How to Use the Cerbos (Access Control) MCP in Google ADK

Q: How do I add Cerbos (Access Control) to my Google ADK agent?

Install google-adk via pip. Initialize an McpToolset using StreamableHttpServerParameters and your Vinkius URL. Pass this toolset to the tools array in your LlmAgent setup.

Q: Can Google ADK restrict which Cerbos (Access Control) tools the agent sees?

Yes, you can use the toolnames filter in the ADK configuration. This allows you to expose checkresources to a standard agent while reserving addpolicy and deletepolicy for admin agents.

Q: How does the agent handle AuthZEN metadata?

The server provides the getauthzenconfig tool for this exact scenario. Your agent can fetch the configuration metadata to ensure compliance with the AuthZEN standard before executing batch evaluations.

Give your Google ADK agents the ability to check permissions and manage Cerbos (Access Control) policies inside your architecture.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cerbos (Access Control) MCP to Google ADK

Create your Vinkius account to connect Cerbos (Access Control) to Google ADK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cerbos (Access Control) with Google ADK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Build enterprise access control with Google ADK

Integrating the Cerbos (Access Control) MCP Server gives your Gemini models direct access to your policy engine. The agent can parse complex access requirements and instantly verify them using the `check_resources` tool. Long-context reasoning makes Gemini perfect for analyzing massive policy sets. You can ask the agent to review your entire authorization setup by calling `list_policies` and `list_schemas`. The model ingests all this data and identifies conflicting rules or overlapping permissions.

Query resource plans for BigQuery integration

Cerbos (Access Control) excels at generating query plans for data filtering. Your agent can call `plan_resources` to get an Abstract Syntax Tree (AST) defining exactly which records a user can view. This AST translates perfectly into SQL filters for your BigQuery datasets. Instead of pulling thousands of rows and filtering them in memory, your AI client handles authorization at the database level. The agent fetches the plan, constructs the BigQuery statement, and retrieves only the authorized data. This keeps your Google Cloud architecture fast and cost-effective.

Monitor policy infrastructure dynamically

Keeping an eye on your authorization service is vital, and the Cerbos (Access Control) MCP Server exposes this data natively. Your agent can check the operational status by executing `get_health` and `get_server_info`. If a deployment fails, the agent can diagnose the issue by inspecting the server build information. Performance data is also readily available. The `get_metrics` tool pulls Prometheus metrics directly from the server. Your agent can analyze these metrics to detect latency spikes or high error rates in your access control evaluations.

Setup guide

Set up Cerbos (Access Control) MCP in Google ADK

Prerequisites

Python 3.10+ installed
google-adk package (pip install google-adk)
Active Vinkius subscription with a valid endpoint token

1

Install Google ADK

Run pip install google-adk to install the Agent Development Kit. MCP support is included via the McpToolset class.
2

Connect via SSE transport

Use McpToolset.from_server() with SseServerParams pointing to your Vinkius endpoint. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Create an LlmAgent

Pass the returned mcp_tools list directly to LlmAgent(tools=mcp_tools). The ADK maps each MCP tool to a native Gemini function call — no manual schema definitions required.
4

Run with any Gemini model

The agent works with any Gemini model (gemini-2.0-flash, gemini-2.5-pro, etc.). Copy the full example on the right to get started with Cerbos (Access Control) tools in your ADK agent.

agent.py

from google.adk.agents import LlmAgent
from google.adk.tools.mcp_tool.mcp_toolset import McpToolset
from google.adk.tools.mcp_tool.mcp_session_manager import SseServerParams

# Connect to the MCP via SSE
mcp_tools, exit_stack = await McpToolset.from_server(
    connection_params=SseServerParams(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    )
)

# Create your agent with auto-discovered tools
agent = LlmAgent(
    name="Cerbos (Access Control)_agent",
    model="gemini-2.0-flash",
    instruction="You have access to Cerbos (Access Control) tools via MCP.",
    tools=mcp_tools,
)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cerbos. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cerbos (Access Control) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cerbos (Access Control) MCP in Google ADK

Install `google-adk` via pip. Initialize an `McpToolset` using `StreamableHttpServerParameters` and your Vinkius URL. Pass this toolset to the `tools` array in your `LlmAgent` setup.

Yes, you can use the `tool_names` filter in the ADK configuration. This allows you to expose `check_resources` to a standard agent while reserving `add_policy` and `delete_policy` for admin agents.

It functions flawlessly within the Vertex AI ecosystem. As long as your Google ADK agent has network access to the Vinkius endpoint, it can evaluate permissions and manage schemas.

The server provides the `get_authzen_config` tool for this exact scenario. Your agent can fetch the configuration metadata to ensure compliance with the AuthZEN standard before executing batch evaluations.

The server interacts strictly with policy definitions, audit logs, and resource access queries. Vinkius routes these requests through ephemeral, zero-trust endpoints. Your actual user identities and core database contents never pass through this connection.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript