Integration

Ory Keto integration

Ory Keto is a Zanzibar-style permission server: authorization is stored as relationship tuples (namespace, object, relation, subject) and questions are answered by walking those relations. This catalog entry lets an agent create a relationship, patch several relationships at once with insert and delete operations, delete every relationship matching a filter, query relationships page by page, ask whether one subject holds one relation on one object, ask the same question for a batch of tuples in a single call, expand a relation into the tree of subjects that hold it, list the configured namespaces, and read server version and readiness. Keto serves reads and writes on two different ports (4466 read, 4467 write), so the host must front both, which is what an Ory Network project URL and a normal reverse proxy already do; a bare self-hosted install reachable on only one of the two ports will answer half of these calls and 404 the other half. The host is part of the credential because every install is its own deployment. Authentication is an API key sent as a bearer token in the Authorization header; a self-hosted Keto is normally protected by the network or by a proxy instead, in which case any placeholder value is accepted.

Connect Ory Keto How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Ory Keto.Built from the 11 Ory Keto tools below, on the connection you add once.

What you can do with Ory Keto

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Relation tuple, 4 operations

create_relationshipCreate relationshipPUTCreate a Relationship.
delete_relationshipsDelete relationshipsDELETEDelete Relationships.
list_relationshipsList relationshipsGETQuery relationships.
patch_relationshipsPatch relationshipsPATCHPatch Multiple Relationships.

Alive, 1 operation

check_aliveCheck aliveGETCheck alive status.

Check, 1 operation

batch_check_permissionsBatch check permissionsPOSTBatch check permissions.

Expand, 1 operation

expand_permissionExpand permissionGETExpand a Relationship into permissions.

Namespace, 1 operation

list_namespacesList namespacesGETQuery namespaces.

Openapi, 1 operation

check_permissionCheck permissionPOSTCheck a permission.

Ready, 1 operation

check_readyCheck readyGETCheck readiness status.

Version, 1 operation

get_versionGet versionGETGet service version.

Use Ory Keto from Claude Code, Cursor or Codex

Connect Ory Keto in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Ory Keto operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Ory Keto

Create your workspace
Sign up free. Nothing to install.
Connect Ory Keto once
Add your Ory Keto connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.