OPA MCP - install, status & alternatives [2026]

01 · Install OPA MCP

before you install - you'll need

Set OPA_BINARY, REGAL_BINARY, OPA_URL, OPA_MCP_ALLOWED_PATHS before connecting.

Claude Code

claude mcp add orygnscode-opa-mcp-server -- npx -y @orygn/opa-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "orygnscode-opa-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions · container (OCI image) - can be sandboxed away from your filesystem

license MIT - declared in the repository

npm package @orygn/opa-mcp - the @orygn scope differs from the repo owner (orygnscode); confirm it's the project's official package

registry namespace io.github.OrygnsCode is GitHub-verified and matches the repo owner

03 · What OPA MCP can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect, read the capabilities (built-ins, future keywords) understood by the bundled OPA, evaluate a query against a policy and input. The bread-and-butter tool, and evaluate with --explain=full and return a structured trace.

Capability map

Tools grouped from the project's README - what OPA MCP lets an agent do.

Rego

23 tools - e.g. Format Rego source. Wraps opa fmt. Idempotent.; Type-check and validate Rego. Wraps opa check.; Run Regal across a file or directory. Returns findings grouped by category. Requires regal on PATH or…

rego_format · rego_check · rego_lint · rego_parse_ast · rego_inspect · rego_capabilities…

Opa

17 tools - e.g. Batch-evaluate a decision against multiple input files. Returns per-file results with successCount and errorCount.; Build a .tar.gz bundle from a policy directory. Supports optimize and revision.; Sign a…

opa_exec · opa_bundle_build · opa_bundle_sign · opa_bundle_verify · opa_list_policies · opa_get_policy…

Latest releases

v0.3.0 · 2026-08-05

What's new in v0.3.0 · Changed · The bundled OPA binary moves from 0.69.0 to 1.19.0. This is a breaking change for · anyone relying on the bundle. OPA 1.0 made Rego v1 the default, so rule bodies · require the if…

v0.2.1 · 2026-06-25

What's new in v0.2.1 · Fixed · Structured tool arguments that are free-form JSON values (input, value) are · re-parsed when an MCP client sends them as a JSON string. They previously · arrived as strings and were used…

v0.2.0 · 2026-06-13

What's new in v0.2.0 · Added · OPA is now bundled. The OPA binary ships as platform-specific optional · dependencies (@orygn/opa-mcp-<platform>-<arch>), so npx @orygn/opa-mcp runs · without installing OPA separately.…

04 · Who maintains OPA MCP

OPA MCP is maintained by orygnscode. We track 2 MCP servers from orygnscode - 2 actively maintained, 14 combined GitHub stars, oldest repo from May 2026. Full record: all servers from orygnscode.

omnicord Discord server management MCP for AI agents: chat, moderation, admin, and full server building. ★ 7

05 · Facts

repository: github.com/orygnscode/opa-mcp-server
website: https://orygn.tech/
category: cloud infrastructure - ranked #43 of 141 actively-maintained cloud infrastructure servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-08-05)
registry: io.github.OrygnsCode/opa-mcp (active, first published 2026-05-10 · 5 versions)
packages: npm:@orygn/opa-mcp · oci:docker.io/orygn/opa-mcp:0.3.0

06 · OPA MCP FAQ

Is OPA MCP still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-23 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can OPA MCP do?

With this server connected, an agent can inspect a bundle or directory: packages, rules, annotations. Wraps opa inspect, read the capabilities (built-ins, future keywords) understood by the bundled OPA, evaluate a query against a policy and input. The bread-and-butter tool, and evaluate with --explain=full and return a structured trace.

How do I install OPA MCP?

Run `npx -y @orygn/opa-mcp`. The README documents 4 environment variables (OPA_BINARY, REGAL_BINARY, OPA_URL…) to set first. Set OPA_BINARY, REGAL_BINARY, OPA_URL, OPA_MCP_ALLOWED_PATHS before connecting. You can also paste the ready-made client config above.

Does OPA MCP run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to OPA MCP

Alternatives to OPA MCP

Maintained cloud infrastructure servers if OPA MCP isn't the fit.

Pairs well with

Servers that cover what OPA MCP doesn't - only shown when the pairing reason fits the companion.

More cloud infrastructure MCP servers · DevUtils MCP Server · UniFi Gateway · OWASP ZAP MCP Server · AINumbers Fintech Intelligence Suite

More TypeScript MCP servers · Zoteus · Bruno MCP Studio · Otto Travel · Outlit · Outscraper MCP Server · see all