Cerbos MCP. Audit policies and manage access rights via conversation.

Hey, so this Cerbos server lets your AI client manage and audit all your access policies directly. You don't gotta manually call APIs for every permission check anymore. Your agent treats authorization like any other data task. It handles the whole authorization lifecycle, from testing development rules to compliance audits.

Checking Permissions: Your agent uses check_resources to verify if a user has the necessary rights for a specific resource. You can run multiple checks using authzen_evaluations or a single check with authzen_evaluation. You can also see if a user can act on a resource by checking the rules with check_resources.

Planning Queries: If you need to filter database results based on complex policy rules, run plan_resources. This generates an Abstract Syntax Tree (AST) query plan, letting you see the logic before the query actually runs.

Managing Policies and Schemas: You can list all current policies using list_policies, and you can retrieve the full details of any single policy with get_policy. Need to change something? Use update_policy to modify existing policies, or use add_policy to define a brand new access policy. You can also temporarily disable a policy with disable_policy or activate it with enable_policy.

If a policy is stale, you can delete it entirely using delete_policy. Similarly, you can list all resource schemas with list_schemas, get the structure of a single resource using get_schema, and update definitions with add_schema.

Auditing and Monitoring: To prove compliance, you can pull a list of all recorded access control audit logs using list_audit_logs. You'll also get performance data and Prometheus metrics via get_metrics. You can check the current operational status and health of the Cerbos server using get_health, and you'll always know the server version with get_server_info.

Other Tools: You can get metadata about the AuthZEN configuration using get_authzen_config and you can find out what policies are currently defined by running list_policies.

Basically, your agent can list all defined policies and schemas, check if a user can do what they wanna do, plan complex filters, and manage the rules that govern it all. It's a full-service policy playground built right into your chat.