How to Use the Cerbos MCP in Cline

Q: Can Cline test single actions against the policy engine?

Your agent calls the authzenevaluation tool to evaluate single actions against the AuthZEN entity model. It sends the principal and resource data, then outputs the exact permission result.

Q: What AuthZEN batch semantics do Cerbos and Cline support?

The integration handles executeall, denyonfirstdeny, and permitonfirstpermit. Your agent formats the batch request and processes the response based on whichever semantic you specify.

Give Cline direct access to your Cerbos policies. This MCP Server lets your VS Code agent write, test, and debug access control logic end-to-end.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cerbos MCP to Cline

Create your Vinkius account to connect Cerbos to Cline and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cerbos with Cline

Ask AI about this MCP

ChatGPT

Claude

Perplexity

End-to-end access control in VS Code

Cline actively tests policies against your codebase by calling the `check_resources` tool. The agent verifies exact permissions for any principal on your defined resources. It does this right inside your editor. If a permission fails, Cline doesn't stop. It modifies your policy files, runs the evaluation again, and stages the commit once the tests pass. You get a fully automated authorization workflow without leaving your IDE.

Batch test AuthZEN models with Cline

Your agent uses the `authzen_evaluations` tool to execute batch evaluations using execute_all or deny_on_first_deny semantics. Testing multiple access requests manually is a massive waste of time. You tell the agent to verify a new user role across ten different endpoints. It structures the batch request, fires it off to the Cerbos MCP Server, and parses the results to ensure your new policies don't break existing access rules.

Automate query plan generation

The `plan_resources` tool produces a precise query plan for obtaining a list of resources a principal is allowed to access. Writing complex database filters based on permissions is tedious work. Cline takes that plan and writes the actual SQL or ORM code into your repository. It connects your application data layer directly to your authorization logic, completely autonomously.

Setup guide

Set up Cerbos MCP in Cline

Prerequisites

VS Code with Cline extension installed
Active Vinkius subscription with a valid endpoint token

1

Open Cline MCP settings

Click the Cline icon in the VS Code sidebar to open the Cline panel. Then click the MCP Servers icon (server stack) at the top-right corner of the panel.
2

Add a remote server

Click "Remote Servers" at the top, then click "Add Remote MCP". In the Name field, type cerbos-mcp. In the URL field, paste your Vinkius endpoint: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp. Get your token from cloud.vinkius.com.
3

Enable the server

After saving, the server appears in the Cline MCP panel. Toggle the switch to enable it. The status indicator turns green when the connection is live.
4

Start using tools

Return to the Cline chat and ask: "Check my latest Cerbos refund status." Cline will discover the available tools and request your approval before invoking each one — giving you full control over every action.

Cline MCP Settings

{
  "mcpServers": {
    "cerbos-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cerbos. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cerbos now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cerbos MCP in Cline

Open the Cline sidebar and click the MCP Servers icon. You can add the URL via the Remote Servers tab using the Streamable HTTP transport. Alternatively, edit your `cline_mcp_settings.json` file directly.

Your agent calls the `authzen_evaluation` tool to evaluate single actions against the AuthZEN entity model. It sends the principal and resource data, then outputs the exact permission result.

Debugging version mismatches takes seconds. The agent executes `get_server_info` to pull the exact build details of your running instance. It uses this data to ensure compatibility with your current policy schema.

The integration handles execute_all, deny_on_first_deny, and permit_on_first_permit. Your agent formats the batch request and processes the response based on whichever semantic you specify.

Security is handled at the transport layer with a zero-trust architecture. The agent processes principal IDs, resource attributes, and evaluation results inside an ephemeral sandbox. None of your internal authorization rules leak or persist after the session ends.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript