Integration

OpenFGA integration

OpenFGA is a relationship-based authorization engine in the style of Google Zanzibar: permissions are stored as relationship tuples (user, relation, object) inside a store, interpreted through an authorization model written in the OpenFGA modelling language. This catalog entry lets an agent create, list, read and delete stores, publish and read authorization models, write and delete relationship tuples transactionally, read tuples back with a filter, follow the change log of tuple writes since a point in time, ask whether one user holds one relation on one object, ask a batch of such questions in a single call, list every object of a type a user can reach through a relation, list every user that can reach an object, expand a relation into the userset tree that grants it, and store and read the assertions used to test a model. The host is part of the credential because every install is its own deployment: point it at the OpenFGA HTTP server (port 8080 by default) or at a managed FGA environment URL. Authentication depends on how the server was started: with a pre-shared key the value goes in the Authorization header as a bearer token, with OIDC it is an access token obtained from the configured issuer, and a server started with no authentication accepts any placeholder value.

Connect OpenFGA How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in OpenFGA.Built from the 17 OpenFGA tools below, on the connection you add once.

What you can do with OpenFGA

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Store, 4 operations

create_storeCreate storePOSTCreate a store.
delete_storeDelete storeDELETEDelete a store.
get_storeGet storeGETGet a store.
list_storesList storesGETList all stores.

Authorization model, 3 operations

create_authorization_modelCreate authorization modelPOSTCreate a new authorization model.
get_authorization_modelGet authorization modelGETReturn a particular version of an authorization model.
list_authorization_modelsList authorization modelsGETReturn all the authorization models for a particular store.

Assertion, 2 operations

read_assertionsRead assertionsGETRead assertions for an authorization model ID.
write_assertionsWrite assertionsPUTUpsert assertions for an authorization model ID.

Batch check, 1 operation

batch_check_permissionsBatch check permissionsPOSTSend a list of `check` operations in a single request.

Change, 1 operation

list_tuple_changesList tuple changesGETReturn a list of all the tuple changes.

Check, 1 operation

check_permissionCheck permissionPOSTCheck whether a user is authorized to access an object.

Expand, 1 operation

expand_relationExpand relationPOSTExpand all relationships in userset tree format, and following userset rewrite rules. Useful to reason about and debug a certain relationship.

List object, 1 operation

list_objects_for_userList objects for userPOSTList all objects of the given type that the user has a relation with.

List user, 1 operation

list_users_for_objectList users for objectPOSTList the users matching the provided filter who have a certain relation to a particular type.

Read, 1 operation

read_tuplesRead tuplesPOSTGet tuples from the store that matches a query, without following userset rewrite rules.

Write, 1 operation

write_tuplesWrite tuplesPOSTAdd or delete tuples from the store.

Use OpenFGA from Claude Code, Cursor or Codex

Connect OpenFGA in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its OpenFGA operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect OpenFGA

Create your workspace
Sign up free. Nothing to install.
Connect OpenFGA once
Add your OpenFGA connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.