mcp-authz-spicedb-demo

MCP server that uses AuthZed Cloud (SpiceDB) to authorize every tool call before execution.

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│                  │     │                  │     │                  │
│   MCP Client     │────▶│   MCP Server     │────▶│  AuthZed Cloud   │
│  (Claude, etc.)  │     │  (this demo)     │     │  (SpiceDB)       │
│                  │◀────│                  │◀────│                  │
└──────────────────┘     └──────────────────┘     └──────────────────┘
                               │
                               ▼
                         ┌──────────────┐
                         │  In-Memory   │
                         │  Document &  │
                         │  Refund      │
                         │  Store       │
                         └──────────────┘

Every tool call follows this flow:

1. MCP client sends tool call (e.g., read_document("q1-report") as user alice)
2. MCP server extracts: user, action, resource
3. Server calls AuthZed Cloud: CheckPermission(user:alice, read, document:q1-report)
4. If ALLOWED → execute tool, return result
5. If DENIED → return insufficient_scope error

• Deny-by-default — no tool executes without an explicit SpiceDB permission grant
• ReBAC, not RBAC — team membership flows through the permission graph
• Separation of concerns — MCP server handles tool execution; SpiceDB handles authorization

definition user {}

definition team {
    relation member: user
}

definition document {
    relation owner: user
    relation editor: user | team#member
    relation viewer: user | team#member

    permission read = owner + editor + viewer
    permission write = owner + editor
}

definition refund {
    relation approver: user

    permission approve = approver
}

| Tool | Description | SpiceDB