How to Use the Cerbos MCP in OpenAI Agents SDK

Q: How do I use the Cerbos MCP server with the OpenAI Agents SDK?

Install openai-agents and instantiate MCPServerStreamableHttp with your Vinkius endpoint URL. Pass it to your Agent constructor in the mcpservers list. The SDK automatically discovers all the Cerbos tools.

Q: Can my OpenAI agent batch permission checks with Cerbos?

Yes. The authzenevaluations tool is designed for batching. Your agent can send multiple requests and get a decision for all of them at once, which is much faster than checking them individually.

Q: How do I get the Cerbos server version?

Just call the getserverinfo tool. It returns the running version and build details, which is useful for debugging or confirming your environment is what you expect.

Build production agents with Cerbos and the OpenAI Agents SDK that make safe, auditable authorization decisions.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cerbos MCP to OpenAI Agents SDK

Create your Vinkius account to connect Cerbos to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cerbos with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Check Permissions Before Acting

The `check_resources` tool lets your agent verify access rights for a user before it tries to read or modify data. It's a simple, read-only check that returns a clear allow or deny for a set of resources. With the OpenAI Agents SDK, you can wrap this check in a guardrail. This means the agent system itself validates the authorization check *before* executing the next step, giving you a hard safety layer for critical operations.

Plan Data Access with your MCP Server

Use the `plan_resources` tool to get a query plan for all resources a principal can access. Instead of checking one by one, Cerbos gives your agent the exact conditions needed to fetch the right data from a database. This is perfect for building specialized agents. One agent can generate the access plan, then hand it off to another agent responsible for data retrieval, with full tracing in the OpenAI dashboard.

Evaluate Complex AuthZEN Policies

The `authzen_evaluation` and `authzen_evaluations` tools run complex authorization logic defined in the AuthZEN entity model. You can send one-off requests or batch them with different execution rules for efficiency. Your agent gets back a simple permit or deny based on your central policies. This decouples the authorization logic from your agent's code, so you can update policies without redeploying the agent.

Setup guide

Set up Cerbos MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all Cerbos tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives Cerbos tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate Cerbos tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="Cerbos Agent",
            instructions="You have access to Cerbos tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cerbos. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cerbos now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cerbos MCP in OpenAI Agents SDK

Install `openai-agents` and instantiate `MCPServerStreamableHttp` with your Vinkius endpoint URL. Pass it to your `Agent` constructor in the `mcp_servers` list. The SDK automatically discovers all the Cerbos tools.

Yes. The `authzen_evaluations` tool is designed for batching. Your agent can send multiple requests and get a decision for all of them at once, which is much faster than checking them individually.

You get centralized, auditable access control. Instead of hardcoding permissions in your agent's logic, it queries Cerbos, so you can manage access policies in one place for all your agents.

Just call the `get_server_info` tool. It returns the running version and build details, which is useful for debugging or confirming your environment is what you expect.

No, it doesn't store anything. The server processes principal IDs, resource details, and actions in-memory just for the evaluation. Vinkius runs each MCP server in an ephemeral, zero-trust sandbox that's destroyed after each request.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript