Calling a domain with an empty argument returns the children your route and privileges authorize together with their schemas, so an agent plans against what is callable rather than against a catalog it might not be allowed to touch. That also keeps nine tool definitions in context instead of the full expansion. The built-in surface is read-only throughout — the admin domain is reserved and never registered — so the Doris account you connect as is the whole of the access decision.
The Apache Doris project's own MCP server. Tools are grouped into domains you call empty to discover which children your route and privileges actually authorize, then call again naming one child and its arguments — so the surface stays small and Doris RBAC remains the final authority over what comes back.
- doris_catalog — metadata navigation: catalogs, databases, tables, columns and their definitions
- doris_query — read-only querying and query diagnostics, including explain and profile work
- doris_cluster — runtime and resource state: nodes, workload groups, and what the cluster is currently doing
- doris_pipeline — ingestion and freshness, for answering whether the data you are about to query has actually landed
- doris_search — text, vector and hybrid retrieval against Doris's own indexes
- doris_governance — quality, lineage, audit and access, for questions about where a table came from and who touched it
- doris_lakehouse — external catalogs and semi-structured data, so a query can reach outside Doris's own storage
- doris_semantic — optional semantic consumers, registered only when you enable them
- An admin domain that is reserved and never registered, which is what makes the built-in surface read-only throughout
Python 3.12 or later, and network access to a supported Doris FE — DORIS_HOST and DORIS_PORT for the MySQL endpoint, DORIS_USER and DORIS_PASSWORD, DORIS_DATABASE for the default, and DORIS_FE_HTTP_HOSTS for the tools that use the HTTP interface. Install with pip and run doris-mcp-server over stdio or Streamable HTTP; non-loopback HTTP requires authentication. One stdio gotcha the docs call out: nothing else may write to stdout, because that is where the MCP frames go. The Doris user you connect as decides what any tool can see.