# Permify MCP for AI Agents AI Agent Connect > Permify MCP helps you manage fine-grained authorization and access control. It allows you to write schemas, manage relation tuples, and perform real-time permission checks for complex IAM models. Use it to handle multi-tenancy and audit relationship graphs without manual API calls. ## Overview - **Category:** developer-tools - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_Lj3zVVVKVoHoqSvO650xPkcUTwv8Ivlhnr8cxNaW/ai-agent-connect - **Tags:** iam, authorization, rbac, abac, rebac, access-control ## Description Permify lets you manage complex authorization models and access control policies through natural language. Instead of manually writing JSON files or running scripts to update roles, you can just tell your agent what needs to change. You can find this in the Vinkius catalog to get started quickly. It handles multi-tenancy so you can keep client data isolated and manageable from one place. Your agent can check if a user has permission to a specific resource or see who has access to a specific item. You can also audit your current relational tuples to see how users and resources are linked. It turns complex IAM infrastructure into a conversational experience where you can write schemas, manage data bundles, and perform real-time checks without switching tabs. You can update parts of your authorization model without rewriting the whole file, and you can create or delete entire tenant environments as needed. It takes the friction out of security engineering by providing a direct way to interact with your permission logic. Whether you are trying to debug a specific permission issue or need to provision a new client environment, you can do it through a single interface. This means no more hunting through configuration files or running complex CLI commands just to verify a single access rule. ## Tools ### list_tenants List all Permify tenants in your account. This gives you a high-level view of all managed clients. ### lookup_entity Find which resources a specific user can perform an action on. This helps you debug specific access issues. ### lookup_subject Find which subjects can do an action on a specific entity. Use this to see all users with a certain permission. ### read_attributes Query stored attributes for your entities. This helps you see the metadata associated with your resources. ### read_bundle Retrieve details of a specific bundle. Use this to inspect the rules within a permission bundle. ### read_relationships Query stored relational tuples. This lets you see the raw connections between users and resources. ### read_schema Inspect a specific schema version. Use this to see the exact rules of a particular authorization model. ### check_permission Perform a resource-based authorization check for a single user. Use this to see if a specific person can perform an action. ### create_tenant Create a new Permify tenant for a client. This helps you isolate permissions for different customers. ### delete_bundle Delete a predefined bundle of permissions. This cleans up old or unused permission sets. ### delete_data Delete relation tuples and attributes from your system. Use this to remove specific access rights. ### delete_tenant Delete a Permify tenant entirely. This is useful for decommissioning old client environments. ### expand_permissions Retrieve all subjects that have a relationship with an entity. This is great for auditing who can see a specific resource. ### list_schemas List all schema versions for a specific tenant. Use this to track the history of your authorization models. ### run_bundle Execute a predefined bundle of permissions. This is useful for applying a set of rules in one go. ### subject_permission List which permissions a user can perform on a specific entity. This is a direct way to check a user's rights. ### write_bundle Define or update data bundles for your permissions. Use this to group and manage sets of rules. ### write_data Create relation tuples and attribute data. This is how you define the actual permissions in your system. ### write_schema Write a new authorization model schema. Use this to set up your initial permission logic for a tenant. ### bulk_check_permissions Check multiple permissions in a single request to speed up validation. This is useful for checking large groups of users at once. ### partial_write_schema Partially update an authorization model without rewriting it. This prevents you from accidentally overwriting other rules. ## Prompt Examples **Prompt:** ``` Check if user 'user:123' has 'edit' permission on 'document:doc-001' in tenant 'default'. ``` **Response:** ``` I've performed the check for you. **Permission Result:** ALLOWED User 123 has the necessary edit rights for that document in the default tenant. You can proceed with the update. ``` **Prompt:** ``` List all schema versions for tenant 'production-v1'. ``` **Response:** ``` I found 3 versions for the 'production-v1' tenant: | Version | Created At | Status | | :--- | :--- | :--- | | v20231027-01 | 2023-10-27 | Active | | v20230915-01 | 2023-09-15 | Archived | | v20230801-01 | 2023-08-01 | Archived | Would you like me to inspect the details of the latest version? ``` **Prompt:** ``` Create a new tenant called 'client-alpha-test'. ``` **Response:** ``` Done! I've created the new tenant for you. **Tenant Details:** - **Name:** client-alpha-test - **ID:** cat-9920 - **Status:** Ready You can now start defining the authorization schema for this new client. ``` ## Capabilities ### Update authorization models Permify lets you write and partially update your permission schemas without overwriting existing data. ### Define user-resource relationships Permify lets you create and manage the relation tuples that define how users connect to resources. ### Check permissions for single or bulk requests Permify lets you verify access rights for one resource or many at the same time. ### Audit stored relational tuples Permify lets you query your current relationships to see exactly who has access to what. ### Manage isolated tenant environments Permify lets you create, list, and delete isolated tenants to manage multiple clients in one place. ## Use Cases ### Security Auditing A security engineer needs to see who has access to a specific folder. They ask the agent to use `expand_permissions` to list all subjects with a relationship to that folder. ### Rapid Schema Updates A developer needs to add a new role to a production tenant. They ask the agent to use `partial_write_schema` to update the model without affecting other rules. ### Bulk Permission Validation A QA tester needs to verify permissions for 100 different users. They ask the agent to run `bulk_check_permissions` to get a full report in one go. ### Automated Tenant Provisioning A DevOps lead needs to set up a new client. They ask the agent to use `create_tenant` and then `write_schema` to initialize the new environment. ## Benefits - Check permissions instantly using `check_permission` without writing custom code for every individual request. - Update your authorization models with `partial_write_schema` to modify specific rules without overwriting your entire configuration. - Manage multiple clients easily by creating and listing tenants with `create_tenant` and `list_tenants` in one place. - Audit your security posture by viewing all relationships with `read_relationships` to see exactly who has access to what. - Handle large scale permission checks efficiently using `bulk_check_permissions` to validate hundreds of users in one go. - Verify who has access to specific resources using `expand_permissions` and `lookup_entity` to get a clear picture of your security. ## How It Works The bottom line is you get a natural language interface for your IAM infrastructure. 1. Subscribe to the Permify MCP through the Vinkius catalog. 2. Provide your Permify API URL and Secret Token in your agent configuration. 3. Ask your agent to check permissions, update schemas, or manage tenants using natural language. ## Frequently Asked Questions **Can Permify MCP help me manage permissions for multiple clients?** Yes, it is designed for multi-tenancy. You can create, list, and delete isolated environments for different clients, ensuring their permissions remain completely separate. **How does Permify MCP handle complex user-resource relationships?** It uses a relationship-based model. This means you can define complex links between users and resources, and then query those relationships naturally to check access. **Can I use Permify MCP to audit my current access controls?** Absolutely. You can ask your agent to list all relationships or expand permissions to see exactly which users have access to specific entities in your system. **Is Permify MCP suitable for multi-tenant applications?** It is a primary use case. It allows you to manage multiple client environments from a single interface, making it ideal for SaaS platforms that need strict data isolation. **How does Permify MCP simplify my security engineering tasks?** It removes the need for manual API calls and complex CLI commands. You can interact with your IAM infrastructure using natural language to check, update, or audit permissions. **Can I update my authorization schemas without redeploying my app?** Yes, by using the partial update tools, you can modify specific parts of your authorization model through your agent without needing to touch the underlying code or redeploy. **Can I check permissions for multiple users or resources at once?** Yes! Use the `bulk_check_permissions` tool. It allows you to send a list of check requests in a single call, making it efficient for auditing complex views or batch processing. **How do I update only a small part of my authorization model?** You can use the `partial_write_schema` tool. Instead of overwriting the entire model, you provide a map of entity updates to modify specific parts of your schema. **Is it possible to manage isolated environments for different customers?** Absolutely. Use the `create_tenant` tool to spin up new isolated authorization silos. You can then use `list_tenants` to keep track of all active environments.