Opa MCP Server
UnclaimedModel Context Protocol server for Open Policy Agent (OPA). Author, validate, debug, and explain Rego policies through any MCP-compatible client.
Set up this server
01 / Choose your client
02 / Before you connect
Authentication is not specified. Check the project instructions before connecting.
Project instructions03 / Add the configuration
claude mcp add --transport stdio 'opa-mcp-server' -- 'npx' '-y' '@orygn/opa-mcp'04 / Check it in your client
Open your client’s MCP settings and confirm the server connects and lists its tools. A copied configuration does not confirm a working connection.
More in AI & ML
Browse the full directoryUnclaimed listing
Is this your MCP server?
This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.
Claim this serverSecurity profile
Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works
40 of 40 tools
Documented tools (40)
From project documentation. A server handshake does not verify each tool’s description or behavior.
opa_bundle_build
Build a .tar.gz bundle from a policy directory. Supports optimize and revision.
opa_bundle_sign
Sign a bundle with a private key. Returns .signatures.json content.
opa_bundle_verify
Verify the signature of a signed bundle using a public key. Returns { bundle, verified: true }.
opa_compile_query
Partially evaluate a query against the running server.
opa_config
Server configuration (without secrets).
opa_delete_data
Delete a document from the data hierarchy.
opa_delete_policy
Delete a policy by ID.
opa_exec
Batch-evaluate a decision against multiple input files. Returns per-file results with successCount and errorCount.
opa_get_data
Read a path from the data hierarchy.
opa_get_policy
Get a single policy by ID.
opa_health
Liveness / readiness check.
opa_list_policies
List policies registered on the server.
opa_patch_data
Apply a JSON Patch to the data hierarchy.
opa_put_data
Write to a path in the data hierarchy.
opa_put_policy
Upload or replace a policy.
opa_query_decision
POST to a /v1/data/... decision endpoint with input.
opa_status
Bundle / decision-log status.
rego_bench
Run opa bench and return statistical timing data.
rego_capabilities
Return the capabilities (built-ins, future keywords) understood by the bundled OPA.
rego_check
Type-check and validate Rego. Wraps opa check.
rego_check_schema
Check Rego against a JSON Schema. Validates that every input. field the policy reads exists in the schema using opa check --schema. Accepts inline schema or a path to a JSON Schema file on disk.
rego_compile_query
Partially evaluate a query against a policy.
rego_coverage_gaps
Run opa test --coverage and return per-file uncovered line ranges, sorted worst first. Use threshold to focus on files below a target percentage.
rego_deps
Static dependency analysis: rule-level data references and cross-package calls.
rego_describe_policy
Summarize what a policy does, its inputs, decisions, and assumptions.
rego_eval
Evaluate a query against a policy and input. The bread-and-butter tool.
rego_eval_with_coverage
Evaluate with --coverage and return per-line coverage.
rego_eval_with_explain
Evaluate with --explain=full and return a structured trace.
rego_eval_with_profile
Evaluate with --profile and return per-rule timing and evaluation counts.
rego_explain_decision
Walk through every rule that fired (and didn't) for a given query. Wraps regoevalwithexplain and produces a step-by-step natural-language trace.
rego_format
Format Rego source. Wraps opa fmt. Idempotent.
rego_generate_test_skeleton
Given a policy, generate a test.rego skeleton covering each rule.
rego_inspect
Inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect.
rego_lint
Run Regal across a file or directory. Returns findings grouped by category. Requires regal on PATH or REGALBINARY set.
rego_migrate_v1
Migrate Rego v0 source to v1 syntax. Runs opa fmt --rego-v1 then validates with opa check --v1-compatible. Returns { original, migrated, changed, valid, errors }.
rego_parse_ast
Parse Rego to AST JSON. Wraps opa parse.
rego_security_audit
Run regal lint restricted to security and bugs categories across a directory. Returns severity-grouped findings with remediation guidance.
rego_suggest_fix
For a failed regocheck or regolint, propose minimal patches.
rego_test
Run opa test over a directory. Returns pass/fail per test, with optional coverage.
rego_test_multiroot
Run Rego tests across multiple roots. Solves OPA's package-conflict problem for repos with multiple independent namespaces. Supports explicit root lists and scan mode (auto-discovers leaf test roots).
Tool change history
FAQ
Questions about Opa MCP Server
- How do I connect Opa MCP Server to Claude?
- Run `claude mcp add opa-mcp-server -- npx -y @orygn/opa-mcp` in Claude Code, or add the same command and arguments under mcpServers in Cursor's mcp.json or Claude Desktop's claude_desktop_config.json, then restart the client. The blocks above are ready to paste.
- Is Opa MCP Server free?
- The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
- What can Opa MCP Server do?
- Opa MCP Server documents 40 tools to the agent, including opa_bundle_build, opa_bundle_sign, opa_bundle_verify. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.