OPA MCP Server

Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.

Local serverstdio

What is the OPA MCP Server?

OPA MCP is an MCP integration. Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.

Packages and local setup

The published npm package is @orygn/opa-mcp, version 0.9.0. Its declared MCP transport is stdio.

The package declares OPA_URL: Base URL of a running OPA server. Required only for opa_ runtime tools, not for rego_ language tools.; OPA_TOKEN: Bearer token for OPA running with --authentication=token.; OPA_BINARY: Path to the opa binary. Defaults to 'opa' on PATH.; REGAL_BINARY: Path to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.; CONFTEST_BINARY: Path to the conftest binary (optional, used by conftest_ tools). Defaults to 'conftest' on PATH.; OPA_MCP_ALLOWED_PATHS: Comma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.; GITHUB_TOKEN: GitHub personal access token with the "gist" scope. Required only for rego_playground_share..

The published oci package is docker.io/orygn/opa-mcp:0.9.0. Its declared MCP transport is stdio.

The package declares OPA_URL: Base URL of a running OPA server.; OPA_TOKEN: Bearer token for OPA authentication.; GITHUB_TOKEN: GitHub personal access token with the "gist" scope. Required only for rego_playground_share..

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry · Project repository · Project website. This profile uses version 0.9.0 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related other integrations MCP servers for tools that cover the same kind of work.

Configuration

VariableDescriptionRequired
OPA_URLBase URL of a running OPA server. Required only for opa_ runtime tools, not for rego_ language tools.Optional
OPA_TOKENBearer token for OPA running with --authentication=token.Optional
OPA_BINARYPath to the opa binary. Defaults to 'opa' on PATH.Optional
REGAL_BINARYPath to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.Optional
CONFTEST_BINARYPath to the conftest binary (optional, used by conftest_ tools). Defaults to 'conftest' on PATH.Optional
OPA_MCP_ALLOWED_PATHSComma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.Optional
GITHUB_TOKENGitHub personal access token with the "gist" scope. Required only for rego_playground_share.Optional