Qdrant RBAC — Claude Code MCP server: role-based access
Turns an OIDC token into a scoped Qdrant JWT, so each user only reaches the collections and documents their role allows.
Open on GitHubWhat Qdrant RBAC does
This FastMCP server sits between your MCP client and Qdrant, speaking streamable HTTP. Every request arrives with an OIDC bearer token, which the middleware checks against the provider's JWKS: signature, expiry, audience, issuer. Only RS256, RS384, RS512, ES256, ES384 and ES512 pass; the algorithm comes from the signing key, never from the token header, so HS* and none are refused. Roles are collected from realm_access.roles and from resource_access.<client>.roles.
From there JWTBuilder mints a Qdrant token for that user. A member of RBAC_ADMIN_ROLE gets global-manage straight away. Everyone else goes through AclResolver, which reads the role -> [grants] map out of the ACL collection — _rbac_acl by default. Grants live as points inside Qdrant rather than in config files, so admins change them at runtime with MCP tools. Each point id is uuid5(role, collection), which makes re-granting idempotent.
Access can go finer than the collection. An optional doc_policy on a grant restricts which points a role sees; the server turns it into a payload filter and adds it as a must clause on search_collection, search_collection_by_text, scroll_collection and list_documents, keeping any caller-supplied query_filter in place. Grants without a policy expose the whole collection. The reserved acl_tags field marks documents that need this control — leave it off and a document stays invisible under default-deny.
What it helps with
- give an analyst read-only access to a single collection
- hide confidential documents from part of the team
- change grants without editing configs or restarting
- validate OIDC tokens before touching the vector store
- merge permissions when one user holds several roles
Example prompts for the agent
- Grant role data-scientist rw access on collection embeddings_v2
- Show which documents my role can see in embeddings_v2
- Add a doc_policy to the support role grant that denies on acl_tags
How to install Qdrant RBAC
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Qdrant RBAC
How do I install Qdrant RBAC in Claude Code?
There is no install command for Claude. Run the server with Docker: `docker run --rm -p 8000:8000 -e OIDC_ISSUER_URL=... -e OIDC_AUDIENCE=mcp-server -e QDRANT_URL=http://qdrant:6333 -e QDRANT_JWT_SECRET=<secret> ghcr.io/fidonis/qdrant-mcp-rbac:latest, then point your client at the /mcp` endpoint.
What does Qdrant RBAC do?
It validates the caller's OIDC token and derives a Qdrant JWT carrying that user's role grants. The same MCP tool call then returns different results depending on who made it.
Which signing algorithms does it accept?
RS256, RS384, RS512, ES256, ES384 and ES512 only. The algorithm is taken from the signing key rather than the token header, so HS* and none tokens are rejected.
