diff --git a/src/BuildFlow.Host/Endpoints/platform/Permissions/GetPermissionTreeEndpoint.cs b/src/BuildFlow.Host/Endpoints/platform/Permissions/GetPermissionTreeEndpoint.cs
new file mode 100644
index 0000000..e5533b2
--- /dev/null
+++ b/src/BuildFlow.Host/Endpoints/platform/Permissions/GetPermissionTreeEndpoint.cs
@@ -0,0 +1,25 @@
+using BuildFlow.Platform.Application.Permissions.DTOs;
+using BuildFlow.Platform.Application.Permissions.Queries;
+using MediatR;
+
+namespace BuildFlow.Host.Endpoints.rag.Permissions;
+
+/// <summary>
+/// 获取权限分组树。按 Group 聚合，供管理端树形表格展示。
+/// 需 permission:read 权限——权限码本身是敏感信息，仅授权用户可见。
+/// </summary>
+public class GetPermissionTreeEndpoint(IMediator mediator)
+    : EndpointWithoutRequest<List<PermissionGroupNodeDto>>
+{
+    public override void Configure()
+    {
+        Get("/permission/tree");
+        Permissions("permission:read");
+    }
+
+    public override async Task HandleAsync(CancellationToken ct)
+    {
+        var tree = await mediator.Send(new GetPermissionTreeQuery(), ct);
+        await Send.OkAsync(tree, ct);
+    }
+}
diff --git a/src/modules/platform/Application/Permissions/DTOs/PermissionGroupNodeDto.cs b/src/modules/platform/Application/Permissions/DTOs/PermissionGroupNodeDto.cs
new file mode 100644
index 0000000..1b94ea1
--- /dev/null
+++ b/src/modules/platform/Application/Permissions/DTOs/PermissionGroupNodeDto.cs
@@ -0,0 +1,15 @@
+namespace BuildFlow.Platform.Application.Permissions.DTOs;
+
+/// <summary>
+/// 权限分组树节点。按 Group 字段聚合，供管理端树形表格展示。
+/// 第一层为分组，其下 Children 为该分组内的权限。
+/// Group 为空的权限归入“未分组”。
+/// </summary>
+public record PermissionGroupNodeDto
+{
+    /// <summary>分组名称（为空时归入“未分组”）。</summary>
+    public required string Group { get; init; }
+
+    /// <summary>该分组下的权限列表。</summary>
+    public List<PermissionDto> Permissions { get; init; } = [];
+}
diff --git a/src/modules/platform/Application/Permissions/Handlers/GetPermissionTreeQueryHandler.cs b/src/modules/platform/Application/Permissions/Handlers/GetPermissionTreeQueryHandler.cs
new file mode 100644
index 0000000..56096b1
--- /dev/null
+++ b/src/modules/platform/Application/Permissions/Handlers/GetPermissionTreeQueryHandler.cs
@@ -0,0 +1,37 @@
+using MediatR;
+using BuildFlow.Platform.Application.Permissions.DTOs;
+using BuildFlow.Platform.Infrastructure.Persistence;
+using BuildFlow.Platform.Application.Permissions.Queries;
+
+namespace BuildFlow.Platform.Application.Permissions.Handlers;
+
+/// <summary>
+/// 权限分组树查询处理器。按 Group 聚合，一次查询后在内存分组，避免多次往返。
+/// Group 为空的统一归入“未分组”，便于管理端一并展示。
+/// </summary>
+public class GetPermissionTreeQueryHandler(PlatformDbContext db)
+    : IRequestHandler<GetPermissionTreeQuery, List<PermissionGroupNodeDto>>
+{
+    public async Task<List<PermissionGroupNodeDto>> Handle(
+        GetPermissionTreeQuery request,
+        CancellationToken ct)
+    {
+        // 一次查出全部权限，避免按分组逐组查询造成 N 次往返。
+        var permissions = await db.Permissions
+            .OrderBy(p => p.Group)
+            .ThenBy(p => p.Code)
+            .Select(p => new PermissionDto(p.Id, p.Name, p.Code, p.Description, p.Group))
+            .ToListAsync(ct);
+
+        // 按 Group 聚合；null/空 Group 统一归入“未分组”。
+        return permissions
+            .GroupBy(p => string.IsNullOrWhiteSpace(p.Group) ? "未分组" : p.Group!)
+            .OrderBy(g => g.Key)
+            .Select(g => new PermissionGroupNodeDto
+            {
+                Group = g.Key,
+                Permissions = g.ToList(),
+            })
+            .ToList();
+    }
+}
diff --git a/src/modules/platform/Application/Permissions/Queries/GetPermissionTreeQuery.cs b/src/modules/platform/Application/Permissions/Queries/GetPermissionTreeQuery.cs
new file mode 100644
index 0000000..306eb92
--- /dev/null
+++ b/src/modules/platform/Application/Permissions/Queries/GetPermissionTreeQuery.cs
@@ -0,0 +1,9 @@
+using MediatR;
+using BuildFlow.Platform.Application.Permissions.DTOs;
+
+namespace BuildFlow.Platform.Application.Permissions.Queries;
+
+/// <summary>
+/// 查询权限分组树。按 Group 聚合返回树结构，供管理端树形展示。
+/// </summary>
+public record GetPermissionTreeQuery : IRequest<List<PermissionGroupNodeDto>>;