Ankra

Grant cluster access

grant_cluster_access

Destructive

Give an organisation member time-boxed Kubernetes access to one cluster through the Ankra cluster gateway (the twin of ankra cluster access grant). Needs kube_access.manage; a kube_access.elevate holder may only grant themselves inside the self-elevation bounds (use elevate_cluster_access). The grant must expire (expires_in or expires_at): a standing grant is made in the portal or with the CLI. The organisation access policy bounds it: the role ceiling, the longest an elevated grant may last, and when a reason is required; a refusal names the bound. A matching live grant with an expiry is re-timed in place. Always have the user confirm the member, cluster, role and lifetime first.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "user_email": "<user_email>",
      "role": "<role>"
    },
    "name": "grant_cluster_access"
  }
}

Input Schema

Name	Required	Description
`role`	Yes	Kubernetes role the grant carries; must not exceed the organisation access policy's max_grant_role (get_cluster_access_policy).
`scope`	No	cluster (default) for the whole cluster, namespace for one namespace.
`reason`	No	Why the access is needed. The organisation access policy may require it for elevated roles (require_reason_from_role).
`namespace`	No	The namespace, required with scope namespace and refused otherwise (a DNS-1123 label).
`cluster_id`	No	UUID of the cluster. Optional when a cluster is selected.
`expires_at`	No	When the grant ends, an RFC 3339 timestamp at least a minute ahead. Give this or expires_in.
`expires_in`	No	How long the grant lasts: whole days (7d) or a duration (30m, 4h, 1h30m), at least 1m. Give this or expires_at.
`user_email`	Yes	Email of the organisation member to grant access to.
`cluster_name`	No	Exact name of the cluster. Optional when a cluster is selected.

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 8, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare a non-read-only, destructive, non-idempotent operation, but the description adds substantial context: required permission, self-elevation constraints, mandatory expiry, policy ceilings, refusal behaviour, and in-place re-timing of matching live grants. This does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and operational constraints, and nearly every sentence carries useful information. It is dense and slightly long, but there is little obvious filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, high-impact mutation with nine parameters and no output schema, the description covers permissions, alternatives, expiry requirements, policy bounds, re-timing behaviour, and confirmation guidance. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so per-parameter meaning is already well documented. The description adds a useful cross-field rule that either `expires_in` or `expires_at` must be supplied, and ties role and reason requirements to the organisation access policy, though it does not add new syntax beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: giving an organisation member time-boxed Kubernetes access to one cluster. It also distinguishes this tool from `elevate_cluster_access` and from standing grants made in the portal or CLI.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the main usage context, names the alternative for self-elevation (`elevate_cluster_access`), excludes standing grants from this tool, and instructs the agent to confirm member, cluster, role and lifetime before acting.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Ankra tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.