# Cerbos MCP for AI Agents AI Agent Connect

> Cerbos (Access Control) MCP lets you manage your RBAC and ABAC policies directly through your AI agent. You can check permissions, audit logs, and plan database filters without digging into your code or running manual API requests. It connects your Cerbos instance to your AI client so you can handle authorization logic in plain English.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_InOwgNCcuNoJDDtlbw3Rpbk72NQ9Y39enLJWWQOg/ai-agent-connect
- **Tags:** authorization, rbac, abac, policy-as-code, access-control

## Description

This Connector connects your Cerbos instance to your AI agent so you can manage authorization and audit access control through natural language. Instead of digging through complex JSON files or running manual API requests, you can just ask your agent to verify if a specific user has the rights to perform an action on a resource. It makes the process of managing RBAC and ABAC policies much faster by letting you list, add, or update rules directly from your chat interface. When you're looking for a way to simplify your security workflow, finding this in the Vinkius catalog gives you a way to interact with your policy decision point as if you were talking to a teammate. You can quickly spot out-of-scope permissions, review audit logs for compliance, and even generate database query plans to see how your auth logic will affect your data filters. It moves the heavy lifting of security management into a conversational space where you can get answers in seconds. Whether you're trying to debug a denied request or need to see the full scope of your current permissions, this connector provides a direct line to your security logic. It removes the friction of navigating complex schemas and lets you focus on the actual security requirements of your application.

## Tools

### get_health
Check the current status of your Cerbos instance. Use this to ensure your policy decision point is online and ready.

### get_metrics
Pull Prometheus metrics from your Cerbos setup. This is perfect for monitoring performance and request volume.

### get_policy
Fetch the details of a specific policy using its ID. This lets you inspect the logic of a single authorization rule.

### get_schema
Get a specific schema by ID

### add_policy
Create a new policy within your Cerbos instance. Use this to define new permissions for users or resources.

### get_authzen_config
Retrieve the configuration metadata for your AuthZEN setup. This helps you verify the underlying configuration details.

### add_schema
Create or update a resource schema in your system. This defines the structure of the objects your policies protect.

### authzen_evaluation
Perform a single access evaluation using the AuthZEN framework. This is used for specific, single-point permission checks.

### authzen_evaluations
Run a batch of AuthZEN access evaluations at once. This is useful for testing multiple permissions in a single request.

### check_resources
Evaluate if a specific principal has the rights to perform actions on a set of resources. This helps you quickly verify permissions during a security review.

### delete_policy
Remove a specific policy from your system by its unique ID. Use this to clean up old or deprecated authorization rules.

### disable_policy
Turn off a policy without deleting it from the system. This is useful for temporary maintenance or troubleshooting.

### enable_policy
Reactivate a disabled policy to restore its effect on the system. You can quickly toggle permissions on or off as needed.

### get_server_info
Retrieve the version and build information for your Cerbos instance. Use this to verify that you are running the correct software version.

### list_audit_logs
View a list of recent access logs from your system. This is your primary way to check who did what and when.

### list_policies
Get a full list of all active policies in your Cerbos instance. Use this to see the entire scope of your authorization rules.

### list_schemas
List all resource schemas currently defined in your system. This helps you understand the structure of your authorized resources.

### plan_resources
Generate an AST query plan for filtering resources based on auth logic. This allows you to see how your database queries will be modified by security rules.

### update_policy
Modify an existing policy to change its permissions or scope. This lets you make surgical changes to your authorization logic.

## Prompt Examples

**Prompt:** 
```
Can user 'admin_01' delete the record 'doc_99'?
```

**Response:** 
```
I've checked the permissions for you.

**Permission Result:** ALLOWED
- **Principal:** `admin_01`
- **Action:** `delete`
- **Resource:** `doc_99`
- **Policy Applied:** `resource.document.v1`

The user has the necessary rights based on the current RBAC configuration.
```

**Prompt:** 
```
Show me the health of our Cerbos instance and the last 5 audit logs.
```

**Response:** 
```
The system is currently healthy.

**Status:** READY
**Version:** v0.34.0

**Recent Audit Logs:**
| Timestamp | User | Action | Status |
| :--- | :--- | :--- | :--- |
| 10:05:01 | user_42 | read_doc | ALLOWED |
| 10:06:12 | user_99 | delete_doc | DENIED |
| 10:07:45 | admin_01 | list_docs | ALLOWED |
| 10:08:20 | user_12 | update_doc | ALLOWED |
| 10:09:01 | user_42 | delete_doc | DENIED |
```

**Prompt:** 
```
List all policies related to 'expense' resources.
```

**Response:** 
```
I found the following policies related to expenses:

- **resource.expense.v1**: Handles authorization for expense reports.
- **resource.expense.v2**: Handles authorization for historical expense data.

There are 2 active policies for this resource type.
```

## Capabilities

### Verify user permissions
Check if a specific principal has the rights to perform actions on resources.

### Generate query plans
Get AST query plans to filter database results based on your authorization logic.

### Manage RBAC and ABAC policies
Add, list, and update your authorization rules using natural language.

### Review security audit logs
View access logs to ensure your system meets your organizational security standards.

### Monitor system health
Check the status and Prometheus metrics of your policy decision point.

## Use Cases

### Auditing for Compliance
A security engineer needs to prove that only admins can delete records. They ask the agent to list all policies and check the logic for the delete action.

### Development Testing
A backend dev wants to know if a user can view a specific record. They use `check_resources` to verify the result before writing the frontend code.

### Performance Monitoring
An ops lead wants to see the request volume. They ask the agent to pull the latest Prometheus metrics using `get_metrics`.

### Rapid Policy Deployment
A developer needs to add a new resource type. They use `add_schema` and `add_policy` to get the new permissions live in seconds.

## Benefits

- Stop manual API calls: Use `list_policies` and `add_policy` to manage your security rules in plain English instead of writing manual requests.
- Faster security audits: Quickly review your `list_audit_logs` to find unauthorized access attempts or verify permission logic.
- Accurate query planning: Use `plan_resources` to see exactly how your database filters will change based on complex auth rules.
- Instant health monitoring: Check your `get_health` and `get_metrics` data directly in your chat to ensure your system is running correctly.
- Easier schema management: Use `list_schemas` and `add_schema` to keep your resource definitions organized without leaving your AI client.

## How It Works

The bottom line is you get a conversational interface for managing complex authorization without touching your source code.

1. Subscribe to the Cerbos MCP and provide your PDP URL and admin credentials.
2. Connect your preferred AI client to the Vinkius-hosted MCP.
3. Ask your agent to check permissions, list policies, or audit logs in plain English.

## Frequently Asked Questions

**What does the Cerbos MCP do for my security?**
It gives you a conversational interface to manage your RBAC and ABAC policies. You can check permissions, audit logs, and manage your security rules in plain English.

**Can I use Cerbos MCP to check permissions for my users?**
Yes, you can ask your agent to verify if a specific user has the rights to perform actions on certain resources, and it will check your Cerbos instance for the answer.

**How does Cerbos MCP help with database queries?**
It can generate AST query plans. This shows you exactly how your database filters will be modified by your authorization logic before you run the query.

**Can I manage my RBAC policies with Cerbos MCP?**
Yes, you can list, add, update, and disable policies directly through your AI client without needing to manually edit JSON files or use a dashboard.

**Does Cerbos MCP support audit logs?**
Yes, you can retrieve and review your access logs in plain English to see who accessed what resources and whether those actions were allowed.

**Can I see the health of my Cerbos instance?**
Yes, you can ask your agent to check the health status and Prometheus metrics of your Cerbos instance to ensure everything is running correctly.

**How do I set up Cerbos MCP for my team?**
Once you subscribe to the Connector on Vinkius, you just need to provide your Cerbos PDP URL and any necessary admin credentials to connect it to your AI client.

**Can I test if a specific user has access to a resource without writing code?**
Yes. You can ask the agent to use the `check_resources` tool by providing the principal (user) details and the resource you want to check. The agent will return the allowed or denied status based on your Cerbos policies.

**How do I view all the authorization policies currently loaded in my Cerbos server?**
Simply ask the agent to 'list all policies'. It will invoke the `list_policies` tool (requires Admin credentials) and display the IDs of all active policies in your environment.

**Can the AI help me generate filters for my database based on permissions?**
Yes, by using the `plan_resources` tool. The agent will generate a query plan (AST) that describes the conditions under which a user is allowed to access resources, which you can then apply to your database queries.