Mcp Opa Authz

MCP server · by kanywst

Developer Tools Docker v0.6.2

Authorization answers from real policy code: evaluate Rego locally, or ask an AuthZEN 1.0 PDP.

View source ↗ Website ↗ Generate config for multiple servers More servers

Install

Pin version unavailable — the image reference already carries a tag

Docker
docker run -i --rm ghcr.io/kanywst/mcp-opa-authz:0.6.2

Setup by client

Pick your client — the config below is generated for this server (local stdio). Copy respects the “Pin version” switch above.

claude_desktop_config.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>"
      }
    }
  }
}

Format verified against the official Claude Desktop docs ↗.

terminal

claude mcp add --env AUTHZEN_PDP_TOKEN=<YOUR_AUTHZEN_PDP_TOKEN> mcp-opa-authz -- docker run -i --rm ghcr.io/kanywst/mcp-opa-authz:0.6.2

Format verified against the official Claude Code docs ↗.

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>"
      }
    }
  }
}

Format verified against the official Cursor docs ↗.

.vscode/mcp.json

{
  "servers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>"
      }
    }
  }
}

Format verified against the official VS Code docs ↗.

mcp_config.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.6.2"
      ],
      "env": {
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>"
      }
    }
  }
}

Format verified against the official Windsurf docs ↗.

Environment variables

Defined in the server's official registry manifest. Required secrets are shown as <YOUR_…> placeholders in the configs above.

AUTHZEN_PDP_URL — Default AuthZEN Access Evaluation endpoint, e.g. https://pdp.example.com/access/v1/evaluation. Only evaluate_policy works without it.
AUTHZEN_PDP_TOKEN secret — Authorization header value for the PDP. A value with no scheme is sent as "Bearer <token>".
AUTHZEN_PDP_TIMEOUT — Per-request timeout for PDP calls, as a Go duration. Default 10s.
MCP_OPA_EVAL_TIMEOUT — Wall-clock limit on a single Rego evaluation, as a Go duration. Default 5s.
MCP_OPA_ALLOW_NETWORK_BUILTINS — Re-enable http.send, net.lookup_ip_addr and opa.runtime inside evaluated policies. Off by default: policy source evaluated here comes from a model and runs inside the server process.

GitHub

⭐ 1 stars · 最近更新于 29 天前 · MIT license

About this server

mcp opa authz Stop letting your agent guess at authorization. This is an MCP server that answers "is this allowed?" from real policy code — either Rego you hand it, or the OpenID AuthZEN 1.0 PDP that actually governs your system. Ask a model whether Alice may delete that document and it will produce…

Summary from the project README — github.com/kanywst/mcp-opa-authz

Distributed as Docker, listed under Developer Tools. Review our MCP security guide before granting access to real data.

Frequently asked questions

What does the Mcp Opa Authz MCP server do?

How do I install Mcp Opa Authz?

Run the install command shown above, then paste the config for your client (Claude Desktop, Claude Code, Cursor, VS Code or Windsurf) into its MCP settings and restart the client.

Is Mcp Opa Authz free to use?

The MCP server itself is free to install. The source is public on https://github.com/kanywst/mcp-opa-authz. Any third-party service it calls may require its own API key and account.

Which clients support Mcp Opa Authz?

Any MCP-compatible client can use it, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and custom agents.

Add this badge

Publish this server? Link back with a badge on your README or site — copy either snippet.

Markdown

[![Listed on MCPNav](https://mcpnav.net/badge/mcp-opa-authz.svg)](https://mcpnav.net/server/mcp-opa-authz/)

HTML

<a href="https://mcpnav.net/server/mcp-opa-authz/"><img src="https://mcpnav.net/badge/mcp-opa-authz.svg" alt="Listed on MCPNav" height="20"></a>