Couchbase RBAC via cb-analytics-mcp

You have 9 RBAC tools: list/get/upsert/delete user, list/upsert/delete group, list roles, and check permissions.

The two domains

Couchbase users live in one of two domains:

• local — created and managed inside Couchbase itself.
• external — authenticated via LDAP / SAML / PAM, mirrored locally with role bindings.

Every user-related tool takes a domain argument. If you list users without a domain you get both.

Role-spec format