Okta MCP Server by Fctr
fctr-idLABSCO SUMMARY
Offline is the default — you can design a model before you have a server to point at.
That makes the first hour useful without any infrastructure: draft the DSL, generate SDK code against documentation the server carries, and only then connect. When you do connect, writes stay off until OPENFGA_MCP_API_WRITEABLE is set, and OPENFGA_MCP_API_RESTRICT pins every request to a configured store and model.
What it is
An MCP server for OpenFGA and Auth0 FGA. Offline it helps design models and generate SDK code against packaged documentation; online it becomes a management client for a live OpenFGA server.
What you get
- Store management: create, list, get and delete stores
- Model management: create models from the OpenFGA DSL, then list, get and verify them
- Permissions: check, grant and revoke, plus queries for users and objects
- SDK documentation for PHP, Go, Python, Java, .NET, JavaScript and Laravel, with class and method docs and code examples
- Prompts for model design, RBAC-to-ReBAC migration, permission debugging, security audits and least privilege
- Resources addressable as openfga://stores and openfga://docs/search/{query}
Requirements
Runs as the Docker image evansims/openfga-mcp:latest, needing no configuration in offline mode. Online mode adds OPENFGA_MCP_API_URL plus credentials — a pre-shared OPENFGA_MCP_API_TOKEN, or client credentials via OPENFGA_MCP_API_CLIENT_ID and OPENFGA_MCP_API_CLIENT_SECRET. Transport is stdio by default, or http on port 9090.
Setup effort
One command — docker run --rm -i --pull=always evansims/openfga-mcp:latest
USE CASES
01
Designing an authorization model from scratch
Work in the OpenFGA DSL with design prompts and no server required.
02
Generating SDK code that matches the real API
The documentation for your language is in the server, so the generated calls are grounded.
03
Debugging why a permission check fails
Query the users and objects for a relation against the live store.
04
Letting an agent read but not write
Leave writes disabled and restrict requests to one store and model.
BEFORE YOU INSTALL
What to know first
Requires
docker on PATH
Optional
- OPENFGA_MCP_API_TOKEN in your environment
- OPENFGA_MCP_API_CLIENT_ID in your environment
- OPENFGA_MCP_API_CLIENT_SECRET in your environment
Where it runs
All 4 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
docker run --rm -i --pull=always evansims/openfga-mcp:latestMCP Clients
Claude Code, Cursor, Windsurf, Claude Desktop
JSON
{
"mcpServers": {
"OpenFGA": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--pull=always",
"evansims/openfga-mcp:latest"
]
}
}
}Offline mode (the block above) needs none of these. For Online Mode, add -e OPENFGA_MCP_API_URL=… before the image name, plus either -e OPENFGA_MCP_API_TOKEN=… or the pair OPENFGA_MCP_API_CLIENT_ID / OPENFGA_MCP_API_CLIENT_SECRET, the same way the README's Online Mode block passes the URL.
