MCP Actions - Spotify for Backstage

The RBAC plugin provides MCP actions that let AI assistants, such as AiKA, Claude, or Cursor, work with your RBAC policies. You can ask an assistant to explain who has access to what, draft a change to a policy, or publish a draft you’ve reviewed.

RBAC MCP actions require @spotify/backstage-plugin-rbac-backend version 0.10.0 or later.

Available actions

Action	What it does
`list-rbac-policies`	Lists all your policies, with each one’s status and how many roles and permissions it has.
`read-rbac-policy`	Shows the roles, members, and permissions in a policy. By default it shows the active policy, but it can also show the draft or any other policy.
`save-rbac-policy-draft`	Creates a draft policy, or updates the existing draft. Drafts have no effect until you publish them.
`publish-rbac-policy`	Publishes the draft and makes it the active policy.

Publishing a policy changes what people can do in Backstage right away. Review a draft in the RBAC UI before you ask an assistant to publish it.

Who can use the actions

Only RBAC administrators can use these actions. These are the same people who can manage policies in the RBAC UI. See Configure RBAC administrator users.

Turn on the actions

To make the actions available in your Backstage instance:

Make sure the MCP Actions Backend is installed. If AI assistants can already use other Backstage tools in your instance, such as catalog or Soundcheck tools, it’s installed. Otherwise, see the MCP overview.
Add rbac to the list of plugins that share actions in your app-config.yaml:
app-config.yaml
backend: actions: pluginSources: - rbac
Restart Backstage. The RBAC actions now appear alongside your other MCP tools.