OpenFGA

OpenFGA MCP Server enables AI-powered management of OpenFGA authorization via the Model Context Protocol. It lets you design efficient authorization models, generate SDK code with full context, and control live OpenFGA servers through MCP clients.

How to use

You connect an MCP client to the OpenFGA MCP Server to design, generate, and manage OpenFGA models and instances. Use the offline workflow to design models and generate code without starting a server, and switch to online mode to manage a live OpenFGA deployment. Safety: write operations are disabled by default and must be explicitly enabled.

How to install

{
  "mcpServers": {
    "OpenFGA": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "--pull=always",
        "evansims/openfga-mcp:latest"
      ]
    }
  }
}

Configuration and usage notes

Configure how the MCP server is exposed and how it connects to OpenFGA. In offline mode you design models and generate code without starting a live server. In online mode you connect to an OpenFGA instance by passing environment variables to the Docker container.

Security and networking notes

By default, write operations are disabled. To enable writes, set the environment variable OPENFGA_MCP_API_WRITEABLE to true. When using Docker networking, open the OpenFGA MCP API URL as either host.docker.internal on local machines, container names on Docker networks, or a full remote URL for remote instances.

Notes about transports and capabilities

The MCP server supports stdio and HTTP transports. Choose stdio for local, container-based runs and http for networked connections. SSE streams can be enabled to receive real-time responses. Stateless mode is available for session-less clients.

Common usage patterns

Use offline mode to design models and generate SDK documentation without needing an OpenFGA instance. Use online mode to connect to a live OpenFGA server for end-to-end management, including stores, models, and permission checks. You can use the MCP prompts to assist with design, implementation, and troubleshooting workflows.

Troubleshooting tips

If you encounter connection issues, verify the API URL is reachable from your MCP client. Ensure the correct transport is selected (stdio for local runs, http for remote). Check that the API token or credentials are configured if authentication is enabled, and verify that writeable operations are enabled only when you intend to perform them.

Examples and quick references

Use the offline workflow to explore design patterns and generate code contexts. Use the online workflow to manage stores, models, and permissions on a live OpenFGA deployment. The MCP server provides tools for stores, models, permissions, and SDK documentation across multiple SDK languages.

Available tools

Stores

Create, list, get, and delete stores within the OpenFGA MCP workflow.

Models

Create models with a DSL, list existing models, get details, and verify models.

Permissions

Check, grant, revoke permissions; query users and objects within stores and models.

SDK Documentation

Provide comprehensive documentation for OpenFGA SDKs across languages and generate code with context.

AI Prompts

Design, implement, troubleshoot, and optimize authorization models with targeted prompts.

Resources & URIs

Provide convenient URIs for stores, models, and SDK docs to speed up development.

Smart Completions

Autocompletion for store IDs, model IDs, relations, users, and objects when connected.