EXTENSIONS

Kubernetes operational toolkit — 17 model types covering pods, deployments, statefulsets, services, RBAC, storage, networking, autoscaling, batch jobs, External Secrets, and more. Includes 14 ready-to-run workflows for namespace debugging, security audits, RBAC analysis, cluster health, and operational diagnostics.

Manage the people in a Claude Enterprise organization through the Admin API

Datadog Teams — team management, memberships, and permissions

Control-plane administration of a Garage (S3-compatible object store) cluster through its Admin API v2 (bearer token). Reads cluster health, buckets, access keys, and the full key×bucket permission matrix. Creates, updates and deletes buckets; manages aliases; creates, imports, updates, rotates and deletes access keys; and grants or revokes read/write/owner permissions. Never touches S3 object data; delete and revoke methods verify the target by id first.

Non-destructive PostgreSQL administration over a direct TCP connection (node-postgres). Reads databases, roles, permissions, tables, connections, and extensions. Runs admin DDL that does not touch data: create database/role, grant/revoke, rotate passwords, and an idempotent app_provision method that combines them. Never reads or writes table rows, never runs DROP or TRUNCATE, and does not accept arbitrary SQL.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Datadog RBAC — role, permission, user, and restriction query analysis via the Datadog RBAC API (v2). Answers "who can access what data?" by resolving the full chain: user → roles → permissions + restriction queries → effective access. Supports all Datadog sites (us1, us3, us5, eu1, ap1, us1-fed).

Manage FreeIPA sudo, HBAC, RBAC, privilege, and CA-ACL policy over the JSON-RPC API: find/show read-only snapshots plus idempotent ensureSudoRule/ensureHbacRule/ensureRole/ensurePrivilege/ensureCaAcl, fan-out member/option/privilege/permission/certprofile methods, enable/disable toggles, read-only privilege/permission/CA-ACL discovery, and confirm-guarded deletes, each mutation with an audit trail.