Opa Authz MCP server

by kanywst·io.github.kanywst/mcp-opa-authz·v0.3.0

Authorization answers from real policy code: evaluate Rego locally, or ask an AuthZEN 1.0 PDP.

B73/100grade B

What users say

No reviews yet

Safety scan

B73/100

Adoption

New

0 stars

Reviews

Nobody has reviewed Opa Authz yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

No tool declarations could be read from the package source. They show once the server is installed.

scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it

no findings

–Code scanpackage could not be scannedn/a
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 5 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 73/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

claude mcp add mcp-opa-authz -- docker run -i --rm ghcr.io/kanywst/mcp-opa-authz:0.3.0

Is Opa Authz MCP server safe?: Mostly: it is graded B (73/100). Read the Opa Authz safety report
How do I install Opa Authz?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Opa Authz need an API key?: Yes. The registry entry asks for AUTHZEN_PDP_TOKEN.
Is Opa Authz maintained?: The last commit was 6 days ago (2026-09-14). The latest release is v0.3.0.

Local package. It runs on your machine, not through the gateway.

AUTHZEN_PDP_URLDefault AuthZEN Access Evaluation endpoint, e.g. https://pdp.example.com/access/v1/evaluation. Only evaluate_policy works without it.
AUTHZEN_PDP_TOKENsecretAuthorization header value for the PDP. A value with no scheme is sent as "Bearer <token>".
AUTHZEN_PDP_TIMEOUTPer-request timeout for PDP calls, as a Go duration. Default 10s.
MCP_OPA_EVAL_TIMEOUTWall-clock limit on a single Rego evaluation, as a Go duration. Default 5s.
MCP_OPA_ALLOW_NETWORK_BUILTINSRe-enable http.send, net.lookup_ip_addr and opa.runtime inside evaluated policies. Off by default: policy source evaluated here comes from a model and runs inside the server process.

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/kanywst-mcp-opa-authz.svg)](https://mcp.market/server/kanywst-mcp-opa-authz)