User (AI Agent) ──→ MCP Server ──→ Ranger Policy Check ──→ RAG Studio
                                        │
                                  DENY → "Access Denied"
                                  ALLOW → Forward query, return results

git clone <repo-url>
cd ranger-rag-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

cp .env.example .env
# Edit .env with your Ranger and RAG Studio credentials

{
  "mcpServers": {
    "ranger-rag-mcp-server": {
      "command": "/FULL/PATH/TO/ranger-rag-mcp/.venv/bin/python",
      "args": ["-m", "ranger_rag_mcp_server.server"],
      "env": {
        "RANGER_GATEWAY_URL": "https://<gateway>/<topology>/cdp-proxy-api/ranger/",
        "RANGER_USER": "<workload_username>",
        "RANGER_PASS": "<workload_password>",
        "RANGER_SERVICE_NAME": "rag",
        "RAG_STUDIO_URL": "https://<rag-studio-url>",
        "RAG_STUDIO_API_KEY": "<api_key>"
      }
    }
  }
}

{
  "mcpServers": {
    "ranger-rag-mcp-server": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/<your-org>/ranger-rag-mcp@main",
        "run-server"
      ],
      "env": {
        "RANGER_GATEWAY_URL": "https://<gateway>/<topology>/cdp-proxy-api/ranger/",
        "RANGER_USER": "<workload_username>",
        "RANGER_PASS": "<workload_password>",
        "RANGER_SERVICE_NAME": "rag",
        "RAG_STUDIO_URL": "https://<rag-studio-url>",
        "RAG_STUDIO_API_KEY": "<api_key>"
      }
    }
  }
}

# User with access → gets results
"As user 'alice', query the 'Finance KB' knowledge base: What was Q3 revenue?"

# User without access → gets denied
"As user 'bob', query the 'HR Policies' knowledge base: What is the PTO policy?"

# Check what a user can access
"List all knowledge bases that user 'alice' can access"

# Admin: see all policies
"Show me all the RAG access policies"

{
  "service": "rag",
  "name": "Finance KB Access",
  "isEnabled": true,
  "resources": {
    "knowledge_base": {
      "values": ["Finance KB"],
      "isRecursive": false
    }
  },
  "policyItems": [
    {
      "users": ["alice", "bob"],
      "groups": ["finance-team"],
      "accesses": [
        {"type": "read", "isAllowed": true}
      ]
    }
  ]
}