OpenFGA is an open-source authorization solution based on Google's Zanzibar model, designed for fine-grained, relationship-based access control.

Which AI clients can I use with this MCP?

You can use this MCP with any compatible client, including Claude, Cursor, Windsurf, and VS Code.

Do I need to provide my own OpenFGA instance?

Yes, you must provide your own OpenFGA API URL and credentials to connect the MCP to your specific instance.

Can I use this to check specific user permissions?

Yes, you can use the check_relation capability to verify if a user has a specific relation to an object.

How do I manage different environments?

You can use the create_store and delete_store capabilities to manage isolated stores for different environments like staging or production.

How can I check if a specific user has access to a resource?

You can use the check_relation capability. Provide the store ID and the relationship details (user, relation, and object) to get an immediate boolean response on whether the access is permitted.

Can I see the history of changes made to relationship tuples?

Yes, the read_changes capability allows you to retrieve the changelog of relationship tuples for a specific store, optionally filtered by object type.

How do I define a new authorization model?

Use the write_authorization_model capability. You will need to provide the store ID, the schema version, and a JSON array of type definitions that describe your relations.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect Openfga Fine Grained Auth to ChatGPT and Claude

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Manage complex permission models through simple conversation.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 16 capabilities

We ship only the actions that matter.

Capability set01 / 04

01-04

4 capabilities in this set.

Part of 16 available through OpenFGA.

01
List users
This capability identifies every user that holds a specific relation to an object.
02
Read changes
Use this to pull the history of changes made to your relationship tuples.
03
Write authorization model
This capability allows you to submit and save a new authorization model to your store.
04
Create store
This capability generates a brand new OpenFGA store for your application or environment.

Capability set02 / 04

05-08

4 capabilities in this set.

Part of 16 available through OpenFGA.

05
Expand relation
This capability turns a single relation into a full tree to show the hierarchy of permissions.
06
Get authorization model
Use this to pull the details of a specific authorization model you have already created.
07
Get store
This capability retrieves the configuration and details for a specific OpenFGA store.
08
Health check
This capability checks the current status of your OpenFGA instance to ensure it is running.

Capability set03 / 04

09-12

4 capabilities in this set.

Part of 16 available through OpenFGA.

09
List stores
This capability returns a list of all the OpenFGA stores currently in your account.
10
Batch check relations
This capability runs multiple permission checks at once in a single request.
11
Check relation
Use this to verify if a specific user has a specific relation to an object.
12
Delete store
This capability removes an existing OpenFGA store from your instance.

Capability set04 / 04

13-16

4 capabilities in this set.

Part of 16 available through OpenFGA.

13
List authorization models
This capability provides a list of all authorization models stored in your instance.
14
List objects
This capability finds all objects that a particular user is allowed to access.
15
Read tuples
Use this to query and view the relationship tuples currently stored in your system.
16
Write tuples
This capability adds or removes relationship tuples from your authorization data.

Real work

What teams actually run

Rapid Model Prototyping

A developer defines a new permission model and immediately tests it with a few queries.

Security Auditing

A security engineer asks the agent to list all users with access to a sensitive resource.

Environment Management

A DevOps engineer creates and deletes stores to set up staging and production environments.

Permission Troubleshooting

An engineer expands a relation into a tree to see exactly why a user was granted access.

Automate a task

Put OpenFGA to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

OpenFGA works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put OpenFGA to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

1108ms average. Fast in production.

OpenFGA is checked daily against the live service.

Daily averagePeak 1444ms

Oct 3Today

Fastest day: 907ms
Slowest day: 1444ms
14-day trend: Improving-9%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 16 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of OpenFGA, so you can see the experience inside your AI.

It does not authenticate your account with OpenFGA. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

OpenFGA Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_VDWoQMoj6eTPYg6n6XBuedyNPsCIKIje0Bwlugcp/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — OpenFGA capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "openfga-fine-grained-auth-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_VDWoQMoj6eTPYg6n6XBuedyNPsCIKIje0Bwlugcp/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up OpenFGA in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work OpenFGA owners hand off.

This MCP is built for technical teams managing complex, relationship-based access control systems.

01
Security Engineers
They use the agent to audit tuples and verify that models behave as expected.
02
Backend Developers
They use the agent to test and iterate on permission logic directly from their IDE.
03
DevOps and SREs
They use the agent to monitor store health and manage environments across clusters.

FAQ

Questions OpenFGA owners ask.

01
What is OpenFGA?
OpenFGA is an open-source authorization solution based on Google's Zanzibar model, designed for fine-grained, relationship-based access control.
02
Which AI clients can I use with this MCP?
You can use this MCP with any compatible client, including Claude, Cursor, Windsurf, and VS Code.
03
Do I need to provide my own OpenFGA instance?
Yes, you must provide your own OpenFGA API URL and credentials to connect the MCP to your specific instance.
04
Can I use this to check specific user permissions?
Yes, you can use the check_relation capability to verify if a user has a specific relation to an object.
05
How do I manage different environments?
You can use the create_store and delete_store capabilities to manage isolated stores for different environments like staging or production.
06
How can I check if a specific user has access to a resource?
You can use the check_relation capability. Provide the store ID and the relationship details (user, relation, and object) to get an immediate boolean response on whether the access is permitted.
07
Can I see the history of changes made to relationship tuples?
Yes, the read_changes capability allows you to retrieve the changelog of relationship tuples for a specific store, optionally filtered by object type.
08
How do I define a new authorization model?
Use the write_authorization_model capability. You will need to provide the store ID, the schema version, and a JSON array of type definitions that describe your relations.

Explore

More in Developer Tools

Connect OpenFGA to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-04

List users

Read changes

Write authorization model

Create store

05-08

Expand relation

Get authorization model

Get store

Health check

09-12

List stores

Batch check relations

Check relation

Delete store

13-16

List authorization models

List objects

Read tuples

Write tuples

What teams actually run

Rapid Model Prototyping

Security Auditing

Environment Management

Permission Troubleshooting

Building your own app? The connector is yours to use.

OpenFGA Connector

Claude Desktop

Security Engineers

Backend Developers

DevOps and SREs

What is OpenFGA?

Which AI clients can I use with this MCP?

Do I need to provide my own OpenFGA instance?

Can I use this to check specific user permissions?

How do I manage different environments?

How can I check if a specific user has access to a resource?

Can I see the history of changes made to relationship tuples?

How do I define a new authorization model?

Cerbos (Access Control) AI Connector

Okta AI Connector

Duo Security (Two-Factor Authentication API) AI Connector

Logto (Auth Platform) AI Connector

Suggestions

Family Account Permission Matrix AI Connector

Security and Key Access Plan AI Connector

Lit Protocol (Decentralized Access Control) AI Connector

Auth0 AI Connector