OPA MCP server

OPA MCP Server

A Model Context Protocol (MCP) server that turns any MCP-compatible client (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others) into a first-class Open Policy Agent and Rego authoring environment.

+--------------------+ MCP/stdio  +-----------------+ spawn/HTTP +---------------------+
|  Claude · Cursor · |----------> | @orygn/opa-mcp  |----------> | opa · regal         |
|   VS Code · ...    |<---------- |                 |<---------- | conftest · REST API  |
+--------------------+  52 tools  +-----------------+            +---------------------+

Status: v0.6.0. Tool surface, error codes, and

environment variables follow SemVer from

v0.1.0 forward.

Upgrading to 0.6.0: rego_bench reports iterations, nsPerOp,

allocsPerOp and bytesPerOp. The fields opa prints (N, T, Bytes,

MemAllocs, MemBytes, Extra) were top-level and now sit under raw

for a single run, so anything that read them from the top level has to

look there. With count above one, raw is omitted: every document is in

runs, and fastest indexes the one the top-level figures come from.

Upgrading to 0.4.0: subprocesses no longer inherit the server's

environment. A policy that read a variable through opa.runtime().env

will no longer see it; name the variable in OPAMCPPASSTHROUGH_ENV if

it is genuinely needed. See the security section for why.

Upgrading to 0.3.0: the bundled OPA is now 1.19, so Rego v0 policies

no longer parse (if is required before a rule body, contains before a

partial set). Run regomigratev1 to convert them. If you supply your own

binary via OPA_BINARY or PATH, nothing changes.

Table of contents

• What you can do with it
• Why this MCP
• Install
• Configuration
• Tool reference
• Prompts
• Resources
• Cookbook
• Architecture
• Security
• Troubleshooting
• Development

What you can do with it

Once an MCP client is connected, an agent can:

Shortened. The full README is on GitHub.