OPA MCP Server
A Model Context Protocol (MCP) server that turns any MCP-compatible client (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others) into a first-class Open Policy Agent and Rego authoring environment.
+--------------------+ MCP/stdio +-----------------+ spawn/HTTP +---------------------+
| Claude · Cursor · |----------> | @orygn/opa-mcp |----------> | opa · regal |
| VS Code · ... |<---------- | |<---------- | conftest · REST API |
+--------------------+ 52 tools +-----------------+ +---------------------+Status: v0.2.1. Tool surface, error codes, and environment variables follow SemVer from v0.1.0 forward.
Table of contents
- What you can do with it
- Why this MCP
- Install
- Configuration
- Tool reference
- Prompts
- Resources
- Cookbook
- Architecture
- Security
- Troubleshooting
- Development
- Versioning & support
- License
What you can do with it
Once an MCP client is connected, an agent can:
- Author Rego. Generate, format, and refactor policies. The server
runs the real
opa fmtandopa parseso output is byte-identical to what you'd get on the command line, andregal(optional) surfaces idiomatic suggestions. - Evaluate against data. Run a query against a policy and an input
document. Optional
--explain,--profile, and--coverageflags surface execution traces, hot rules, and per-line coverage. - Debug a deny.
rego_explain_decisionwalks the agent through every rule that fired (and every one that didn't), so it can answer "why was this rejected" without you reading the trace by hand. - Manage policies on a running OPA. List, get, put, delete policies on
an OPA server through its REST API. Works against a local
opa run --serveror a production deployment with bearer-token auth. - Build & sign bundles. Package a directory of policies into a
deployable bundle, optionally signing it. Output is a regular
.tar.gzthe agent can hand to your delivery system. - Lint.
rego_lintruns Regal across a directory or a single file and returns categorized findings (style, bugs, performance, idioms).
