# OPA MCP

This MCP server brings OPA and Rego tools into an AI client for policy authoring, evaluation, linting, and decision debugging.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: OrygnsCode
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/OrygnsCode/opa-mcp-server
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/opa-mcp

## What it does

OPA MCP exposes structured operations for Rego instead of making an agent parse free-form command output. It can format and parse policies with `opa`, evaluate queries against input data, and return traces, profiles, or coverage. A decision helper walks through rules that accepted or rejected a request.

The server can run `regal` linting, manage policies on a live OPA instance through its REST API, create `.tar.gz` bundles, and generate test skeletons. Installation uses `npx` with `@orygn/opa-mcp`. Node.js 22 or later is required when the bundled OPA is used.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `OPA_URL`, `OPA_TOKEN`, `OPA_BINARY`, `REGAL_BINARY`, `CONFTEST_BINARY`, `OPA_MCP_ALLOWED_PATHS`, `GITHUB_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env OPA_URL=<OPA_URL> --env OPA_TOKEN=<OPA_TOKEN> --env OPA_BINARY=<OPA_BINARY> --env REGAL_BINARY=<REGAL_BINARY> --env CONFTEST_BINARY=<CONFTEST_BINARY> --transport stdio opa-mcp -- npx -y @orygn/opa-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Codex

**Platform CLI**
```bash
codex mcp add opa-mcp --env OPA_URL=<OPA_URL> --env OPA_TOKEN=<OPA_TOKEN> --env OPA_BINARY=<OPA_BINARY> --env REGAL_BINARY=<REGAL_BINARY> --env CONFTEST_BINARY=<CONFTEST_BINARY> -- npx -y @orygn/opa-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "opa-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@orygn/opa-mcp"
            ],
            "env": {
                "OPA_URL": "<OPA_URL>",
                "OPA_TOKEN": "<OPA_TOKEN>",
                "OPA_BINARY": "<OPA_BINARY>",
                "REGAL_BINARY": "<REGAL_BINARY>",
                "CONFTEST_BINARY": "<CONFTEST_BINARY>"
            }
        }
    }
}
```
Replace <…> with your own values. 2 more environment variables are in the server README

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "opa-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@orygn/opa-mcp"
            ],
            "env": {
                "OPA_URL": "<OPA_URL>",
                "OPA_TOKEN": "<OPA_TOKEN>",
                "OPA_BINARY": "<OPA_BINARY>",
                "REGAL_BINARY": "<REGAL_BINARY>",
                "CONFTEST_BINARY": "<CONFTEST_BINARY>"
            }
        }
    }
}
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e OPA_URL=<OPA_URL> -e OPA_TOKEN=<OPA_TOKEN> -e OPA_BINARY=<OPA_BINARY> -e REGAL_BINARY=<REGAL_BINARY> -e CONFTEST_BINARY=<CONFTEST_BINARY> opa-mcp npx -y @orygn/opa-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

## When to use it
- author and format Rego policies
- evaluate a query against policy data
- trace the rules behind a denied decision
- lint one file or a policy directory with `regal`
- package policies as a `.tar.gz` bundle

## Example prompts
- Check this Rego policy and explain why the request is denied.
- Evaluate the query with execution tracing and line coverage.
- Build a `.tar.gz` bundle from the policies in this directory.

## Similar
- [policy-as-code](https://affpapa.org/en/nevibecode/skills/policy-as-code.md) — skill · 345 installs
- [prototype-pollution](https://affpapa.org/en/nevibecode/skills/prototype-pollution.md) — skill · 3600 installs
- [backend-developer](https://affpapa.org/en/nevibecode/agents/voltagent-community-backend-developer.md) — subagent · 2724 installs
- [jwt-encode](https://affpapa.org/en/nevibecode/skills/jwt-encode.md) — skill · 606 installs
- [node-express](https://affpapa.org/en/nevibecode/rules/node-express.md) — rule · ★ 41024
- [fastify-best-practices](https://affpapa.org/en/nevibecode/skills/fastify-best-practices.md) — skill · 82300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md