OPA MCP

MCP server · by OrygnsCode

Developer Tools npmDocker v0.9.1

Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.

View source ↗ Website ↗ Generate config for multiple servers More servers

Install

Pin version registry version 0.9.1

npm
npx -y @orygn/opa-mcp

npm
npx -y @orygn/opa-mcp@0.9.1

Docker
docker run -i --rm docker.io/orygn/opa-mcp:0.9.1

Setup by client

Pick your client — the config below is generated for this server (local stdio). Copy respects the “Pin version” switch above.

claude_desktop_config.json

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp@0.9.1"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

Format verified against the official Claude Desktop docs ↗.

terminal

claude mcp add --env OPA_TOKEN=<YOUR_OPA_TOKEN> --env GITHUB_TOKEN=<YOUR_GITHUB_TOKEN> opa-mcp -- npx -y @orygn/opa-mcp

claude mcp add --env OPA_TOKEN=<YOUR_OPA_TOKEN> --env GITHUB_TOKEN=<YOUR_GITHUB_TOKEN> opa-mcp -- npx -y @orygn/opa-mcp@0.9.1

Format verified against the official Claude Code docs ↗.

.cursor/mcp.json

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp@0.9.1"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

Format verified against the official Cursor docs ↗.

.vscode/mcp.json

{
  "servers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

{
  "servers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp@0.9.1"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

Format verified against the official VS Code docs ↗.

mcp_config.json

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

{
  "mcpServers": {
    "opa-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp@0.9.1"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_OPA_TOKEN>",
        "GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>"
      }
    }
  }
}

Format verified against the official Windsurf docs ↗.

Environment variables

Defined in the server's official registry manifest. Required secrets are shown as <YOUR_…> placeholders in the configs above.

OPA_URL — Base URL of a running OPA server. Required only for opa_* runtime tools, not for rego_* language tools.
OPA_TOKEN secret — Bearer token for OPA running with --authentication=token.
OPA_BINARY — Path to the opa binary. Defaults to 'opa' on PATH.
REGAL_BINARY — Path to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.
CONFTEST_BINARY — Path to the conftest binary (optional, used by conftest_* tools). Defaults to 'conftest' on PATH.
OPA_MCP_ALLOWED_PATHS — Comma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.
GITHUB_TOKEN secret — GitHub personal access token with the "gist" scope. Required only for rego_playground_share.

GitHub

⭐ 8 stars · 最近更新于 23 天前 · MIT license

About this server

OPA MCP Server A Model Context Protocol (MCP) server that turns any MCP compatible client (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others) into a first class Open Policy Agent and Rego authoring environment. Status: v0.9.0. Tool surface, error codes, and environment variable…

Summary from the project README — github.com/OrygnsCode/opa-mcp-server

Distributed as npm, Docker, listed under Developer Tools. Review our MCP security guide before granting access to real data.

Frequently asked questions

What does the OPA MCP MCP server do?

How do I install OPA MCP?

Run the install command shown above, then paste the config for your client (Claude Desktop, Claude Code, Cursor, VS Code or Windsurf) into its MCP settings and restart the client.

Is OPA MCP free to use?

The MCP server itself is free to install. The source is public on https://github.com/OrygnsCode/opa-mcp-server. Any third-party service it calls may require its own API key and account.

Which clients support OPA MCP?

Any MCP-compatible client can use it, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and custom agents.

Add this badge

Publish this server? Link back with a badge on your README or site — copy either snippet.

Markdown

[![Listed on MCPNav](https://mcpnav.net/badge/opa-mcp.svg)](https://mcpnav.net/server/opa-mcp/)

HTML

<a href="https://mcpnav.net/server/opa-mcp/"><img src="https://mcpnav.net/badge/opa-mcp.svg" alt="Listed on MCPNav" height="20"></a>