DEV-215183 - Add Collibra Data Access MCP tools

.github/workflows/build.yaml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.6'
 
       - name: Install dependencies
         run: go mod download
@@ -40,7 +40,7 @@ jobs:
       - name: Lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9  # v8
         with:
-          version: v2.4.0
+          version: v2.12.2
 
   # Every green build of main is tagged with the next patch version.
   # The release workflow then publishes a chosen tag on demand.

.github/workflows/release.yaml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.6'
 
       - name: Install dependencies
         run: go mod download

README.md

@@ -10,12 +10,15 @@ This Go-based MCP server acts as a bridge between AI applications and Collibra,
 
 ### Read Tools
 
+- [`check_user_data_object_access`](pkg/tools/check_user_data_object_access/) - Check whether a user has access to one or more data objects (by ID) and through which roles (access controls). Defaults to the current user **Requires:** `dgc.data-access-view-all-access-and-usage` **Experimental** (`data-access` feature flag)
 - [`discover_business_glossary`](pkg/tools/discover_business_glossary/) - Ask questions about terms and definitions. Note that this tool leverages Collibra AI and therefore consumes Collibra Units (CUs). **Requires:** `dgc.ai-copilot`
 - [`discover_data_assets`](pkg/tools/discover_data_assets/) - Query available data assets using natural language. Note that this tool leverages Collibra AI and therefore consumes Collibra Units (CUs). **Requires:** `dgc.ai-copilot`
 - [`get_assessment`](pkg/tools/get_assessment/) - Retrieve conducted assessment(s) from the Assessments application (these are not catalog assets). Direct lookup of a single assessment by name or UUID (or by its linked Assessment Review asset), or a filtered lookup combining name (partial), status, template, conducted asset, and a last-modified range (paginated)
 - [`get_asset_details`](pkg/tools/get_asset_details/) - Retrieve detailed information about specific assets by UUID, including the asset's assignable attribute schema (every attribute it can hold, including empty ones)
 - [`get_business_term_data`](pkg/tools/get_business_term_data/) - Trace a business term back to its connected physical data assets
 - [`get_column_semantics`](pkg/tools/get_column_semantics/) - Retrieve data attributes, measures, and business assets connected to a column
+- [`get_data_access_control_details`](pkg/tools/get_data_access_control_details/) - Retrieve detailed information about a specific Collibra Data Access control by its id **Requires:** `dgc.data-access-view-all-access-and-usage` **Experimental** (`data-access` feature flag)
+- [`get_data_access_data_source`](pkg/tools/get_data_access_data_source/) - Fetch a Collibra Data Access data source by ID, resolving an opaque data source ID to its name, type, and description **Requires:** `dgc.data-access-view-all-access-and-usage` **Experimental** (`data-access` feature flag)
 - [`get_data_quality_rule`](pkg/tools/get_dq_rule/) - Read the definition of a single DQ rule (monitor) on a job — its type, SQL, filter, tolerance and active/suppressed state
 - [`get_data_quality_rule_results`](pkg/tools/get_dq_rule_results/) - Read a rule's per-run results after a job run — score, breaking/passing record counts, pass/fail status and any exception. Paginated (`offset`/`limit`), newest first by default
 - [`validate_data_quality_rule`](pkg/tools/validate_dq_rule/) - Validate a rule's SQL/definition against the source before saving or running it, so a malformed rule is caught up front. Returns whether the rule is valid plus the engine's message. Requires `edgeSiteId`/`connectionId`/`schemaName` (from `prepare_create_data_quality_job`)
@@ -35,6 +38,8 @@ This Go-based MCP server acts as a bridge between AI applications and Collibra,
 - [`pull_data_contract_manifest`](pkg/tools/pull_data_contract_manifest/) - Download manifest for a data contract
 - [`search_asset_keyword`](pkg/tools/search_asset_keyword/) - Wildcard keyword search for assets; filters (status, community, domain, domain type, asset type, created-by) accept names or UUIDs
 - [`search_catalog_columns`](pkg/tools/search_catalog_columns/) - Find catalog Column assets by metadata that keyword search can't filter on — Description/Data Type (attribute values), a Data Steward role, or relations to a Business Term/Business Rule/Data Element/Data Attribute (by name); AND-combined. Uses the DGC Knowledge Graph GraphQL API (must be enabled on the instance). Classification-tag filtering is not supported
+- [`search_data_access_identities`](pkg/tools/search_data_access_identities/) - Search for Data Access users (identities) by name and/or email. At least one of the two is required — an unfiltered call returns `validation_error` **Requires:** `dgc.data-access-view-all-access-and-usage` **Experimental** (`data-access` feature flag)
+- [`search_data_access_objects`](pkg/tools/search_data_access_objects/) - Search for data objects in Collibra Data Access (tables, columns, schemas, views, and other entities tracked in registered data sources). At least one of `name`, `dataSources`, `types`, `parents` or `ancestors` is required — an unfiltered call returns `validation_error` **Requires:** `dgc.data-access-view-all-access-and-usage` **Experimental** (`data-access` feature flag)
 - [`search_data_class`](pkg/tools/search_data_classes/) - Search for data classes with filters. **Requires:** `dgc.data-classes-read`
 - [`search_data_classification_match`](pkg/tools/search_data_classification_matches/) - Search for associations between data classes and assets. **Requires:** `dgc.classify`, `dgc.catalog`
 - [`search_lineage_entities`](pkg/tools/search_lineage_entities/) - Search for entities in the technical lineage graph
@@ -45,6 +50,7 @@ This Go-based MCP server acts as a bridge between AI applications and Collibra,
 - [`add_data_classification_match`](pkg/tools/add_data_classification_match/) - Associate a data class with an asset. **Requires:** `dgc.classify`, `dgc.catalog`
 - [`create_assessment`](pkg/tools/create_assessment/) - Conduct a new assessment from a template (given by name or UUID) in the Assessments application. Returns the template's (unanswered) questions to fill in afterward with `edit_assessment` — no separate prepare step needed
 - [`create_asset`](pkg/tools/create_asset/) - Create a new asset of any type. Resolves `assetType` (UUID, publicId, or display name), `domain` (UUID or name), `status` (UUID or name), and attributes (by name or typeId) server-side; converts Markdown to HTML for `RICH_TEXT` attributes; gates on duplicate-name (default `allowDuplicate: false`)
+- [`create_asset_access_request`](pkg/tools/create_asset_access_request/) - Create a Collibra Data Access request on an asset (`assetId`). The WHAT of the request is the Data Access role linked to that asset, resolved by the tool — never pass a role or a data object yourself. Which assets carry a role is instance configuration, so the roles linked to the asset are read rather than inferred from its asset type; an asset with no active Grant returns status `no_role_linked` with whatever is linked in `linkedRoles`, and nothing is created. Beneficiaries are Collibra users (`users` — email addresses or usernames, mapped to Data Access users by email) and/or groups (`groups` — group names or UUIDs, mapped to Data Access groups by name); at least one is required, both can be combined, and nothing is created unless every entry maps — failures come back in `unresolvedUsers`/`unresolvedGroups`, including a group name that matches several Data Access groups. `purpose` is mandatory and must come from the user: it is used verbatim as the request's description with a note appended stating it was created by AI. `expiresAt` is mandatory — a plain date (`2026-12-31`) is taken as the end of that day UTC, an RFC 3339 timestamp is used as given. `name` is optional — pass it only when the user supplied one, and otherwise omit it so Data Access generates a unique name itself; a name that is already taken comes back as status `name_conflict` with nothing created. Built around a confirm checkpoint: `confirm=false` (the default) resolves everything and returns status `preview` with the asset, role, mapped beneficiaries, description and expiration date, creating nothing — review it with the user and call again with `confirm=true`. On `created` the response carries the asset, the role it was requested through, the mapped users and groups, the expiration date, and a link to the request in Collibra **Requires:** `dgc.data-access-view-all-access-and-usage`, `dgc.data-access-create-access-controls` **Experimental** (`data-access` feature flag)
 - [`create_data_quality_rule`](pkg/tools/create_dq_rule/) - Create a data quality rule (monitor) on an existing DQ job. `monitorType` is `FREEFORM_SQL` (full SQL query) or `SIMPLE_SQL` (single-column check); defaults to active and not suppressed. Confirm checkpoint: `confirm=false` (default) returns a preview of the rule + SQL without creating; `confirm=true` creates. Uses the DQ monitoring API and requires permission to create rules on the target job. **Experimental** (`data-quality` feature flag)
 - [`deploy_data_quality_rule_template`](pkg/tools/deploy_dq_rule_template/) - Instantiate a rule template as concrete rules across one or more job/column targets (bulk). The DQ service resolves dialect-specific SQL and names each rule `{templateName}_{columnName}`. Confirm checkpoint: `confirm=false` (default) previews the template + targets without deploying; `confirm=true` deploys. Requires permission to deploy templates and create rules on the target jobs. **Experimental** (`data-quality` feature flag)
 - [`dq_cancel_job_run`](pkg/tools/cancel_dq_job_run/) - Cancel an IN-PROGRESS Collibra data-quality job run. Supply EITHER `jobRunId` OR `jobName` (not both). By `jobRunId`: looks up the run's state and refuses with a clear message if it is already in a terminal state (finished/failed/cancelled). By `jobName`: finds the job's cancellable (non-terminal) runs — if exactly one, cancels it; if several, returns them as candidates (`needs_input`) so you can pick one and re-call with its `jobRunId`. No confirm checkpoint — the terminal-state pre-check (by ID) and non-terminal search filter (by name) are the safety mechanism. Cancellation is irreversible and immediately queued on success. **Experimental** (`data-quality` feature flag)
@@ -238,6 +244,8 @@ Some functionality ships behind an opt-in `experimental` flag. These features ar
 
 - `context-specifications` — Context specification tools: `list_context_specifications`, `get_context_specification`, and the `contextSpecificationId` parameter on `get_asset_details`. These tools generate structured YAML context for assets using the Semantic Blueprint API.
 
+- `data-access` — Collibra Data Access tools: `search_data_access_identities`, `search_data_access_objects`, `check_user_data_object_access`, `get_data_access_data_source`, `get_data_access_control_details`, and `create_asset_access_request`. The last one WRITES to Data Access (behind a confirm checkpoint), so the whole set stays opt-in until it graduates.
+
 - `skills` — Embedded skill catalog served via two additional tools, `list_collibra_skills` and `load_collibra_skill`. Skills are short Markdown guides that document multi-step Collibra workflows (discovery, lineage, asset create/edit, …) for the connecting LLM. See [SKILLS.md](SKILLS.md) for the catalog.
 
   Point chip at an **external skills directory** with `--skills-dir=<path>` (or `COLLIBRA_MCP_SKILLS_DIR`, or `mcp.skills-dir` in YAML) to add your own skills on top of the embedded ones. The expected layout is `<dir>/<namespace>/<name>/SKILL.md` (with optional `references/*.md` and `_shared/*.md` siblings) — same as the bundled catalog. External skills whose name matches an embedded skill (e.g. `collibra/lineage`) **fully replace** the embedded entry, including its resources, so you can override the shipped guides without rebuilding chip. `~` and `~user` in the path are expanded.

SKILLS.md

@@ -10,13 +10,14 @@ those tools. Skill content lives in [`pkg/skills/files/collibra/`](pkg/skills/fi
 
 ## Current skills
 
-| Name | Topic |
-|---|---|
-| `collibra/index` | Navigator — start here when unsure which skill applies |
-| `collibra/discovery` | Semantic vs keyword search; resolving names to UUIDs |
-| `collibra/lineage` | Technical lineage; DGC UUID ↔ lineage entity ID bridge; column-level workaround |
+| Name                    | Topic |
+|-------------------------|---|
+| `collibra/index`        | Navigator — start here when unsure which skill applies |
+| `collibra/discovery`    | Semantic vs keyword search; resolving names to UUIDs |
+| `collibra/lineage`      | Technical lineage; DGC UUID ↔ lineage entity ID bridge; column-level workaround |
 | `collibra/asset-create` | `create_asset` workflow; RICH_TEXT Markdown handling; duplicate gating |
-| `collibra/asset-edit` | `edit_asset` operation types |
+| `collibra/asset-edit`   | `edit_asset` operation types |
+| `collibra/data-access`  | Manages who can access what data, through grants, masks and filters |
 
 Each skill is one `SKILL.md` per directory, with frontmatter (`description`, `related`) and an
 optional `references/` directory for bundled reference documents.

cmd/chip/experimental.go

@@ -19,6 +19,7 @@ import (
 var knownExperimentalFeatures = map[string]string{
 	skills.FeatureName:                 "Embedded skill catalog served via list_collibra_skills and load_collibra_skill.",
 	tools.ContextSpecificationsFeature: "Context specification tools: list_context_specifications, get_context_specification, and contextSpecificationId parameter on get_asset_details.",
+	tools.DataAccessFeatureName:        "Collibra Data Access tools: search Data Access users and groups (search_data_access_identities) and data objects (search_data_access_objects); check what a user can do on a data object and through which access controls (check_user_data_object_access); resolve a data source (get_data_access_data_source) or a single access control with its owners and who/what scope (get_data_access_control_details); and raise an access request on a catalog asset through the role linked to it (create_asset_access_request, which WRITES behind a confirm checkpoint).",
 	tools.DataQualityFeatureName:       "Data quality tools: create data quality jobs (create_data_quality_job: discovery + preview + create in one); read a job's full definition (dq_get_job) or a run's full details and per-monitor results (dq_get_job_run); cancel an in-progress job run (dq_cancel_job_run); delete a completed job run and its results (dq_delete_job_run); delete a job definition and everything attached to it (dq_delete_job); partially update an existing job's configuration — schedule, monitors, notifications, scan SQL, compute/sizing and data location (dq_update_job); create, validate, read and search rules; per-run rule results; rule templates (list, read, deploy); plain-language (Text2SQL) rule generation; and catalog column search.",
 }
 

cmd/chip/main.go

@@ -34,8 +34,8 @@ func main() {
 		EnabledTools:     config.Mcp.EnabledTools,
 		DisabledTools:    config.Mcp.DisabledTools,
 		EnableDebugTools: config.Mcp.EnableDebugTools,
-		Experimental:  config.Mcp.Experimental,
-		SkillsDir:     config.Mcp.SkillsDir,
+		Experimental:     config.Mcp.Experimental,
+		SkillsDir:        config.Mcp.SkillsDir,
 	}
 
 	serverOpts := []chip.ServerOption{

go.mod

@@ -1,8 +1,9 @@
 module github.com/collibra/chip
 
-go 1.25.0
+go 1.26.6
 
 require (
+	github.com/collibra/data-access-go-sdk v0.0.73
 	github.com/google/go-querystring v1.2.0
 	github.com/google/jsonschema-go v0.4.3
 	github.com/google/uuid v1.6.0
@@ -13,8 +14,12 @@ require (
 )
 
 require (
+	github.com/Khan/genqlient v0.8.2-0.20260808220311-f53a04c8e9d2 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
@@ -23,12 +28,13 @@ require (
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.36 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )