Openlane MCP Server

Openlane MCP Server

A secure, open-source Model Context Protocol server for the Openlane GRC platform.

This project is not an official Openlane product and is not endorsed by theopenlane, Inc.

Overview

openlane-mcp lets MCP clients such as Cursor and Claude Desktop query Openlane over stdio (default) or Streamable HTTP. It talks to Openlane Cloud or a self-hosted instance through the official Openlane Go client.

MCP Client
    → Openlane MCP Server (stdio or HTTP)
        → Official Openlane Go Client
            → Openlane API

The server is read-only by default. Write and delete tools are opt-in and independent. Openlane authorization still applies to every request.

Features

• Openlane MCP access for programs, controls, evidence, policies, risks, standards, tasks, entities (vendors), assets, contacts, findings, assessments, control implementations, groups, users, and workflows
• Enriched get tools with vendor/security fields and compact relationship summaries
• List filters on entities, risks, findings, evidence, programs, assessments, implementations, and workflows
• Opt-in create/update tools for controls, evidence, policies, risks, tasks, workflow definitions, workflow assignments, and native policy lifecycle
• Opt-in delete tools for the same domains plus workflow definitions (except programs and standards)
• Openlane Cloud and self-hosted Openlane (configurable base URL)
• stdio transport (default) and opt-in Streamable HTTP transport
• Native Go binary
• Docker image (published with GitHub Releases)
• MCP Registry listing on tagged releases (io.github.GregDog/mcp-server-theopenlane)

Quick Start

Create an Openlane API token or PAT in console developer settings. Organization tokens start with tola. Personal access tokens start with tolp.

export OPENLANE_API_TOKEN="tola_..."
# Optional for multi-org PATs:
export OPENLANE_ORGANIZATION_ID="..."

openlane-mcp serve

Then connect an MCP client. See Client configuration.

Installation

From source

go install github.com/GregDog/mcp-server-theopenlane/cmd/openlane-mcp@latest

Requires Go 1.27 or later.

GitHub Releases

Binary archives will be published on tagged GitHub Releases (linux/darwin amd64+arm64, windows amd64) with SHA256 checksums.

Docker

docker run --rm -i \
  -e OPENLANE_API_TOKEN \
  -e OPENLANE_ORGANIZATION_ID \
  ghcr.io/gregdog/mcp-server-theopenlane serve

Images are published with GitHub Releases to ghcr.io/gregdog/mcp-server-theopenlane.

Client configuration

Cursor (stdio, recommended)

This repository's .cursor/mcp.json uses scripts/mcp-serve.sh, which loads .env and runs the local binary:

{
  "mcpServers": {
    "openlane": {
      "command": "bash",
      "args": ["${workspaceFolder}/scripts/mcp-serve.sh"]
    }
  }
}

Or install globally and pass env vars directly:

{
  "mcpServers": {
    "openlane": {
      "command": "openlane-mcp",
      "args": ["serve"],
      "env": {
        "OPENLANE_API_TOKEN": "${env:OPENLANE_API_TOKEN}",
        "OPENLANE_ORGANIZATION_ID": "${env:OPENLANE_ORGANIZATION_ID}"
      }
    }
  }
}

Cursor (HTTP)

Shortened. The full README is on GitHub.