# Cerbos MCP for AI Agents AI Agent Connect

> Cerbos MCP lets you manage complex authorization policies and permission checks through your AI client. It handles RBAC and ABAC logic, evaluates resource access, and generates database query plans based on your specific security rules. Instead of digging through config files or running manual CLI commands, you can ask your agent to verify permissions or audit your policy setup in plain English.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_y0c5dNo7ENj8oh5gsdkYK0hZAMSRgY44sro1JyED/ai-agent-connect
- **Tags:** authorization, rbac, abac, policy-engine, access-control

## Description

Imagine you're trying to figure out why a specific user can't access a resource, or you need to know exactly what filters to apply to a database query to keep things secure. Usually, this means digging through nested configuration files or running a series of manual commands just to get a straight answer. With this Connector, you can just ask your AI client. You can have it check if a specific role has the right permissions for a set of resources or ask it to build a query plan that automatically handles the security logic for you. It takes the guesswork out of complex authorization. Whether you're debugging a tricky policy or auditing your security posture, you can get instant feedback on how your rules actually behave. It's one of the many ways the Vinkius catalog helps bridge the gap between your security infrastructure and your daily development workflow. You get to stop worrying about the mechanics of permission evaluation and start focusing on the security of your application.

## Tools

### get_server_info
Get the current version and build details of your Cerbos instance. This is useful for verifying your current deployment status.

### get_authzen_config
Retrieve the endpoint URLs for your AuthZEN APIs. This helps you quickly grab the configuration needed for your integration.

### authzen_evaluation
Perform a single action evaluation using the AuthZEN entity model. Use this for one-off permission checks.

### authzen_evaluations
Batch evaluate multiple access requests using AuthZEN semantics like deny_on_first_deny. This helps you check many permissions at once.

### check_resources
Verify if a specific principal has permission to perform actions on a set of resources. Use this for quick, read-only permission checks.

### plan_resources
Create an AST-based query plan to filter database results according to user permissions. This tells you exactly what filters to apply in your code.

## Prompt Examples

**Prompt:** 
```
Can a user with the 'manager' role see the 'finance' folder?
```

**Response:** 
```
I've checked the permissions for the 'manager' role. 

| Resource | Action | Result |
| :--- | :--- | :--- |
| finance_folder | view | **ALLOWED** |
| finance_folder | edit | **DENIED** |

Based on your current policies, managers have read-only access to finance materials.
```

**Prompt:** 
```
What filters do I need to add to my SQL query to show only the documents a user can edit?
```

**Response:** 
```
To ensure the user only sees documents they can edit, you should apply the following filters to your query:

- **Attribute Filter**: `owner_id` must match `principal.id`
- **Status Filter**: `is_locked` must be `false`
- **Role Check**: `required_role` must be in `principal.roles`

I've generated this plan based on your current edit permissions.
```

**Prompt:** 
```
Show me the version of my Cerbos instance and the AuthZEN URLs.
```

**Response:** 
```
Here are the details for your Cerbos instance:

- **Version**: 0.34.0
- **Build Date**: 2024-01-15
- **AuthZEN Endpoints**:
  - Evaluation: `https://authzen.internal/eval`
  - Config: `https://authzen.internal/config`
```

## Capabilities

### Verify resource permissions
Check if a user can perform specific actions on resources instantly.

### Generate database query plans
Get the exact filters needed to fetch data based on user permissions.

### Batch evaluate access requests
Process multiple permission checks at once using AuthZEN semantics.

### Audit security configurations
View your instance's build details and AuthZEN endpoint configurations.

### Test policy logic
Run real-time evaluations to see if your rules behave as expected.

## Use Cases

### Debugging a Permission Denied error
A developer asks the agent to check why a specific user can't edit a document using check_resources.

### Building a secure admin dashboard
A developer uses plan_resources to see which filters to apply to a list of users to keep it secure.

### Security auditing
An auditor asks the agent to evaluate a batch of requests to find potential security gaps using authzen_evaluations.

### Infrastructure health check
A DevOps engineer asks for the current build details to verify a successful deployment using get_server_info.

## Benefits

- Stop guessing how policies behave by using check_resources to get instant allow or deny answers.
- Write safer database queries faster by using plan_resources to get the exact filters your policy requires.
- Simplify complex security audits by using authzen_evaluations to check multiple requests in one go.
- Keep your infrastructure in sync by using get_server_info to verify the exact version of your running instance.
- Reduce configuration errors by using get_authzen_config to quickly grab your required API endpoints.

## How It Works

The bottom line is that you get instant, conversational access to your authorization logic without manual testing.

1. Connect your Cerbos instance by providing the base URL in your AI client.
2. Ask your agent to check a specific permission or generate a query plan.
3. Receive a clear allow or deny result along with the underlying logic.

## Frequently Asked Questions

**What is Cerbos MCP for?**
Cerbos MCP lets you manage and audit your authorization policies using natural language. You can ask your AI client to check permissions, generate query plans, or verify security rules without leaving your chat interface.

**How can I use Cerbos to check permissions?**
You can simply ask your AI agent to verify if a specific user or role can perform an action on a resource. The Connector will check your Cerbos policies and give you a clear allow or deny answer immediately.

**Can Cerbos help with my database queries?**
Yes. It can generate query plans that tell you exactly what filters to apply to your database results to ensure they comply with your security policies.

**Is Cerbos good for RBAC and ABAC?**
It is built specifically for both RBAC and ABAC. It helps you manage complex permission logic and ensures your AI agent can evaluate those rules accurately in real time.

**How do I connect Cerbos to my AI client?**
Once you subscribe to the Connector, you just need to provide your Cerbos instance base URL in your AI client settings. From there, your agent can start interacting with your policies.

**Can I audit my security policies with Cerbos?**
Absolutely. You can ask your agent to evaluate batches of requests or check specific roles to ensure your policies are behaving exactly as you intended.

**Can I check if a specific user has permission to access a resource?**
Yes. Use the `check_resources` tool by providing the principal (user) details and the resource information. The agent will return an evaluation of allowed or denied actions.

**How do I generate a filter for my database based on user permissions?**
Use the `plan_resources` tool. It produces a query plan (AST) that you can use to construct database queries, ensuring users only see records they are authorized to access.

**Is it possible to verify the Cerbos server version via AI?**
Yes, the `get_server_info` tool retrieves the version, build date, and commit hash of your connected Cerbos instance.