That makes the first hour useful without any infrastructure: draft the DSL, generate SDK code against documentation the server carries, and only then connect. When you do connect, writes stay off until OPENFGA_MCP_API_WRITEABLE is set, and OPENFGA_MCP_API_RESTRICT pins every request to a configured store and model.
An MCP server for OpenFGA and Auth0 FGA. Offline it helps design models and generate SDK code against packaged documentation; online it becomes a management client for a live OpenFGA server.
- Store management: create, list, get and delete stores
- Model management: create models from the OpenFGA DSL, then list, get and verify them
- Permissions: check, grant and revoke, plus queries for users and objects
- SDK documentation for PHP, Go, Python, Java, .NET, JavaScript and Laravel, with class and method docs and code examples
- Prompts for model design, RBAC-to-ReBAC migration, permission debugging, security audits and least privilege
- Resources addressable as openfga://stores and openfga://docs/search/{query}
Runs as the Docker image evansims/openfga-mcp:latest, needing no configuration in offline mode. Online mode adds OPENFGA_MCP_API_URL plus credentials — a pre-shared OPENFGA_MCP_API_TOKEN, or client credentials via OPENFGA_MCP_API_CLIENT_ID and OPENFGA_MCP_API_CLIENT_SECRET. Transport is stdio by default, or http on port 9090.
One command plus a key — docker run --rm -i --pull=always evansims/openfga-mcp:latest, then supply credentials