How to Use the Cerbos (Access Control) MCP in Mastra AI

Q: How can my Mastra AI agent use Cerbos (Access Control) to handle a failed permission check?

Use the result of the checkresources tool in a conditional branch. If the result is 'deny', your Mastra AI workflow can execute a different set of steps, like sending a notification or logging the attempt.

Q: Can I require human approval before my Mastra AI agent enables a policy using Cerbos (Access Control)?

Yes. Configure requireToolApproval in Mastra AI for the enablepolicy tool. The workflow will automatically pause and wait for a human to approve the action before proceeding.

Q: How do I list all available schemas in Cerbos?

Just have your agent call the listschemas tool. It doesn't require any parameters. It will return a list of all schema IDs currently loaded in the Cerbos instance.

Build resilient authorization workflows for your Mastra AI agents, from policy updates to conditional access checks.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cerbos (Access Control) MCP to Mastra AI

Create your Vinkius account to connect Cerbos (Access Control) to Mastra AI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cerbos (Access Control) with Mastra AI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Automate Policy Lifecycle Management

Define workflows that manage your Cerbos policies from creation to deletion. A single Mastra AI agent can use `add_policy` to introduce a new rule, wait for an approval signal, then trigger `enable_policy`. If something goes wrong, a separate step can use `delete_policy` to roll it back. This is where Mastra AI's workflow engine shines. You can build a process that tries to update a policy with `update_policy`, but if it fails validation, the workflow can automatically branch and retry. It makes your authorization management rock-solid, and it's all managed through this single MCP server.

Create Conditional Access Workflows

Go beyond simple allow/deny. Use the `check_resources` tool as a conditional step in your Mastra AI agent's logic. If access is denied, the agent can branch to a different path—maybe requesting approval or logging an alert. For example, an agent processing a data export could first call `check_resources`. If the check fails, Mastra AI's workflow can automatically call another tool to create a support ticket and pause until approval is granted. This MCP server connects your logic to your permissions.

Integrate Health Checks into Deployments

Make your deployment pipelines smarter. Before routing traffic to a new service, have your Mastra AI agent run a health check on your Cerbos instance using the `get_health` and `get_server_info` tools. You can even pull `get_metrics` to ensure performance is stable. With Mastra AI, you can build a pre-flight check workflow. The agent checks Cerbos health, and only if it gets a healthy response does it proceed with the deployment. It's a simple way to prevent outages caused by a misconfigured authorization service.

Setup guide

Set up Cerbos (Access Control) MCP in Mastra AI

Prerequisites

Node.js 18+ and a TypeScript project
@mastra/mcp + @mastra/core packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run npm install @mastra/mcp @mastra/core plus your preferred model provider (e.g. @ai-sdk/openai).
2

Configure the MCPClient
Create an MCPClient with your Vinkius endpoint as a URL object. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and inject tools
Call mcpClient.listTools() and spread the result into your agent's tools object. All Cerbos (Access Control) tools become native Mastra tools.
4

Run with any model
Swap openai("gpt-4o") for any AI SDK-compatible provider. Call agent.generate() and the agent routes tool calls through MCP automatically.

agent.ts

import { MCPClient } from "@mastra/mcp";
import { Agent } from "@mastra/core/agent";
import { openai } from "@ai-sdk/openai";

const mcpClient = new MCPClient({
  id: "cerbos-access-control-mcp-client",
  servers: {
    "cerbos-access-control-mcp": {
      url: new URL(
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
      ),
    },
  },
});

const agent = new Agent({
  name: "Cerbos (Access Control) Agent",
  model: openai("gpt-4o"),
  instructions: "You have access to Cerbos (Access Control) tools.",
  tools: {
    ...(await mcpClient.listTools()),
  },
});

const result = await agent.generate(
  "List recent Cerbos (Access Control) transactions"
);
console.log(result.text);

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cerbos. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cerbos (Access Control) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cerbos (Access Control) MCP in Mastra AI

Use the result of the `check_resources` tool in a conditional branch. If the result is 'deny', your Mastra AI workflow can execute a different set of steps, like sending a notification or logging the attempt.

You can create a workflow that iterates through a list of policy definitions. In each loop, the agent calls `update_policy`. Mastra AI's engine can handle retries with exponential backoff for each call if one fails.

Yes. Configure `requireToolApproval` in Mastra AI for the `enable_policy` tool. The workflow will automatically pause and wait for a human to approve the action before proceeding.

Just have your agent call the `list_schemas` tool. It doesn't require any parameters. It will return a list of all schema IDs currently loaded in the Cerbos instance.

The server primarily handles your authorization policies and schemas, along with the resource and principal data for access checks. Vinkius isolates every MCP server in a sandboxed environment with encrypted-in-transit communication. Authentication is managed for you via your single Vinkius endpoint token.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript