[Security Feature]: RBAC Plugin using Cedar

MANIFEST.in

@@ -200,3 +200,12 @@ exclude plugins/external/llmguard/Containerfile
 exclude plugins/external/llmguard/MANIFEST.in
 exclude plugins/external/llmguard/pyproject.toml
 exclude plugins/external/llmguard/run-server.sh
+
+# Exclude cedar
+
+exclude plugins/external/cedar/.dockerignore
+exclude plugins/external/cedar/.env.template
+exclude plugins/external/cedar/.ruff.toml
+exclude plugins/external/cedar/Containerfile
+exclude plugins/external/cedar/MANIFEST.in
+exclude plugins/external/cedar/pyproject.toml

docs/docs/architecture/plugins.md

@@ -103,7 +103,7 @@ flowchart TB
 
     subgraph "External Services"
         AI["AI Safety Services<br>(LlamaGuard, OpenAI)"]
-        Security["Security Services<br>(Vault, OPA)"]
+        Security["Security Services<br>(Vault, OPA, Cedar)"]
     end
 
     Client --request--> GW
@@ -141,7 +141,7 @@ The framework supports two distinct plugin deployment patterns:
 - Standalone MCP servers implementing plugin logic
 - Can be written in any language (Python, TypeScript, Go, Rust, etc.)
 - Communicate via MCP protocol (Streamable HTTP, STDIO, SSE)
-- Examples: OPA filter, LlamaGuard, OpenAI Moderation, custom AI services
+- Examples: OPA filter, Cedar Policy Plugin (RBAC), LlamaGuard, OpenAI Moderation, custom AI services
 
 ### Plugin Configuration Schema
 
@@ -1721,6 +1721,7 @@ FEDERATION_POST_SYNC = "federation_post_sync"  # Post-federation processing
 #### Current Integrations
 
 - ✅ **Open Policy Agent (OPA):** Policy-as-code enforcement engine
+- ✅ **Cedar Policy Plugin:** Policy-as-code enforcement engine, RBAC
 - ✅ **LlamaGuard:** Content safety classification and filtering
 - ✅ **OpenAI Moderation API:** Commercial content moderation
 - ✅ **Custom MCP Servers:** Any language, any protocol

docs/docs/using/plugins/plugins.md

@@ -104,6 +104,7 @@ Plugins for enforcing custom policies and business rules.
 | Plugin | Type | Description |
 |--------|------|-------------|
 | [OPA Plugin](https://github.com/IBM/mcp-context-forge/tree/main/plugins/external/opa) | External | Enforces Rego policies on tool invocations via an OPA server. Allows selective policy application per tool with context injection and customizable policy endpoints |
+| [Cedar (RBAC) Plugin](https://github.com/IBM/mcp-context-forge/tree/main/plugins/external/cedar) | External | Enforces RBAC-based policies on MCP servers using Cedar (leveraging the cedarpy library) or a custom DSL, for local evaluation with flexible configuration and output redaction. |
 
 ## Plugin Types