Skip to main content
Glama
Sign In
Pangolin MCP Connector

Pangolin MCP Connector

by si-essence
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

pangolin_roles

DestructiveIdempotent

Manage self-hosted Pangolin CE roles by listing, creating, updating, deleting, retrieving, and assigning user roles, with confirmation for writes and dry-run previews.

Instructions

pangolin_roles covers the roles toolset (6 operations). Auth header Authorization Bearer. Self-hosted Pangolin CE only. Writes need confirm:true and PANGOLIN_ALLOW_WRITES=true. Omit confirm for a dry-run preview. Actions: add_role: POST /role/{roleId}/add/{userId}. Legacy: set exactly one role for the user (replaces any other roles the user has in the org). create_org_role: PUT /org/{orgId}/role. Create a role. delete_role: DELETE /role/{roleId}. Delete a role. get_role: GET /role/{roleId}. Get a role. list_org_roles: GET /org/{orgId}/roles. List roles. update_role: POST /role/{roleId}. Update a role.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "action": "<action>"
    },
    "name": "pangolin_roles"
  }
}

Input Schema

NameRequiredDescriptionDefault
bodyNoJSON body for the Pangolin operation. Secrets are redacted in output.
queryNoOpenAPI query parameters.
actionYesPangolin operation to call.
paramsNoOpenAPI path parameters, such as orgId or siteId.
confirmNoSet to the boolean true to execute the write. Omit this field for a dry-run preview. false and the string true are rejected.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, readOnlyHint=false and idempotentHint=true, but the description adds real context beyond them: the Bearer auth requirement, the environment-variable write gate, the dry-run mechanism, and the critical side effect that add_role replaces any other roles the user holds in the org. It is thin on delete_role's blast radius (role definition vs. assignments) and on error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the critical gating rules (auth, write confirmation, CE-only) before the action list, then a uniform enum-by-enum format. Redundancy is minimal (e.g., 'Create a role.' restating the action name) and every other sentence carries new information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action wrapper with 5 params and no output schema, the description covers routing, auth and write safety well. The missing piece is per-action input documentation: 'body' is an unconstrained object and the description never says which fields create_org_role or update_role expect, leaving a real gap before an agent can invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, but the description goes further by binding path placeholders to specific actions ({roleId}, {userId}, {orgId}), which the generic 'params' schema description does not convey. It still does not describe the body payload shape per action, which is where agents most often fail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names the domain (roles toolset) and enumerates all six actions with explicit verb+resource plus HTTP method and path, so it is immediately distinguishable from the sibling tools (resources, sites, orgs, targets, users). An agent can map an intent to a specific action without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operating conditions: self-hosted Pangolin CE only, writes require confirm:true plus PANGOLIN_ALLOW_WRITES=true, and omitting confirm yields a dry-run preview. It also flags add_role as legacy semantics. It does not, however, state when to prefer create_org_role over add_role beyond the legacy label, nor when not to use the tool at all.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools