How to Use the Cerbos MCP in CrewAI

Q: What's the best way to use Cerbos's planresources tool within a CrewAI crew?

Have a 'Planner' agent call planresources at the start of a task. It generates an access plan that defines the scope of work. This plan is then passed to other agents in the CrewAI team so they know exactly what resources they are cleared to work on.

Equip your CrewAI agent teams with centralized authorization to act on behalf of users, safely.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cerbos MCP to CrewAI

Create your Vinkius account to connect Cerbos to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cerbos with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Assign a Dedicated Security Agent

In a CrewAI setup, you can create an agent whose sole job is to handle permissions. This 'Security Officer' agent would be equipped with the Cerbos tools. When another agent in the crew needs to perform an action, it first asks the Security Officer. That agent then uses `check_resources` or `authzen_evaluation` to get a definitive yes/no answer. This separates concerns perfectly: your 'Operator' agents focus on getting work done, while the 'Security Officer' ensures they only act within the bounds of their given authority.

Scope Agent Work with Resource Plans

Kick off a crew's task by having a 'Planner' agent use the `plan_resources` tool. This agent's job is to ask Cerbos for a query plan that defines all the resources a user is allowed to access for a given task. The agent then passes that plan to the rest of the crew. This gives your autonomous agents a clearly defined, pre-authorized scope of work. An 'Analyst' agent knows it's only looking at approved data, and a 'Writer' agent knows it's only editing approved documents. It makes your crew's operation safe and predictable. This MCP Server is the source of truth.

Let Your CrewAI Team Manage Permissions

For complex monitoring tasks, have one agent in your crew use `authzen_evaluations` to check a wide array of permissions across different systems. The agent can check if a user's access rights are consistent with company policy, for example. Based on the batch results, it can delegate tasks to other agents. If a permission is missing, it can task a 'Notifier' agent to alert an admin. If an improper permission is found, it can task an 'Auditor' agent to log the compliance violation.

Setup guide

Set up Cerbos MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke Cerbos tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="Cerbos Analyst",
    goal="Access and analyze Cerbos data via MCP.",
    backstory="Expert analyst with direct Cerbos access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent Cerbos transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="Cerbos Analyst",
        goal="Access and analyze Cerbos data via MCP.",
        backstory="Expert analyst with direct Cerbos access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent Cerbos transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cerbos. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cerbos now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cerbos MCP in CrewAI

You can assign one agent the role of checking permissions with Cerbos tools. Other agents in the crew would then consult this 'security' agent before taking any action, ensuring everything they do is authorized.

Yes. You can model your agents as principals within Cerbos. Then, your 'Supervisor' agent can use `check_resources` to see if a 'Worker' agent has permission to access a specific file or API before delegating the task.

Have a 'Planner' agent call `plan_resources` at the start of a task. It generates an access plan that defines the scope of work. This plan is then passed to other agents in the CrewAI team so they know exactly what resources they are cleared to work on.

Absolutely. You provide the MCP Server URL when you define your agents. The single Vinkius endpoint and token can be shared across all agents in the crew, giving them all access to the same centralized authorization logic.

Cerbos handles the data needed to make an authorization decision: identifiers for the principal, resources, and actions. When your CrewAI agent makes a call, that data is processed in a secure, ephemeral sandbox on Vinkius and is never stored or analyzed.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript