ranger-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| KNOX_TOKEN | No | Knox JWT token | |
| KNOX_COOKIE | No | Knox cookie | |
| RANGER_PASS | No | Password for basic auth | |
| RANGER_USER | No | Username for basic auth | |
| RANGER_VERIFY_SSL | No | Whether to verify SSL certificates | true |
| RANGER_GATEWAY_URL | Yes | Full Knox Ranger API base URL (ends with /ranger/service) | |
| HTTP_TIMEOUT_SECONDS | No | HTTP request timeout in seconds | 30 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_ranger_servicesC | List Ranger service instances (cm_hive, cm_hdfs, cm_tag, etc.). |
| get_ranger_serviceB | Get a Ranger service instance by name. |
| get_ranger_service_definitionA | Get the service definition schema (access types, resources, mask types) for a component type. |
| search_ranger_policiesC | Search Ranger policies. policy_type: 0=access, 1=masking, 2=row-filter. |
| get_ranger_policyA | Get a policy by id or by service_name + policy_name. |
| create_ranger_policyC | Create a Ranger policy from a full JSON payload. WRITE OPERATION |
| update_ranger_policyC | Update an existing Ranger policy by id. WRITE OPERATION |
| apply_ranger_policyC | Create or update a policy via the apply/upsert endpoint. WRITE OPERATION |
| delete_ranger_policyC | Delete a policy by id or by service_name + policy_name. WRITE OPERATION |
| create_access_policyC | Create an access-control policy. WRITE OPERATION Provide resources via resources_json or simple fields (database, table, column, path). users/groups/roles/accesses are comma-separated. |
| create_masking_policyB | Create a data-masking policy (policyType=1). WRITE OPERATION data_mask_type examples: MASK, MASK_SHOW_LAST_4, MASK_HASH, MASK_NULL, CUSTOM. |
| create_tag_based_policyB | Create a tag-based access policy on the tag service (e.g. cm_tag). WRITE OPERATION access_type is prefixed by target service, e.g. hive:select or hdfs:read. |
| list_ranger_rolesC | List Ranger policy-engine roles. |
| get_ranger_roleB | Get a role by id or name. |
| create_ranger_roleC | Create a Ranger role with optional members. WRITE OPERATION |
| update_ranger_roleC | Update a Ranger role from JSON. WRITE OPERATION |
| delete_ranger_roleC | Delete a Ranger role by id. WRITE OPERATION |
| add_users_groups_to_roleC | Add users and/or groups to an existing role. WRITE OPERATION |
| get_roles_for_userC | List roles assigned to a user. |
| list_ranger_usersC | List Ranger users. |
| get_ranger_userB | Get a Ranger user by name. |
| create_ranger_userB | Create a Ranger user. WRITE OPERATION user_roles: ROLE_USER or ROLE_SYS_ADMIN. group_ids: comma-separated numeric ids. |
| update_ranger_userC | Update a Ranger user from JSON. WRITE OPERATION |
| delete_ranger_userB | Delete a Ranger user by id. WRITE OPERATION |
| list_ranger_groupsC | List Ranger groups. |
| get_ranger_groupB | Get a Ranger group by name. |
| create_ranger_groupC | Create a Ranger group. WRITE OPERATION |
| update_ranger_groupC | Update a Ranger group from JSON. WRITE OPERATION |
| delete_ranger_groupB | Delete a Ranger group by id. WRITE OPERATION |
| lookup_ranger_usersC | Search Ranger users by partial name. |
| lookup_ranger_groupsB | Search Ranger groups by partial name. |
| list_tag_definitionsB | List Ranger tag type definitions. |
| get_tag_definitionB | Get a tag definition by name. |
| list_tag_instancesC | List tag instances in Ranger. |
| list_tagged_resourcesC | List resources that have tags applied. |
| search_tag_based_policiesC | Search tag-based policies on the tag service (e.g. cm_tag). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 36 tools
Most tools have distinct purposes (CRUD for users, groups, roles, policies, services, tags). However, there is overlap between create_access_policy, create_ranger_policy, and apply_ranger_policy, which could confuse an agent selecting the right one for a given task.
Majority follow verb_noun pattern (create_ranger_user, get_ranger_group, list_ranger_users), but there are deviations like add_users_groups_to_role, apply_ranger_policy, lookup_ranger_groups, and mixing list/search/lookup for similar operations reduces consistency.
36 tools is high but covers multiple resource types (users, groups, roles, policies, services, tags). Some tools could be merged (e.g., list/search variants) to reduce count. Not extreme, but borderline heavy for typical agent interactions.
Covers CRUD for users, groups, roles, and access/masking policies. Missing create/update/delete for tag definitions and tag-based resources, and row-filter policy lifecycle (only searchable). Gaps will require workarounds.