MCP Server

@vengtoo/mcp-server is a Model Context Protocol server that exposes your Vengtoo account as a set of tools any MCP-compatible AI agent can call. It lets agents create policies, list subjects, evaluate access decisions, and manage your full authorization model, without leaving the chat.

This guide covers manual setup for other MCP clients.

Prerequisites

Export your API key so the MCP server can read it at startup:

export VENGTOO_API_KEY=vgt_...

Get your key at console.vengtoo.com → Settings → API Keys.

Setup

Claude Code

claude mcp add --transport stdio vengtoo -- npx -y @vengtoo/mcp-server

Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "vengtoo": {
      "command": "npx",
      "args": ["-y", "@vengtoo/mcp-server"]
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "vengtoo": {
      "command": "npx",
      "args": ["-y", "@vengtoo/mcp-server"],
      "env": {
        "VENGTOO_API_KEY": "vgt_..."
      }
    }
  }
}

Available tools

Subjects

Tool	Description
list_subjects	List all subjects in the tenant
create_subject	Create a subject (user, service, agent, device)
get_subject	Get a subject by ID
update_subject	Update a subject
delete_subject	Delete a subject
assign_role_to_subject	Give a subject a role
unassign_role_from_subject	Remove a role from a subject

Roles

Tool	Description
list_roles	List all roles
create_role	Create a role
get_role	Get a role by ID
delete_role	Delete a role

Resource Types

Tool	Description
list_resource_types	List all resource types
create_resource_type	Create a resource type with actions
get_resource_type	Get a resource type by ID
delete_resource_type	Delete a resource type

Resources

Tool	Description
list_resources	List all resources
create_resource	Create a resource instance
get_resource	Get a resource by ID
update_resource	Update a resource
delete_resource	Delete a resource

Policies

Tool	Description
list_policies	List all policies
create_policy	Create a policy (type-level or instance-level)
update_policy	Update an existing policy
get_policy	Get a policy by ID
delete_policy	Delete a policy
activate_policy	Activate a policy
deactivate_policy	Deactivate a policy
assign_policy	Assign a policy to a subject, role, or group
unassign_policy	Remove a policy assignment
list_policy_assignments	List a policy's assignments

Subject Attributes

Tool	Description
define_subject_attribute	Define a subject attribute for use in ABAC conditions

MCP Governance

Tool	Description
list_pending_tools	List agent tool calls awaiting approval
approve_tool	Approve a pending tool call
block_tool	Block a tool call

Evaluation

Tool	Description
evaluate_access	Check if a subject can perform an action on a resource

OAuth (client credentials)

For non-interactive environments, use client credentials instead of an API key:

{
  "mcpServers": {
    "vengtoo": {
      "command": "npx",
      "args": ["-y", "@vengtoo/mcp-server"],
      "env": {
        "VENGTOO_CLIENT_ID": "your-client-id",
        "VENGTOO_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

See OAuth Client Credentials for setup.