Agent skills

This documentation is for an as-yet unreleased version of Cerbos PDP. Choose 0.56.0 from the version picker at the top right or navigate to https://docs.cerbos.dev for the latest version.

The Cerbos agent skills let you use an AI coding agent such as Claude Code, Cursor, or Codex to build authorization with Cerbos. With the skills installed, you can describe who should be able to do what in your application, and the agent turns that into Cerbos policies, policy tests, and the calls from your code to the PDP.

The skills give the agent the Cerbos policy schema, CLI commands, SDK APIs, and Cerbos Hub workflows. The cerbos-policy skill directs the agent to write tests for the policies it changes and run them with cerbos compile before it reports the change.

Install the skills

Install the skills into your project with the skills CLI, which works with Claude Code, Cursor, Codex, OpenCode, and other agents. It asks which of your agents to install the skills for.

npx skills add cerbos/skills

Use these options to change what the CLI installs:

# List the skills without installing them
npx skills add cerbos/skills --list

# Install one skill
npx skills add cerbos/skills --skill cerbos-policy

# Install for specific agents
npx skills add cerbos/skills -a cursor -a claude-code

# Install for your user account instead of the project
npx skills add cerbos/skills -g

To update skills installed this way, run npx skills update.

The cerbos-policy skill runs the cerbos CLI, or the Cerbos container image when the CLI is not installed.

Install as a plugin

The skills are also published as the cerbos-skills plugin, which your agent’s plugin manager installs and updates.

  • Claude Code

  • Codex

  • GitHub Copilot CLI

  • Cursor

  • Gemini CLI

  • Grok

claude plugin marketplace add cerbos/skills
claude plugin install cerbos-skills@cerbos-skills

To update, run claude plugin marketplace update cerbos-skills.

codex plugin marketplace add cerbos/skills
codex plugin add cerbos-skills@cerbos-skills

To update, run codex plugin marketplace upgrade cerbos-skills.

copilot plugin marketplace add cerbos/skills
copilot plugin install cerbos-skills@cerbos-skills

To update, run copilot plugin update cerbos-skills.

Clone the repository into the Cursor local plugin directory, then run Developer: Reload Window:

git clone --depth 1 https://github.com/cerbos/skills ~/.cursor/plugins/local/cerbos-skills

To update, run git -C ~/.cursor/plugins/local/cerbos-skills pull and reload the window.

gemini extensions install https://github.com/cerbos/skills

To update, run gemini extensions update cerbos-skills.

grok plugin install cerbos/skills --trust

To add the plugin to a Cursor team marketplace or to Claude Cowork, follow the steps in the repository README.

Use the skills

Describe the access rule or task in your own words. The agent selects the matching skill, even when the request does not name Cerbos. For example:

  • "Only the owner of a document or an admin in the same tenant can edit it."

  • "Filter the invoices list to the ones the current user can see."

  • "Replace the role checks in our Express middleware with Cerbos."

  • "Deploy our policies to Cerbos Hub and connect the PDP in staging."

Available skills

The cerbos skill chooses the Cerbos components for a requirement and hands off to the other skills. To install only some of them, use the --skill option.

Skill Use it to

cerbos

Decide which Cerbos components fit a requirement: the PDP, Cerbos Hub, Cerbos Synapse, an embedded PDP, or an SDK.

cerbos-policy

Write resource policies, role policies, derived roles, and CEL conditions, with policy tests that cover them.

cerbos-pep-integration

Add authorization checks to your application and to AI agent or MCP tool calls with a Cerbos SDK, pass JWT data to the PDP, and filter database queries with PlanResources.

cerbos-hub-setup

Create Cerbos Hub policy stores and deployments, issue client credentials, and connect your PDPs.

cerbos-embedded-pdp

Run authorization checks in browsers, edge functions, serverless functions, and React Native apps with an embedded PDP.

cerbos-audit-insights

Turn on audit logging, mask sensitive fields, send decision logs to Cerbos Hub, and use Insights.

cerbos-synapse-extension

Build Synapse call mappers, data sources, and proxy, route, and Envoy ext_authz extensions.

cerbos-authz-migration

Move permission checks out of your application code, or off another authorization system, into Cerbos policies.

Project pointer in AGENTS.md

After Cerbos is set up in your project, the agent offers to add a short pointer to your AGENTS.md or CLAUDE.md, or to create AGENTS.md if neither exists. The pointer names your policy directory, so later agent sessions make authorization changes in your Cerbos policies instead of in application code. The agent adds the pointer only if you accept, and skips this step if the file already has one.

Commands and permissions

The skills contain no hooks, MCP servers, or background processes, and send no data to Cerbos. They direct the agent to run commands in your project, such as cerbos compile to test policies and cerbosctl to manage a Cerbos Hub policy store. The cerbos-hub-setup skill uploads your policy files to your own Cerbos Hub policy store.

The agent asks for approval before it runs a command, unless the active skill pre-approves it. The cerbos-policy skill pre-approves only cerbos compile and version checks. The cerbos-hub-setup skill pre-approves all shell commands, because it runs Docker, cerbos, and cerbosctl. The repository README lists what each skill runs and pre-approves.