About OPA MCP
OPA MCP is an MCP server in the Security category: author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.
Install
Claude Code
claude mcp add opa-mcp -- npx -y @orygn/opa-mcpnpx
npx -y @orygn/opa-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (9)
rego_capabilitiesList the built-ins and features the resolved `opa` binary understands (`OPA_BINARY`, then `PATH`, then the bundled copy); `builtins` names up to 100 to return full records for
Parameters not published.
rego_checkType-check and validate Rego. Wraps `opa check`.
Parameters not published.
rego_check_schemaCheck Rego against a JSON Schema. Validates that every `input.*` field the policy reads exists in the schema using `opa check --schema`. Accepts an inline schema, a path to a JSON Schema file, or a schema directory when the policy declares `schemas:` annotations.
Parameters not published.
rego_depsStatic dependency analysis: rule-level data references and cross-package calls.
Parameters not published.
rego_formatFormat Rego source. Wraps `opa fmt`. Idempotent.
Parameters not published.
rego_inspectInspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.
Parameters not published.
rego_lintRun Regal across a file or directory. Returns each violation with its category, level and location. **Requires `regal` on `PATH` or `REGAL_BINARY` set.**
Parameters not published.
rego_migrate_v1Migrate Rego v0 source to v1 syntax. Runs `opa fmt --rego-v1` then validates with `opa check --v1-compatible`. Returns `{ original, migrated, changed, valid, errors }`.
Parameters not published.
rego_parse_astParse Rego to AST JSON. Wraps `opa parse`.
Parameters not published.
Ask AI
✦
Ask AI about OPA MCP
Powered by Claude · Grounded in docs
I know everything about OPA MCP. Ask me about installation, configuration, usage, or troubleshooting.
Security checks
6 checks have not been run yet.