Home › Security › OPA MCP

OPA MCP

Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.

TypeScript CloudLocal macOSWindowsLinux

★ 8 stars Last pushed 2026-11-01 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 0.9.1)

npx -y @orygn/[email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "opa-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/[email protected]"
      ],
      "env": {
        "OPA_TOKEN": "<YOUR_VALUE>",
        "GITHUB_TOKEN": "<YOUR_VALUE>"
      }
    }
  }
}

OPA_URL — Base URL of a running OPA server. Required only for opa_* runtime tools, not for rego_* language tools.
OPA_TOKEN secret — Bearer token for OPA running with --authentication=token.
OPA_BINARY — Path to the opa binary. Defaults to 'opa' on PATH.
REGAL_BINARY — Path to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.
CONFTEST_BINARY — Path to the conftest binary (optional, used by conftest_* tools). Defaults to 'conftest' on PATH.
OPA_MCP_ALLOWED_PATHS — Comma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.
GITHUB_TOKEN secret — GitHub personal access token with the "gist" scope. Required only for rego_playground_share.

Package (oci)

docker run -i --rm -e OPA_TOKEN=<YOUR_VALUE> -e GITHUB_TOKEN=<YOUR_VALUE> docker.io/orygn/opa-mcp:0.9.1

Or add to your MCP client config:

{
  "mcpServers": {
    "opa-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "OPA_TOKEN=<YOUR_VALUE>",
        "-e",
        "GITHUB_TOKEN=<YOUR_VALUE>",
        "docker.io/orygn/opa-mcp:0.9.1"
      ]
    }
  }
}

OPA_URL — Base URL of a running OPA server.
OPA_TOKEN secret — Bearer token for OPA authentication.
GITHUB_TOKEN secret — GitHub personal access token with the "gist" scope. Required only for rego_playground_share.