# Aserto MCP for AI Agents AI Agent Connect

> Aserto MCP lets you manage and evaluate fine-grained access control policies using your AI client. It handles Rego queries, permission checks, and audit log retrieval so you can manage security policies through natural conversation instead of manual API calls or complex CLI commands.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_XOpJU2PJe7LAxPuGtGU6XTuW4mAiWsbg1RviddXw/ai-agent-connect
- **Tags:** authorization, rego, policy-as-code, access-control, iam

## Description

Connect your Aserto tenant to your AI agent to manage and evaluate fine-grained access control policies through natural conversation. If you're tired of digging through complex Rego files or running manual curl commands to figure out why a specific user can't access a resource, this Connector handles that for you. You can ask your agent to check specific permissions, run custom queries against your authorizer, or pull decision trees to see the exact logic behind a policy. It even lets you manage your control plane and grab audit logs for compliance checks. You'll find this in the Vinkius catalog, where it makes it easy to plug your security stack into your daily workflow. It turns complex authorization into a simple conversation, so you can spend less time on the plumbing and more time actually securing your app. Instead of switching between multiple tabs and tools, you get a direct line to your security data. This means you can move faster during development and have a clearer picture of your permissions at any given moment. Debugging a production issue or preparing for an audit both become easier because you have your authorization data ready at a moment's notice. This takes the heavy lifting out of security engineering by letting you interact with your authorization layer in plain English.

## Tools

### list_decision_logs
List available decision log storage objects. Use this to see what audit logs are available for your policies.

### authz_decisiontree
Get decision tree values across all policy modules. This is useful for seeing the exact logic path of a policy.

### authz_is
Determine if a user is authorized to perform an action. Use this to check permissions instantly.

### authz_query
Execute a general Rego query against the Authorizer. Use this to inspect policy data or evaluate complex logic.

### control_plane_exec
Send commands to a connected Edge Authorizer. This helps you sync policy instances or directories quickly.

### get_decision_log
Retrieve a signed download URL for a specific log object. Use this to grab specific audit data.

### query_decision_logs
Query the last N decisions from decision logs. This is great for a quick look at recent authorization events.

## Prompt Examples

**Prompt:** 
```
Check if user 'bob@company.com' can 'delete' 'resource_99'.
```

**Response:** 
```
I checked the policy via `authz_is`. Bob is **not** authorized. It looks like the 'delete' action requires an 'admin' role which his account doesn't have.
```

**Prompt:** 
```
List the last 5 decisions from the logs.
```

**Response:** 
```
I pulled the last 5 decisions using `query_decision_logs`:

| User | Action | Result |
| :--- | :--- | :--- |
| User A | read | Allowed |
| User B | write | Denied |
| User C | read | Allowed |
| User D | write | Allowed |
| User E | read | Denied |
```

**Prompt:** 
```
Run a query to see all active roles.
```

**Response:** 
```
Running `authz_query` now... The authorizer returned the following roles: `['super_admin', 'editor', 'viewer', 'billing_manager']`.
```

## Capabilities

### Check user permissions
Determine if a user identity is allowed to perform a specific action based on the current policy and context.

### Run custom Rego queries
Execute custom Rego queries against your authorizer to inspect policy data or evaluate complex logic.

### View decision trees
Retrieve full decision tree values across all policy modules for deep inspection or UI logic.

### Execute control plane commands
Send commands to connected Edge Authorizers to sync policy instances or directories.

### Retrieve decision logs
List and query available decision log storage objects to maintain a clear audit trail.

## Use Cases

### Debugging a 'Permission Denied' error
A developer asks the agent why a user can't access a file. The agent uses authz_is to check the policy and identifies the missing role.

### Quick security auditing
A compliance officer asks to see the last 50 decisions to verify a recent change. The agent uses query_decision_logs to pull the data.

### Syncing policies to the edge
An engineer needs to push a new policy to a specific Edge Authorizer. The agent uses control_plane_exec to sync the instance.

### Inspecting data roles
A security lead wants to see all roles defined in the current Rego data. The agent runs an authz_query to list them instantly.

## Benefits

- Skip manual API calls by using authz_is to check permissions instantly.
- Debug complex logic faster by pulling full decision trees with authz_decisiontree.
- Audit security events quickly by querying logs with query_decision_logs.
- Sync policy instances across the edge without manual configuration using control_plane_exec.
- Validate policy changes in real-time using authz_query to run custom Rego code.

## How It Works

The bottom line is you get a direct line to your Aserto policies without the manual overhead of switching tools.

1. Subscribe to the Connector and enter your Aserto Tenant ID and API URL.
2. Provide your Authorizer and Decision Logs API keys.
3. Start asking your agent to check permissions, run Rego queries, or pull logs.

## Frequently Asked Questions

**What is the Aserto MCP for?**
The Aserto MCP lets you manage and evaluate fine-grained access control policies using natural language. You can check permissions, run Rego queries, and audit logs through your AI agent.

**Can I use Aserto MCP to check if a user has permission?**
Yes, you can ask your agent to check if a specific user is authorized to perform an action. It will evaluate the current policy and give you a direct answer.

**Does the Aserto MCP support Rego queries?**
Yes, it allows you to execute custom Rego queries against your authorizer. This is great for inspecting policy data or testing complex logic.

**How do I audit my authorization decisions with Aserto MCP?**
You can ask your agent to list or query your decision logs. It will pull the recent events so you can see who was allowed or denied access.

**Is Aserto MCP good for security engineers?**
It's perfect for security engineers because it removes the need for manual API calls. You can verify policy changes and audit logs much faster.

**Can I use Aserto MCP to manage my control plane?**
Yes, it can send commands to your connected Edge Authorizers. This makes it easy to sync policy instances or directories via your AI agent.

**How do I verify a specific permission for a user?**
Use the `authz_is` tool. You need to provide the identity context (user), the policy context (the path to the rule), and any relevant resource context to get a boolean decision.

**Can I execute complex Rego logic through the agent?**
Yes! The `authz_query` tool allows you to run any valid Rego query against your authorizer, enabling you to inspect data or evaluate custom logic on the fly.

**Is it possible to trigger a policy sync on an Edge Authorizer?**
Yes. Use the `control_plane_exec` tool with the instance ID and the appropriate command (e.g., `{"discovery": {}}`) to manage your connected authorizers.