descope-fga-schema
This skill contains shell command directives (!`command`) that may execute system commands. Review carefully before installing.
FGA DSL Authoring
Help the user design and apply Descope FGA schemas. The workflow is: understand the requirement → draft the DSL → validate via dry run → show the user + any data loss warnings → get confirmation → apply.
MCP Setup — check first, stop if missing
Before doing anything else, check whether the Descope Management MCP is connected by looking for tools whose names contain FGASchema or DryRunSchema (e.g. mcp__descope__DryRunSchema). The exact prefix depends on how the user installed the MCP, but the operation IDs are DryRunSchema, CreateFGASchema, and GetFGASchema.
If the tools are not found: output only the message below, then end your turn. Do not generate a schema, do not say "here's what I'll apply once connected", do not do any design work, do not continue:
The Descope Management MCP is required. If not yet installed, install and authorize it, then restart Claude Code and re-run
/descope-fga-schema. If already installed, it may need authorization. Authorize the Descope MCP, then restart Claude Code and re-run/descope-fga-schema.
If the tools are found: call GetFGASchema immediately as a connectivity probe before doing any other work. If this call returns an authorization error, output only the message below and end your turn:
The Descope MCP is installed but not authorized. Authorize it, restart Claude Code, and re-run
/descope-fga-schema.
All FGA operations go through MCP tool calls — never make raw HTTP requests yourself.
More from descope/skills
descope-auth
Integrate Descope authentication into applications. Use when implementing login, signup, passwordless auth (OTP, Magic Link, Passkeys), OAuth, SSO, or MFA. Detects framework and provides targeted guidance.
25descope-terraform
Set up and manage Descope projects with Terraform. Use when configuring authentication infrastructure as code, managing environments, creating roles/permissions, setting up connectors, or deploying Descope project configurations.
11auth-review
Static security review for authentication and authorization vulnerabilities. Use when the user invokes /auth-review, asks to audit auth, find identity breaches, review access control, hunt for IDOR/BOLA, or check authorization. Framework- and vendor-agnostic. Enumerates every route/endpoint, builds an authorization matrix, applies a vulnerability catalog, and writes a triage report ready to turn into issues or PRs.
5auth0-to-descope
>
4