NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

Mcp Opa Authz

io.github.kanywst/mcp-opa-authz ยท v0.6.2

Authorization answers from real policy code: evaluate Rego locally, or ask an AuthZEN 1.0 PDP.

Website Source code Set it up

Connect Runs on your machine

Terminal
claude mcp add mcp-opa-authz -e AUTHZEN_PDP_URL=<AUTHZEN_PDP_URL> -e AUTHZEN_PDP_TOKEN=<AUTHZEN_PDP_TOKEN> -e AUTHZEN_PDP_TIMEOUT=<AUTHZEN_PDP_TIMEOUT> -e MCP_OPA_EVAL_TIMEOUT=<MCP_OPA_EVAL_TIMEOUT> -e MCP_OPA_ALLOW_NETWORK_BUILTINS=<MCP_OPA_ALLOW_NETWORK_BUILTINS> -- docker run -i --rm ghcr.io/kanywst/mcp-opa-authz:0.6.2
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "mcp-opa-authz": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
AUTHZEN_PDP_URL
Optional		Default AuthZEN Access Evaluation endpoint, e.g. https://pdp.example.com/access/v1/evaluation. Only evaluate_policy works without it.
AUTHZEN_PDP_TOKEN
Optional, secret		Authorization header value for the PDP. A value with no scheme is sent as "Bearer <token>".
AUTHZEN_PDP_TIMEOUT
Optional		Per-request timeout for PDP calls, as a Go duration. Default 10s.
MCP_OPA_EVAL_TIMEOUT
Optional		Wall-clock limit on a single Rego evaluation, as a Go duration. Default 5s.
MCP_OPA_ALLOW_NETWORK_BUILTINS
Optional		Re-enable http.send, net.lookup_ip_addr and opa.runtime inside evaluated policies. Off by default: policy source evaluated here comes from a model and runs inside the server process.

Details

Packageghcr.io/kanywst/mcp-opa-authz:0.6.2 (OCI, stdio)
First published25 Oct 2026
Last updated25 Oct 2026
Registry nameio.github.kanywst/mcp-opa-authz

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.