opa_patch_data
Apply a JSON Patch to the data hierarchy.
How to use it
opa_patch_data is exposed by the Opa MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the opa_patch_data tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Opa MCP Server
npx -y @orygn/opa-mcpOther tools in Opa MCP Server (39)
Build a .tar.gz bundle from a policy directory. Supports optimize and revision.
Sign a bundle with a private key. Returns .signatures.json content.
Verify the signature of a signed bundle using a public key. Returns { bundle, verified: true }.
Partially evaluate a query against the running server.
Server configuration (without secrets).
Delete a document from the data hierarchy.
Delete a policy by ID.
Batch-evaluate a decision against multiple input files. Returns per-file results with successCount and errorCount.
Read a path from the data hierarchy.
Get a single policy by ID.
Liveness / readiness check.
List policies registered on the server.
Write to a path in the data hierarchy.
Upload or replace a policy.
POST to a /v1/data/... decision endpoint with input.
Bundle / decision-log status.
Run opa bench and return statistical timing data.
Return the capabilities (built-ins, future keywords) understood by the bundled OPA.
Type-check and validate Rego. Wraps opa check.
Check Rego against a JSON Schema. Validates that every input. field the policy reads exists in the schema using opa check --schema. Accepts inline schema or a path to a JSON Schema file on disk.
Partially evaluate a query against a policy.
Run opa test --coverage and return per-file uncovered line ranges, sorted worst first. Use threshold to focus on files below a target percentage.
Static dependency analysis: rule-level data references and cross-package calls.
Summarize what a policy does, its inputs, decisions, and assumptions.
Evaluate a query against a policy and input. The bread-and-butter tool.
Evaluate with --coverage and return per-line coverage.
Evaluate with --explain=full and return a structured trace.
Evaluate with --profile and return per-rule timing and evaluation counts.
Walk through every rule that fired (and didn't) for a given query. Wraps regoevalwithexplain and produces a step-by-step natural-language trace.
Format Rego source. Wraps opa fmt. Idempotent.
Given a policy, generate a test.rego skeleton covering each rule.
Inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect.
Run Regal across a file or directory. Returns findings grouped by category. Requires regal on PATH or REGALBINARY set.
Migrate Rego v0 source to v1 syntax. Runs opa fmt --rego-v1 then validates with opa check --v1-compatible. Returns { original, migrated, changed, valid, errors }.
Parse Rego to AST JSON. Wraps opa parse.
Run regal lint restricted to security and bugs categories across a directory. Returns severity-grouped findings with remediation guidance.
For a failed regocheck or regolint, propose minimal patches.
Run opa test over a directory. Returns pass/fail per test, with optional coverage.
Run Rego tests across multiple roots. Solves OPA's package-conflict problem for repos with multiple independent namespaces. Supports explicit root lists and scan mode (auto-discovers leaf test roots).