Authorizer: Open-source authentication and authorization for your apps
Open-source Authorizer adds login, fine-grained permissions, and a local MCP check for AI agents.
Authorizer is a free, self-hosted Go server for application sign-in and access control, with accounts stored in a database the operator chooses. It supports passwords, magic links, passkeys, social login, one-time MFA codes, and SSO through SAML 2.0 and OpenID Connect, and works with PostgreSQL, MySQL, MongoDB, DynamoDB, and other databases. Fine-grained permissions use embedded OpenFGA relationship records. A local, stdio-only MCP interface exposes read-only profile and permission checks so an agent acting for a user receives only the overlap of both permission sets, including filtering vector-search hits before scoring.
- Self-hosted Go server handles login, SSO, and fine-grained authorization.
- Embedded OpenFGA stores access as user-to-resource relationships.
- A local stdio MCP server exposes three read-only permission checks.
- Vector-search results can be limited to documents the user may see.
Full article329 words · extracted from helpnetsecurity.com · click to collapse
Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface for AI agents into the same Go program that logs users in, so a chatbot can ask whether a user may see a document before it fetches that document.
This affects any team that connects an AI assistant to company files. A vector search, which is the lookup that finds text similar to a question, returns close matches without checking who asked. Authorizer gives the search a list of documents the user is allowed to see, and everything else is dropped before it is scored.
Authorizer covers the usual login options: email and password, magic links, passkeys, social login through 10 providers, and one-time codes for multifactor authentication. It also supports single sign-on through SAML 2.0 and OpenID Connect, the protocols corporate identity systems such as Okta use. The server works with 13 or more databases, including PostgreSQL, MySQL, MongoDB and DynamoDB.
For detailed permissions, the server embeds OpenFGA, an open-source take on Google’s Zanzibar system. OpenFGA records access as relationships, such as a given user being able to view a given file. The built-in MCP server, which is the interface tools like Claude Code and Cursor use to call outside services, exposes three read-only functions: profile, check_permissions and list_permissions. The maintainers say it runs only over local stdio and cannot be reached over a network. They also say an agent acting for a user gets only the overlap of its own permissions and that user’s.
Authorizer is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!