OpenFGA
About
Enables large language models to interact with OpenFGA authorization stores by providing tools to read, search, and manipulate fine-grained access control policies with support for checking permissions and generating access decision explanations.
Details
- Author
- evansims
- Repository
- evansims/openfga-mcp
- GitHub stars
- 8
- License
- Apache License 2.0
- Categories
- Developer Tools, AI, Design, Search, Infrastructure, Frontend, Security
Jump to
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
OpenFGACommand (node, npx, python, etc.)dockerArguments-
Argument 1
run -
Argument 2
--rm -
Argument 3
-i -
Argument 4
--pull=always -
Argument 5
evansims/openfga-mcp:latest
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
-
Argument 1
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
| Authentication | Variable | Default | Description |
| ------------------ | ------------------------------- | ------- | ------------- |
| Pre-Shared Keys | OPENFGA_MCP_API_TOKEN | | API Token |
| Client Credentials | OPENFGA_MCP_API_CLIENT_ID | | Client ID |
| | OPENFGA_MCP_API_CLIENT_SECRET | | Client Secret |
| | OPENFGA_MCP_API_ISSUER | | Token Issuer |
| | OPENFGA_MCP_API_AUDIENCE | | API Audience |
See docker-compose.example.yml for complete examples.
Create Store
Create a new store in OpenFGA.
List Stores
List all stores available in OpenFGA.
Get Store
Retrieve details of a specific store.
Delete Store
Delete a specified store from OpenFGA.
Create Model
Create a new authorization model using the DSL (Domain Specific Language).
List Models
List all authorization models available in a specific store.
Get Model
Retrieve details of a specific authorization model.
Verify Model
Verify the correctness of a specific authorization model.
Check Permission
Check if a specific user has certain permissions.
Grant Permission
Grant specific permissions to a user.
Revoke Permission
Revoke specific permissions from a user.
Query Users
Query for users related to specific permissions or objects.
Query Objects
Query for objects related to specific permissions or users.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"openfga": {
"env": {},
"args": [
"run",
"--rm",
"-i",
"--pull=always",
"evansims/openfga-mcp:latest"
],
"command": "docker"
}
}
}Linux
{
"env": [],
"args": [
"run",
"--rm",
"-i",
"--pull=always",
"evansims/openfga-mcp:latest"
],
"command": "docker"
}Macos
{
"env": [],
"args": [
"run",
"--rm",
"-i",
"--pull=always",
"evansims/openfga-mcp:latest"
],
"command": "docker"
}Windows
{
"env": [],
"args": [
"run",
"--rm",
"-i",
"--pull=always",
"evansims/openfga-mcp:latest"
],
"command": "docker"
}OpenFGA
| Variable | Default | Description |
| --------------------------- | ------- | --------------------------------------------------- |
| OPENFGA_MCP_API_URL | | OpenFGA server URL |
| OPENFGA_MCP_API_WRITEABLE | false | Enables write operations |
| OPENFGA_MCP_API_STORE | | Default requests to a specific store ID |
| OPENFGA_MCP_API_MODEL | | Default requests to a specific model ID |
| OPENFGA_MCP_API_RESTRICT | false | Restrict requests to configured default store/model |
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
