{"name":"io.github.OrygnsCode/opa-mcp","slug":"orygnscode-opa-mcp","title":"OPA MCP","description":"Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.","url":"https://mcp.market/server/orygnscode-opa-mcp","rating":null,"grade":"B","score":75,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":27,"stars":8,"forks":1,"downloads_week":null,"last_push_at":"2026-09-10T01:22:37.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/OrygnsCode/opa-mcp-server","website":"https://orygn.tech","version":"0.6.0","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@orygn/opa-mcp","version":"0.6.0","runtimeHint":"npx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Base URL of a running OPA server. Required only for opa_* runtime tools, not for rego_* language tools.","default":"http://localhost:8181","name":"OPA_URL"},{"description":"Bearer token for OPA running with --authentication=token.","isSecret":true,"name":"OPA_TOKEN"},{"description":"Path to the opa binary. Defaults to 'opa' on PATH.","default":"opa","name":"OPA_BINARY"},{"description":"Path to the regal binary (optional; used by rego_lint, rego_security_audit and rego_fix). Defaults to 'regal' on PATH.","default":"regal","name":"REGAL_BINARY"},{"description":"Path to the conftest binary (optional, used by conftest_* tools). Defaults to 'conftest' on PATH.","default":"conftest","name":"CONFTEST_BINARY"},{"description":"Comma-separated list of root directories tools may read/write. When unset, file-based tools refuse to access the disk.","name":"OPA_MCP_ALLOWED_PATHS"},{"description":"GitHub personal access token with the \"gist\" scope. Required only for rego_playground_share.","isSecret":true,"name":"GITHUB_TOKEN"}]},{"registryType":"oci","identifier":"docker.io/orygn/opa-mcp:0.6.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Base URL of a running OPA server.","default":"http://localhost:8181","name":"OPA_URL"},{"description":"Bearer token for OPA authentication.","isSecret":true,"name":"OPA_TOKEN"},{"description":"GitHub personal access token with the \"gist\" scope. Required only for rego_playground_share.","isSecret":true,"name":"GITHUB_TOKEN"}]}],"tools":[{"name":"conftest_pull","description":"Download Rego policies from an OCI registry or Git repository into a local directory","write_action":false,"price_micros":0,"input_schema":null},{"name":"conftest_push","description":"Package the local Rego policy directory as an OCI artifact and push it to a registry","write_action":false,"price_micros":0,"input_schema":null},{"name":"conftest_test","description":"Evaluate configuration files (Kubernetes manifests, Terraform plans, Dockerfiles, Helm","write_action":false,"price_micros":0,"input_schema":null},{"name":"conftest_verify","description":"Run the `test_*` rules inside `*_test.rego` files within a conftest policy directory,","write_action":true,"price_micros":0,"input_schema":null},{"name":"mcp_server_info","description":"Return the name, version, and runtime details of this opa-mcp server instance. Use this when you need to confirm which version of opa-mcp is running, or to verify that the OPA, Regal, and Conftest binaries are reachable.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_bundle_build","description":"Build a deployable bundle from policy / data paths using `opa build`. Output is a `.tar.gz` archive with optional inline signing. Supports optimization, custom revision strings, and the WASM target.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_bundle_sign","description":"Sign a bundle directory with `opa sign`.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_bundle_verify","description":"Verify the signature of a signed bundle directory or `.tar.gz` archive with the public key.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_compile_query","description":"Send a query to the OPA server's `/v1/compile` endpoint for partial evaluation. Returns the residual query -- what remains after substituting in everything that's known.","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_config","description":"Return the running OPA server configuration from `GET /v1/config`. OPA drops the `credentials` block but returns `services.*.headers` verbatim, which is the ordinary place to put an API key or a bearer token, so those values are redacted here and the header names kept.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_delete_data","description":"Remove a document from OPA's data store at the given path. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both. OPA responds with 204 No Content on success; if no document exists at the path, OPA returns","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_delete_policy","description":"Delete a policy by ID from the running OPA server.","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_exec","description":"Evaluate a policy decision against one or more input files using `opa exec --format=json`. Unlike `rego_eval` (single input), `opa exec` processes every file independently and returns a per-file result -- ideal for CI pipelines that check many config files against a policy in one call. Supply `bundle` for bundle-based policies or `dataPaths` for raw policy files; these are mutually exclusive. Each","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_get_data","description":"Read a path from OPA's data hierarchy. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_get_policy","description":"Fetch a single policy by ID from the running OPA server. Returns the Rego source; the parsed AST is omitted unless asked for, since it is roughly forty times the size of the source it came from. Use `rego_parse_ast` on the source when an AST is what's wanted.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_health","description":"Hit the OPA `/health` endpoint. A server that answers reports `{ healthy: true }` on 200 and `{ healthy: false }` with OPA's own reason otherwise, so an unactivated bundle is a health result rather than a tool error. `OPA_UNREACHABLE` means the server could not be reached at all. Supports `bundles` and `plugins` query flags to require those subsystems to also be healthy.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_list_policies","description":"List policies registered on the running OPA server. Returns the policy IDs and a count. Set `includeSource` for the Rego text of every policy, or `includeAst` for the parsed AST of every policy; both are off by default because either one pushes a list of any real size past the response cap.","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_patch_data","description":"Apply a JSON Patch (RFC 6902) to the data document. Each operation is `{ op, path, value? }`. Omit both `path` and `segments` to patch the root of the data hierarchy, which is how a whole new top-level document is added.","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_put_data","description":"Write or replace a value at the given data path. Body is sent as JSON. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both.","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_put_policy","description":"Upload a Rego policy under the given ID. Replaces any existing policy with that ID. The policy is uploaded as raw text/plain -- OPA parses it on the server side.","write_action":true,"price_micros":0,"input_schema":null},{"name":"opa_query_decision","description":"Evaluate a decision against the running OPA server. POSTs to the data path with `{input}` and returns whatever the rule produces. Use this to ask the server \"given this input, what does data.X.allow say?\"","write_action":false,"price_micros":0,"input_schema":null},{"name":"opa_status","description":"Return the running OPA server configuration via `GET /v1/config`.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_bench","description":"Benchmark a Rego query against a policy + input with `opa bench`. Returns statistical timing data: iterations, ns/op, and allocation counts. Use this to spot slow rules.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_capabilities","description":"Return OPA capabilities -- the available builtins, future keywords, features, and WASM ABI versions. With `current: true`, returns the running OPA's capabilities. With `version: \"v1.19.0\"`, returns those of a specific version. With neither, lists available named versions. By default (`names_only: true`), returns only builtin names and count to stay within response size limits. Pass `builtins: [...","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_check","description":"Type-check Rego with `opa check`. Returns `{ valid: true, errors: [] }` on success, or a list of structured diagnostics with file/line locations on failure. Provide either `source` for inline checking or `paths` for file/directory checking.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_check_schema","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_compile_query","description":"Run partial evaluation on a query -- substitute known values and return the residual policy. Defaults `unknowns` to `[\"input\"]` (treat input as unknown), so the residual encodes \"given input X, this is what would have to be true.\" Use this for offline policy slicing or pre-computing decision sets.","write_action":true,"price_micros":0,"input_schema":null},{"name":"rego_coverage_gaps","description":"Run opa test --coverage and return a per-file breakdown of uncovered line ranges. Identifies which rules or branches are not yet exercised by tests. Files are sorted by coverage ascending so the worst-covered files appear first. Use threshold to limit the report to files below a target coverage percentage.","write_action":true,"price_micros":0,"input_schema":null},{"name":"rego_deps","description":"Static dependency analysis for a Rego reference. Given a target ref like \"data.example.allow\", returns the base document references (input/data leaves) and virtual document references (rules) it depends on, transitively.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_describe_policy","description":"Parse a Rego policy and return a structured summary: package, imports, and rules. Each rule reports clauseCount (how many definitions share the name), isDefault (true if any clause is a default), hasArgs, bodyLength (total body expressions across all clauses), and inline annotations. Useful as the first step in any \"what does this policy do\" workflow.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_eval","description":"Evaluate a Rego query against a policy and an input document using `opa eval`. Returns the standard `{result: [...]}` shape. The bread-and-butter authoring tool.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_eval_with_coverage","description":"Evaluate with `--coverage` and return per-line coverage data. Useful for verifying that tests actually exercise the rules they're meant to.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_eval_with_explain","description":"Evaluate with `--explain=full` and return a structured trace alongside the result. Use this when an agent needs to see why a rule fired (or didn't) -- the trace is the basis for `rego_explain_decision`.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_eval_with_profile","description":"Evaluate with `--profile` and return per-rule timing and evaluation counts. Use this to find hot rules in slow policies.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_explain_decision","description":"Evaluate a Rego query with full tracing and return a structured trace plus per-rule fired/not-fired summary. Use this when you need to answer \"why was this denied?\" -- the agent reads the structured trace and narrates the cause without re-implementing the trace parser.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_explain_undefined","description":"Diagnose why a fully-qualified Rego query (e.g. \"data.authz.allow\") produces no","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_fix","description":"Run regal fix to automatically apply mechanical fixes for the five rules regal 0.30.0 supports: opa-fmt, use-rego-v1, use-assignment-operator, no-whitespace-comment, and directory-package-mismatch. Use dryRun: true to preview changes before modifying files. NOTE: directory-package-mismatch moves files to match their package path -- use disable: [\"directory-package-mismatch\"] to skip it. Files with","write_action":true,"price_micros":0,"input_schema":null},{"name":"rego_format","description":"Format Rego source code using `opa fmt`. Returns the formatted source and a `changed` flag indicating whether the input was already canonical.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_format_write","description":"Run `opa fmt --write` to canonically format one or more Rego files or directories in place. Use `dryRun: true` to preview which files would change without modifying them. Returns a list of files that were (or would be) reformatted. Unlike `rego_format` which returns formatted source as a string, this tool writes directly to disk. Supports `regoV1`, `v0Compatible`, and `v1Compatible` flags for vers","write_action":true,"price_micros":0,"input_schema":null},{"name":"rego_generate_test_skeleton","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_infer_input_schema","description":"Statically analyse one or more Rego policies and return a JSON Schema (draft-07) object describing every input.* field the policies read. Uses opa parse for AST-level analysis -- no running OPA server required. Correct starting point for writing integration tests, configuring opa check --schema validation, or documenting a policy API. Accepts inline source, individual files, or directories (walked","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_inspect","description":"Inspect an OPA bundle, policy directory, or single Rego file with `opa inspect`. Returns manifest data, namespaces, rule annotations, and (if signed) signature metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_lint","description":"Lint Rego source with the Regal linter. Returns categorized violations (style, bugs, idiomatic, performance) with file/line locations. Requires `regal` on PATH or `REGAL_BINARY` set; returns REGAL_NOT_FOUND otherwise. When called with inline `source`, location-bound rules whose verdict depends on the on-disk path (`directory-package-mismatch`) are auto-disabled to avoid temp-file false positives, ","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_migrate_v1","description":"Migrate Rego v0 source to Rego v1 syntax in two phases: (1) `opa fmt --rego-v1` auto-fixes reserved keywords (`if`, `contains`, `every`, `in` in rule heads) and adds `import rego.v1`; (2) `opa check --v1-compatible` validates the migrated source and reports any remaining issues that cannot be auto-fixed (e.g. removed builtins, semantic conflicts). Returns the migrated source and a `changed` flag e","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_parse_ast","description":"Parse Rego source to a JSON AST using `opa parse`. Returns the AST as a tree of nodes (package, imports, rules, expressions, terms). Use this when you need to introspect policy structure programmatically.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_playground_share","description":"Share a Rego policy with teammates or create a reproducible example by publishing it","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_policy_diff","description":"Evaluate the same query against two policies (or two versions of the same policy) and compare the results. Both evaluations run in parallel. Returns `equal: true/false`, the raw result from each side, and `changedPaths` -- the dot/bracket paths that differ. Useful for verifying that a refactor preserves behavior, or understanding exactly where two policies diverge. Each side takes either inline so","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_security_audit","description":"Run regal lint restricted to its `bugs` category, the correctness rules whose defects most often turn into policy bypasses, plus any custom rules placed in a `security` category, across one or more policy directories. Returns findings grouped by severity (high/medium) with remediation guidance. Use this for a periodic fleet-wide sweep rather than per-file style review. Requires regal.","write_action":true,"price_micros":0,"input_schema":null},{"name":"rego_suggest_fix","description":"Map common Rego compile errors and Regal lint findings to mechanical fix suggestions. Pass diagnostics from `rego_check` or `rego_lint`. Returns one suggestion per input diagnostic; confidence is `high` for well-known patterns, `medium` for partial matches, `low` for everything else.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_test","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_test_multiroot","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"rego_verify","description":"Formally verify a property about a Rego rule using SMT solving (Microsoft Z3).","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":75,"grade":"B","scanned_at":"2026-09-20T00:27:00.064Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T00:27:00.042Z","components":{"code":{"score":20,"max":25,"notes":["175 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 10 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/lib/opa-cli.js: …nd metrics sections). */ async eval(input, signal) { // Inline sourc…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@orygn/opa-mcp","version":"0.6.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":3,"publishedAt":"2026-09-07T16:25:40.346Z","repositoryUrl":"git+https://github.com/OrygnsCode/opa-mcp-server.git"}],"repo":{"found":true,"owner":"OrygnsCode","repo":"opa-mcp-server","archived":false,"pushedAt":"2026-09-10T01:22:37Z","stars":8,"forks":1,"openIssues":1,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/38231263?v=4","ownerCreatedAt":"2018-04-09T23:31:07Z","license":"MIT"},"icon":{"url":"https://orygn.tech/apple-touch-icon.png","source":"site","width":180,"height":180},"presence":{"stars":8,"forks":1,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-09-10T01:22:37.000Z","score":27}}}},"grade_history":[],"reviews":[]}