OPA MCP for VS Code
io.github.orygnscode/opa-mcp
Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.
client:VS Code
transport:stdio
runtime:npm
Install OPA MCP in VS Code
.vscode/mcp.json
{
"inputs": [
{
"type": "promptString",
"id": "opa-url",
"description": "OPA_URL",
"password": true
},
{
"type": "promptString",
"id": "opa-token",
"description": "OPA_TOKEN",
"password": true
},
{
"type": "promptString",
"id": "opa-binary",
"description": "OPA_BINARY",
"password": true
},
{
"type": "promptString",
"id": "regal-binary",
"description": "REGAL_BINARY",
"password": true
},
{
"type": "promptString",
"id": "conftest-binary",
"description": "CONFTEST_BINARY",
"password": true
},
{
"type": "promptString",
"id": "opa-mcp-allowed-paths",
"description": "OPA_MCP_ALLOWED_PATHS",
"password": true
},
{
"type": "promptString",
"id": "github-token",
"description": "GITHUB_TOKEN",
"password": true
}
],
"servers": {
"opa-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@orygn/opa-mcp"
],
"env": {
"OPA_URL": "${input:opa-url}",
"OPA_TOKEN": "${input:opa-token}",
"OPA_BINARY": "${input:opa-binary}",
"REGAL_BINARY": "${input:regal-binary}",
"CONFTEST_BINARY": "${input:conftest-binary}",
"OPA_MCP_ALLOWED_PATHS": "${input:opa-mcp-allowed-paths}",
"GITHUB_TOKEN": "${input:github-token}"
}
}
}
}
VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs