OPA MCP Server: Install & Setup

Install OPA in Claude Code

npm

Claude Code

claude mcp add opa -- npx -y @orygn/opa-mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "opa": {
      "command": "npx",
      "args": [
        "-y",
        "@orygn/opa-mcp"
      ]
    }
  }
}

Docker

Claude Code

claude mcp add opa -- docker run -i --rm docker.io/orygn/opa-mcp:0.9.1

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "opa": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "docker.io/orygn/opa-mcp:0.9.1"
      ]
    }
  }
}

Frequently asked questions

What does the OPA MCP server do?

OPA and Rego policy toolkit wrapping the OPA CLI and Regal: format, lint, evaluate, test and benchmark policies, manage the OPA REST API and explain decisions.

Is the OPA MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does OPA run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add OPA to Claude Code?

Run: claude mcp add opa -- npx -y @orygn/opa-mcp

More security & identity MCP servers

View all

Tamperlens

0240

haruodev/tamperlens-mcp

Document forensics via the Tamperlens API: detect post-creation edits, failed redactions and embedded prompt injection in PDFs, Office files and images.

LocalAccount neededTypeScript

Lazaretto

1207

jamesdfinance-dev/lazaretto-mcp

Check lockfiles against malicious-package advisories and scan artifacts for credential theft, exfiltration, obfuscation, prompt injection and droppers.

Local + RemoteAccount neededTypeScript

Agent Envelope

1220

BlackBoxEngineering/agent-envelope-mcp

Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint.

LocalFree

Job Verify

yessGlory17/job-verify

Check recruiters and job offers for scams: cross-checks company registration, domain age, look-alike domains, blocklists and crypto-scam databases.

LocalAccount neededPython

Aikido Security Analysis Platform

2177

Bajuzjefe/Aikido-Security-Analysis-Platform

Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors.

LocalFree

SDK

rohan-protocol/sdk

Stateless privacy shield, WebMCP semantic firewall, and gasless on-chain state settlement for autonomous AI agents on Midnight Network.

LocalAccount neededTypeScript