OPA MCP — Claude Code MCP server: Rego and setup
This MCP server brings OPA and Rego tools into an AI client for policy authoring, evaluation, linting, and decision debugging.
claude mcp add --env OPA_URL=<OPA_URL> --env OPA_TOKEN=<OPA_TOKEN> --env OPA_BINARY=<OPA_BINARY> --env REGAL_BINARY=<REGAL_BINARY> --env CONFTEST_BINARY=<CONFTEST_BINARY> --transport stdio opa-mcp -- npx -y @orygn/opa-mcpWhat OPA MCP does
OPA MCP exposes structured operations for Rego instead of making an agent parse free-form command output. It can format and parse policies with opa, evaluate queries against input data, and return traces, profiles, or coverage. A decision helper walks through rules that accepted or rejected a request.
The server can run regal linting, manage policies on a live OPA instance through its REST API, create .tar.gz bundles, and generate test skeletons. Installation uses npx with @orygn/opa-mcp. Node.js 22 or later is required when the bundled OPA is used.
What it helps with
- author and format Rego policies
- evaluate a query against policy data
- trace the rules behind a denied decision
- lint one file or a policy directory with
regal - package policies as a
.tar.gzbundle
Example prompts for the agent
- Check this Rego policy and explain why the request is denied.
- Evaluate the query with execution tracing and line coverage.
- Build a
.tar.gzbundle from the policies in this directory.
How to install OPA MCP
Platform CLI
claude mcp add --env OPA_URL=<OPA_URL> --env OPA_TOKEN=<OPA_TOKEN> --env OPA_BINARY=<OPA_BINARY> --env REGAL_BINARY=<REGAL_BINARY> --env CONFTEST_BINARY=<CONFTEST_BINARY> --transport stdio opa-mcp -- npx -y @orygn/opa-mcpReplace <…> with your own values. 2 more environment variables are in the server README
Platform CLI
codex mcp add opa-mcp --env OPA_URL=<OPA_URL> --env OPA_TOKEN=<OPA_TOKEN> --env OPA_BINARY=<OPA_BINARY> --env REGAL_BINARY=<REGAL_BINARY> --env CONFTEST_BINARY=<CONFTEST_BINARY> -- npx -y @orygn/opa-mcpReplace <…> with your own values. 2 more environment variables are in the server README
Config file
{
"mcpServers": {
"opa-mcp": {
"command": "npx",
"args": [
"-y",
"@orygn/opa-mcp"
],
"env": {
"OPA_URL": "<OPA_URL>",
"OPA_TOKEN": "<OPA_TOKEN>",
"OPA_BINARY": "<OPA_BINARY>",
"REGAL_BINARY": "<REGAL_BINARY>",
"CONFTEST_BINARY": "<CONFTEST_BINARY>"
}
}
}
}Replace <…> with your own values. 2 more environment variables are in the server README
Config file
{
"servers": {
"opa-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@orygn/opa-mcp"
],
"env": {
"OPA_URL": "<OPA_URL>",
"OPA_TOKEN": "<OPA_TOKEN>",
"OPA_BINARY": "<OPA_BINARY>",
"REGAL_BINARY": "<REGAL_BINARY>",
"CONFTEST_BINARY": "<CONFTEST_BINARY>"
}
}
}
}Replace <…> with your own values. 2 more environment variables are in the server README
Platform CLI
gemini mcp add -e OPA_URL=<OPA_URL> -e OPA_TOKEN=<OPA_TOKEN> -e OPA_BINARY=<OPA_BINARY> -e REGAL_BINARY=<REGAL_BINARY> -e CONFTEST_BINARY=<CONFTEST_BINARY> opa-mcp npx -y @orygn/opa-mcpReplace <…> with your own values. 2 more environment variables are in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about OPA MCP
How do I install OPA MCP in Claude Code?
Run claude mcp add opa-mcp -e OPA_TOKEN=<OPA_TOKEN> -e GITHUB_TOKEN=<GITHUB_TOKEN> -- npx -y @orygn/opa-mcp.
What does OPA MCP do?
It gives an MCP client tools for authoring, evaluating, linting, and explaining OPA Rego policies. It can also manage policies on a running OPA server.
What does OPA MCP require?
Node.js 22 or later is required when using the bundled OPA. A remote OPA connection can be configured with OPA_URL and OPA_TOKEN.
