OPA MCP - install, status & alternatives [2026]

01 · Install OPA MCP

before you install - you'll need

Set OPA_BINARY, REGAL_BINARY, OPA_URL, OPA_MCP_ALLOWED_PATHS before connecting.

Claude Code

claude mcp add orygnscode-opa-mcp-server -- npx -y @orygn/opa-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "orygnscode-opa-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions · container (OCI image) - can be sandboxed away from your filesystem

license MIT - declared in the repository

npm package @orygn/opa-mcp - the @orygn scope differs from the repo owner (orygnscode); confirm it's the project's official package

registry namespace io.github.OrygnsCode is GitHub-verified and matches the repo owner

03 · What OPA MCP can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect, list the built-ins and features the resolved opa binary understands (OPA_BINARY, then PATH, then the bundled copy), evaluate a query against a policy and input. The bread-and-butter tool, and evaluate with --explain=full and return a structured trace.

Capability map

Tools grouped from the project's README - what OPA MCP lets an agent do.

Rego

23 tools - e.g. Format Rego source. Wraps opa fmt. Idempotent.; Type-check and validate Rego. Wraps opa check.; Run Regal across a file or directory. Returns each violation with its category, level and location.…

rego_format · rego_check · rego_lint · rego_parse_ast · rego_inspect · rego_capabilities…

Opa

17 tools - e.g. Batch-evaluate a decision against multiple input files. Returns per-file results with successCount and errorCount.; Build a .tar.gz bundle from a policy directory. Supports optimize and revision.; Sign a…

opa_exec · opa_bundle_build · opa_bundle_sign · opa_bundle_verify · opa_list_policies · opa_get_policy…

Latest releases

v0.6.0 · 2026-09-07

What's new in v0.6.0 · Security · rego_playground_share created public Gists, listed on the account and · searchable, while the README described them as secret. Anyone who shared a · policy with it should assume the…

v0.5.0 · 2026-09-05

What's new in v0.5.0 · Security · opa_config described its output as sanitized with secrets excluded. OPA · drops the credentials block from GET /v1/config but returns · services..headers verbatim, and a header is the…

v0.4.0 · 2026-09-03

What's new in v0.4.0 · Security · Policies evaluated through this server no longer receive the server's environment. · Rego exposes the environment of the opa process through opa.runtime().env, and · child processes…

04 · Who maintains OPA MCP

OPA MCP is maintained by orygnscode. We track 2 MCP servers from orygnscode - 2 actively maintained, 16 combined GitHub stars, oldest repo from May 2026. Full record: all servers from orygnscode.

omnicord Discord server management MCP for AI agents: chat, moderation, admin, and full server building. ★ 8

05 · Facts

repository: github.com/orygnscode/opa-mcp-server
website: https://orygn.tech/
category: cloud infrastructure - ranked #57 of 153 actively-maintained cloud infrastructure servers as of 2026-09-18.
release cadence: 5 releases in the last 90 days (latest 2026-09-07)
registry: io.github.OrygnsCode/opa-mcp (active, first published 2026-05-10 · 8 versions)
packages: npm:@orygn/opa-mcp · oci:docker.io/orygn/opa-mcp:0.6.0

06 · OPA MCP FAQ

Is OPA MCP still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-10 and it shipped 5 releases in the last 90 days. We re-verify nightly.

What can OPA MCP do?

With this server connected, an agent can inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect, list the built-ins and features the resolved opa binary understands (OPA_BINARY, then PATH, then the bundled copy), evaluate a query against a policy and input. The bread-and-butter tool, and evaluate with --explain=full and return a structured trace.

How do I install OPA MCP?

Run `npx -y @orygn/opa-mcp`. The README documents 4 environment variables (OPA_BINARY, REGAL_BINARY, OPA_URL…) to set first. Set OPA_BINARY, REGAL_BINARY, OPA_URL, OPA_MCP_ALLOWED_PATHS before connecting. You can also paste the ready-made client config above.

Does OPA MCP run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to OPA MCP

Alternatives to OPA MCP

Maintained cloud infrastructure servers if OPA MCP isn't the fit.

Pairs well with

Servers that cover what OPA MCP doesn't - only shown when the pairing reason fits the companion.

More cloud infrastructure MCP servers · Wyd · DevUtils MCP Server · Krabi Claw · UniFi Gateway

More TypeScript MCP servers · Zoteus · Bruno MCP Studio · Aboard · Otskit MCP · Otto Travel · see all