Operator CLI and MCP server suite for the CDP Agent Gateway blueprint, providing read-only and write access to Hive, Impala, and Spark via Knox authentication
Strong foundation with 13 well-defined tools across Hive, Impala, and Spark. All tools have clear, action-verb names (list_, describe_, select, submit_) and detailed descriptions (100-200 chars) that explain WHAT, WHEN, and constraints. Input schemas are complete with proper JSON Schema types, minLength/maxLength constraints, and required field declarations. Risk annotations (READ_ONLY, WRITE) are explicit. However, parameter descriptions are absent from schemas, LLMs see only type info, not semantic meaning. Output schemas are undocumented. Error handling guidance is minimal. Security considerations (Knox token, Ranger authorization) are mentioned in descriptions but not formalized as permission gates or scope declarations.
Describe columns on one Hive table. Read-only. No DDL.
List Hive databases Ranger allows for the Knox token subject. Read-only. /cdp/hive stays unpublished.
List tables in one Hive database for the Knox token subject. Read-only.
SELECT named columns from one Hive table as the Knox token subject. columns is required (no SELECT *). limit max 50. No WHERE, no DDL/DML.
Describe columns on one Impala table. Read-only. No DDL.
List Impala databases Ranger allows for the Knox token subject. Read-only. /cdp/impala stays unpublished.
Parameter descriptions missing from JSON Schema. LLMs see only type constraints (minLength, maxLength, minimum, maximum) but no semantic guidance on what 'database', 'table', 'columns', 'batch_id', or 'file' mean in context.
Output schemas undocumented. Tools return results but LLMs have no formal specification of response structure, field types, or pagination. E.g., hive_select returns rows but response format is opaque.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
List tables in one Impala database for the Knox token subject. Read-only.
SELECT named columns from one Impala table as the Knox token subject. columns is required (no SELECT *). limit max 50. No WHERE, no DDL/DML.
Get one Livy Spark 3 batch by numeric id (state, appId). Read-only.
Get truncated Livy Spark 3 batch logs (last lines, size-capped). Read-only. Do not expect a full executor dump.
List Livy for Spark 3 batch jobs for the Knox token subject. Read-only. Use spark_get_batch to poll a single id.
List Livy for Spark 3 interactive sessions for the Knox token subject. Read-only. Poll this instead of assuming sessions exist.
Submit a Livy Spark 3 batch as the Knox token subject (a write). Ranger authorizes that subject. file must be hdfs://, s3a://, abfs://, or o3fs:// (a jar or script Ranger allows). No inline code, no proxyUser. Poll with spark_get_batch.
Error handling guidance absent. Descriptions mention constraints (e.g., 'limit max 50', 'no WHERE') but do not explain what error the LLM receives if violated, or how to recover. No actionable error messages documented.
Security scopes not formalized. Descriptions reference Knox tokens and Ranger authorization but do not declare required permissions (e.g., 'read:hive', 'write:spark'). No permission-gate pattern visible in tool definitions.
Pagination not implemented for list tools. hive_list_databases, hive_list_tables, spark_list_sessions, spark_list_batches accept no limit/offset/cursor parameters. Large result sets will blow context windows.