Cerbos 2026: Authorization for AI Agents and MCP

Cerbos is an authorization platform for applications, APIs, AI agents, and MCP servers. Its open-source Policy Decision Point (PDP) evaluates YAML policies, while the calling application or framework enforces the result.

That makes Cerbos complementary to MCP-Scan : MCP-Scan looks for MCP security issues, while Cerbos evaluates whether a particular principal may use a tool or access a resource.

Cerbos architecture diagram showing an application sending an authorization request to the policy decision point and receiving an allow or deny decision

The Cerbos repository has about 4.5k GitHub stars. Its current stable release is v0.54.0 , released in July 2026.

What is Cerbos?

Cerbos moves authorization rules out of application code. A request describes the principal, action, resource, and optional context; the PDP evaluates matching policies and returns an allow or deny decision.

The PDP is stateless and can run beside an application or as a shared service. Cerbos also provides eight SDK languages for integrating those checks into application code.

AI and MCP authorization

Policies can govern tool calls and resource access using the delegating user’s identity, role, and request context. The agent framework or MCP server enforces the PDP’s decision.

RAG authorization

The PlanResources API can produce conditions that an integration converts into metadata filters for a vector database or other data store.

Policy as code

Policies are written in YAML and can be versioned, tested, and distributed through Git workflows or Cerbos Hub.

What are Cerbos’s key features?

Feature	Details
Policy engine	Stateless, Apache-2.0 Policy Decision Point
Policy format	YAML policies with conditions
Access models	Role-based, attribute-based, and policy-based authorization
APIs	CheckResources for decisions; PlanResources for conditional query plans
SDK languages	Go, Java, JavaScript, Python, .NET, PHP, Ruby, and Rust
AI authorization	MCP tool calls, agent actions, and RAG retrieval
Deployment	Kubernetes, serverless, edge, or a standalone service
Performance	Sub-millisecond policy evaluation, according to Cerbos
Audit support	Decision logs; Hub can aggregate logs across deployed PDPs
Stable release	v0.54.0, released in July 2026

Cerbos says Hub audit aggregation can support evidence collection for SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR requirements. That is narrower than claiming that every Cerbos deployment is certified or automatically compliant.

How authorization works

Cerbos evaluates authorization but does not transparently intercept every request. The application, API, agent framework, or MCP server must call the PDP and enforce the returned decision.

For MCP, Cerbos documents a flow in which the integration sends user context, tool, and target resource to the PDP before execution. The PDP returns allow or deny, and the agent framework enforces the result .

Cerbos describes these local policy decisions as sub-millisecond. The vendor does not publish that figure as a p99 measurement, and end-to-end latency still depends on network placement and the surrounding integration.

RAG authorization

Cerbos documents authorization at the retrieval step of a RAG pipeline. Its PlanResources API generates conditions from the user’s identity and resource policy, which the integration translates into a filter supported by the target data store.

This filtering happens before documents are added to the LLM prompt. The official RAG recipe includes a Chroma example and notes that each vector store has its own filter syntax.

RAG authorization flow where a Cerbos query plan limits the vector database results supplied to an LLM

Cerbos components

Cerbos PDP is the open-source policy engine that evaluates authorization requests.
Cerbos Hub manages policy authoring, testing, versioning, distribution, and audit aggregation.
Cerbos Synapse collects identity, resource, and relationship data to enrich authorization context.
Policy Enforcement Point integrations call the PDP and apply its decisions in the protected application or service.

When should I use Cerbos?

Cerbos fits teams that want one policy layer for application and agent authorization without embedding permission rules throughout the codebase. Its documented AI patterns cover MCP tool calls and RAG data retrieval.

It is an authorization component, not a prompt-injection detector, MCP vulnerability scanner, or agent red-teaming tool. Those controls solve different parts of the AI security problem.

Tip

Best fit

Use Cerbos when the main requirement is identity- and context-aware authorization for application resources, agent actions, or MCP tools, and your application can call a PDP before performing the protected operation.

How do I get started with Cerbos?

Run the PDP — Start the open-source Cerbos container or deploy it beside your application or as a shared service.

Write and test policies — Define principals, resources, actions, and conditions in YAML, then test the policies before distribution.

Add an enforcement point — Use a Cerbos SDK or API call in the application, agent framework, or MCP server and enforce the returned decision.

Add context if needed — Pass the required attributes with the request or use Synapse to collect identity, resource, and relationship data.

Collect decision logs — Configure PDP audit logging or use Hub to aggregate audit records from multiple PDPs.

How much does Cerbos cost?

The open-source Cerbos PDP is free under Apache 2.0. The public pricing page lists separate Hub and Synapse plans:

Plan	Published price
Proof of Concept	$0 per month, up to 100 monthly active principals
Development	From $25 per month, with the first 100 monthly active principals included
Production	From $933 per month, with the first 5,000 monthly active principals included
Enterprise	Custom pricing

The commercial plans differ in workspace, developer, PDP, tenant, policy-build, audit-retention, support, and deployment limits. Check the vendor page before purchasing because those limits can change.

What are alternatives to Cerbos?

Related authorization projects and services include Open Policy Agent , SpiceDB , Oso Cloud , OpenFGA , and Permit.io . They use different policy models and deployment approaches, so evaluate them against your application’s authorization requirements.

For adjacent AI security controls, see MCP-Scan for MCP vulnerability scanning and Cisco DefenseClaw for agent runtime governance.

Primary sources

Visit Cerbos View source on GitHub (4500★)

Frequently Asked Questions

What is Cerbos?

Cerbos is an authorization platform built around an open-source Policy Decision Point. The PDP evaluates requests against YAML policies and returns a decision; the calling application or framework is responsible for enforcing it.

Is Cerbos free?

The Cerbos PDP is free and open-source under Apache 2.0. Cerbos also sells Hub and Synapse plans for centralized policy management, audit aggregation, and context enrichment.

How does Cerbos work with MCP servers?

An MCP integration can send the user, requested tool, target resource, and request context to the Cerbos PDP. Cerbos returns allow or deny, and the agent framework or MCP server enforces that decision before the tool runs.