Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.
Connect Runs on your machine
claude mcp add opa-mcp -e OPA_URL=<OPA_URL> -e OPA_TOKEN=<OPA_TOKEN> -e OPA_BINARY=<OPA_BINARY> -e REGAL_BINARY=<REGAL_BINARY> -e CONFTEST_BINARY=<CONFTEST_BINARY> -e OPA_MCP_ALLOWED_PATHS=<OPA_MCP_ALLOWED_PATHS> -e GITHUB_TOKEN=<GITHUB_TOKEN> -- npx -y @orygn/[email protected]{
"mcpServers": {
"opa-mcp": {
"command": "npx",
"args": [
"-y",
"@orygn/[email protected]"
],
"env": {
"OPA_URL": "<OPA_URL>",
"OPA_TOKEN": "<OPA_TOKEN>",
"OPA_BINARY": "<OPA_BINARY>",
"REGAL_BINARY": "<REGAL_BINARY>",
"CONFTEST_BINARY": "<CONFTEST_BINARY>",
"OPA_MCP_ALLOWED_PATHS": "<OPA_MCP_ALLOWED_PATHS>",
"GITHUB_TOKEN": "<GITHUB_TOKEN>"
}
}
}
}{
"mcpServers": {
"opa-mcp": {
"command": "npx",
"args": [
"-y",
"@orygn/[email protected]"
],
"env": {
"OPA_URL": "<OPA_URL>",
"OPA_TOKEN": "<OPA_TOKEN>",
"OPA_BINARY": "<OPA_BINARY>",
"REGAL_BINARY": "<REGAL_BINARY>",
"CONFTEST_BINARY": "<CONFTEST_BINARY>",
"OPA_MCP_ALLOWED_PATHS": "<OPA_MCP_ALLOWED_PATHS>",
"GITHUB_TOKEN": "<GITHUB_TOKEN>"
}
}
}
}{
"servers": {
"opa-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@orygn/[email protected]"
],
"env": {
"OPA_URL": "<OPA_URL>",
"OPA_TOKEN": "<OPA_TOKEN>",
"OPA_BINARY": "<OPA_BINARY>",
"REGAL_BINARY": "<REGAL_BINARY>",
"CONFTEST_BINARY": "<CONFTEST_BINARY>",
"OPA_MCP_ALLOWED_PATHS": "<OPA_MCP_ALLOWED_PATHS>",
"GITHUB_TOKEN": "<GITHUB_TOKEN>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
OPA_URLOptional | Base URL of a running OPA server. Required only for opa_* runtime tools, not for rego_* language tools. |
OPA_TOKENOptional, secret | Bearer token for OPA running with --authentication=token. |
OPA_BINARYOptional | Path to the opa binary. Defaults to 'opa' on PATH. |
REGAL_BINARYOptional | Path to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH. |
CONFTEST_BINARYOptional | Path to the conftest binary (optional, used by conftest_* tools). Defaults to 'conftest' on PATH. |
OPA_MCP_ALLOWED_PATHSOptional | Comma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk. |
GITHUB_TOKENOptional, secret | GitHub personal access token with the "gist" scope. Required only for rego_playground_share. |
Details
| Package | @orygn/[email protected] (NPM, stdio) |
| Package | docker.io/orygn/opa-mcp:0.9.1 (OCI, stdio) |
| First published | 23 Oct 2026 |
| Last updated | 23 Oct 2026 |
| Registry name | io.github.OrygnsCode/opa-mcp |
More developer tools servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.