> ## Documentation Index
> Fetch the complete documentation index at: https://backstage.spotify.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Actions

> Let AI assistants view, draft, and publish RBAC policies for you.

The RBAC plugin provides MCP actions that let AI assistants, such as AiKA, Claude, or Cursor, work with your RBAC policies. You can ask an assistant to explain who has access to what, draft a change to a policy, or publish a draft you've reviewed.

> [!NOTE]
>
> RBAC MCP actions require `@spotify/backstage-plugin-rbac-backend` version
> `0.10.0` or later.

## Available actions

| Action | What it does |
| - | - |
| `list-rbac-policies` | Lists all your policies, with each one's status and how many roles and permissions it has. |
| `read-rbac-policy` | Shows the roles, members, and permissions in a policy. By default it shows the active policy, but it can also show the draft or any other policy. |
| `save-rbac-policy-draft` | Creates a draft policy, or updates the existing draft. Drafts have no effect until you publish them. |
| `publish-rbac-policy` | Publishes the draft and makes it the active policy. |

> [!WARNING]
>
> Publishing a policy changes what people can do in Backstage right away. Review
> a draft in the RBAC UI before you ask an assistant to publish it.

## Who can use the actions

Only RBAC administrators can use these actions. These are the same people who can manage policies in the RBAC UI. See [Configure RBAC administrator users](https://backstage.spotify.com/docs/plugins/rbac/setup-and-installation.md#configure-rbac-administrator-users).

## Turn on the actions

To make the actions available in your Backstage instance:

1. Make sure the MCP Actions Backend is installed. If AI assistants can already use other Backstage tools in your instance, such as catalog or Soundcheck tools, it's installed. Otherwise, see the [MCP overview](https://backstage.spotify.com/docs/portal/core-features-and-plugins/mcp/overview).

2. Add `rbac` to the list of plugins that share actions in your `app-config.yaml`:

   ```yaml app-config.yaml theme={"theme":{"light":"github-light","dark":"dracula"}}
   backend:
     actions:
       pluginSources:
         - rbac
   ```

3. Restart Backstage. The RBAC actions now appear alongside your other MCP tools.