Fga MCP Server
OpenFGA and Auth0 FGA authorization models, SDK docs, and live server tools.
Data last scanned today · Reviewed today
Overview
This TypeScript MCP server provides a suite of tools, resources, and documentation for working with OpenFGA and Auth0 FGA. It supports offline authorization modeling, allowing users to design and validate models using local DSL validation and bundled design prompts. For active environments, it connects to live OpenFGA backends to manage stores, models, and tuples. It offers both fixed and dynamic connection options, enabling agents to interface with authorization servers directly while utilizing the provided SDK code examples and documentation search.
Our verdict
With a security score of 48/100, this server is classified as high-risk. This is primarily due to the server being a community-maintained project rather than an official vendor release, alongside an unverified authentication implementation. Users should exercise caution and review the project's handling of credentials in dynamic connection scenarios before deploying it in sensitive authorization workflows.
- Supports local, read-only model validation without live connections
- Bundles extensive SDK documentation and design prompts
- Features a small footprint with only six direct dependencies
- Released under an open-source MIT license
- Lacks official vendor maintenance
- Single-contributor project increases bus-factor risk
- Authentication methods have not been independently reviewed
Setup
{
"mcpServers": {
"fga-mcp": {
"args": [
"-y",
"fga-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| create_store | Creates a new store. | medium |
| delete_store | Deletes a store. | high |
| get_store | Retrieves information about a store. | low |
| list_stores | Lists available stores. | low |
| create_model | Creates a new authorization model. | medium |
| get_model | Retrieves an authorization model. | low |
| get_model_dsl | Retrieves the DSL representation of an authorization model. | low |
| list_models | Lists authorization models for a store. | low |
| verify_model | Verifies an authorization model. | low |
| check_permission | Checks for a specific permission. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the system requirements for running this server?
This server requires Node.js version 20 or higher.
›Can I use the server without a live OpenFGA backend?
Yes, core features like model design prompts, authorization model DSL validation, and bundled OpenFGA documentation are available without any live server connection.
›How do I enable write operations on my OpenFGA instance?
Write operations are disabled by default for safety. You must explicitly set writeable to true within your FGA configuration file.
›How do agents handle authentication for OpenFGA servers?
Agents can use fixed credentials provided in the configuration file or perform runtime authentication via the connect_server tool when a server requires it.
›What is the difference between fixed servers and dynamic connections?
Fixed servers are pre-defined in your configuration file for known environments, while dynamic connections allow agents to connect to ad-hoc or discovered OpenFGA URLs at runtime if enabled.
Badge
Maintain this server? Add the live badge to your README.