OPA MCP
Turns Claude, Cursor, VS Code, or any MCP client into a full OPA Rego development environment by wrapping the OPA CLI and REST API. You get 52 tools covering policy authoring (format, parse, refactor), evaluation with explain and coverage flags, bundle building and signing, linting via Regal, and CRUD operations against a running OPA server. The rego_explain_decision tool walks through every rule that fired or didn't, answering "why was this rejected" without manual trace reading. Ships with curated resources including the built-in function catalog, the official style guide, and patterns for RBAC, Kubernetes admission, and API authorization. Runs locally over stdio with path allow-lists and subprocess timeouts. If you write Rego policies and want an agent that can debug denials or generate test skeletons without fighting opa eval's argument order, this bridges that gap.
- GitHub stars
- 8
- tools
- 9
- auth
- Secret needed
- transport
- STDIO
- env vars
- 7
- last updated
- Oct 23, 2026
Tools
9 toolsPublic tool metadata for what this MCP can expose to an agent.
rego_formatFormat Rego source. Wraps `opa fmt`. Idempotent.
Format Rego source. Wraps `opa fmt`. Idempotent.
No parameter schema in public metadata yet.
rego_checkType-check and validate Rego. Wraps `opa check`.
Type-check and validate Rego. Wraps `opa check`.
No parameter schema in public metadata yet.
rego_lintRun Regal across a file or directory. Returns each violation with its category, level and location.
Run Regal across a file or directory. Returns each violation with its category, level and location.
No parameter schema in public metadata yet.
rego_parse_astParse Rego to AST JSON. Wraps `opa parse`.
Parse Rego to AST JSON. Wraps `opa parse`.
No parameter schema in public metadata yet.
rego_inspectInspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.
Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.
No parameter schema in public metadata yet.
rego_capabilitiesList the built-ins and features the resolved `opa` binary understands.
List the built-ins and features the resolved `opa` binary understands.
No parameter schema in public metadata yet.
rego_depsStatic dependency analysis: rule-level data references and cross-package calls.
Static dependency analysis: rule-level data references and cross-package calls.
No parameter schema in public metadata yet.
rego_migrate_v1Migrate Rego v0 source to v1, renaming reserved rules and replacing removed built-ins, then validating the result.
Migrate Rego v0 source to v1, renaming reserved rules and replacing removed built-ins, then validating the result.
No parameter schema in public metadata yet.
rego_check_schemaCheck Rego against a JSON Schema, validating that every `input.*` field the policy reads exists in the schema.
Check Rego against a JSON Schema, validating that every `input.*` field the policy reads exists in the schema.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
OPA_URLdefault: http://localhost:8181Base URL of a running OPA server. Required only for opa_* runtime tools, not for rego_* language tools.
OPA_TOKENsecretBearer token for OPA running with --authentication=token.
OPA_BINARYdefault: opaPath to the opa binary. Defaults to 'opa' on PATH.
REGAL_BINARYdefault: regalPath to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.
CONFTEST_BINARYdefault: conftestPath to the conftest binary (optional, used by conftest_* tools). Defaults to 'conftest' on PATH.
OPA_MCP_ALLOWED_PATHSComma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.
GITHUB_TOKENsecretGitHub personal access token with the "gist" scope. Required only for rego_playground_share.
Readme
Details
- Repository
- github.com/orygnscode/opa-mcp-server
- Website
- orygn.tech
- Package
@orygn/opa-mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active