result.rows:
    render_result_rows(...)
else:
    click.echo(f"Query executed successfully. rowcount={result.rowcount}")
```

A `SELECT` that matches nothing returns `columns=['session_id', ...]` with `rows=[]`, so it falls into the last branch and prints `Query executed successfully. rowcount=0`, the banner meant for DDL and DML. The us

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1030) · 2026-08-23 · closed · 0 comments

### Add live watch mode to `sql exec` for custom queries

## Scope

Add `--watch SECONDS` to `sql exec`, so an arbitrary user-supplied query can be followed live the same way `queries running`, `queries locks`, and `queries connections` already can (see #1014).

While doing so, lift the existing watch loop out of `queries.py` into a shared CLI helper so both command groups run one implementation.

## Design notes

- The loop currently lives in `src/fabric_dw/cli/commands/queries.py` as `_watch_render`, hardcoded to `Sequence[_JsonModel]` plus `render(.

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1027) · 2026-08-23 · closed · 0 comments

### feat(mcp): add list_capabilities tool for tool discovery

## Summary

Add a `list_capabilities` MCP tool that returns all available tools grouped by domain, so AI agents can discover dedicated tools before falling back to `execute_sql`.

Telemetry from #985 shows `execute_sql` still accounts for 51% of all MCP calls despite the instructions block (#986, #993). `service_principal` sessions use `execute_sql` for 90% of calls. A discovery tool is needed.

## Acceptance criteria

- [ ] New `list_capabilities` MCP tool (no parameters) returns `dict[str, lis

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1018) · 2026-07-19 · closed · 0 comments

### Add live watch mode for query inspection commands

## Scope

Add `--watch SECONDS` to live query inspection:

- `queries running`
- `queries locks`
- `queries connections`

## Acceptance criteria

- Positive integer intervals only.
- Render immediately, then redraw terminal output at the requested interval with a watch-style header.
- Preserve lock filters on every refresh.
- Reject `--watch` combined with `--json` before doing network work.

## Verification

Focused CLI unit tests, lint, and type checks pass.

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1014) · 2026-07-17 · closed · 0 comments

### Add queries show command and remove always-null query_text from running queries

## Summary

Two related changes:

1. **Remove `query_text`** from the `RunningQuery` model and the `_LIST_RUNNING_SQL` query. It is always `NULL` because `sys.dm_exec_sql_text` is not supported on Fabric DW. Keeping it adds noise to JSON output and confuses MCP consumers. The `dist_statement_id` column (added in #1008) provides the correlation key to look up query text separately.

2. **Add `queries show <dist_statement_id>`** command (CLI + MCP tool) that looks up a specific query's full detail

[Read the thread](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues/1009) · 2026-07-17 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/sdebruyn/fabric-dw-mcp-cli/issues).