io.github.kanywst/mcp-opa-authz MCP Server

Name: io.github.kanywst/mcp-opa-authz MCP Server
Author: io.github.kanywst

io.github.kanywst/mcp-opa-authz

Repository Registry

What is the io.github.kanywst/mcp-opa-authz MCP server?

Authorization answers from real policy code: evaluate Rego locally, or ask an AuthZEN 1.0 PDP.

How to install io.github.kanywst/mcp-opa-authz

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

AUTHZEN_PDP_URL
Default AuthZEN Access Evaluation endpoint, e.g. https://pdp.example.com/access/v1/evaluation. Only evaluate_policy works without it.
AUTHZEN_PDP_TOKEN
secret
Authorization header value for the PDP. A value with no scheme is sent as "Bearer <token>".
AUTHZEN_PDP_TIMEOUT
Per-request timeout for PDP calls, as a Go duration. Default 10s.
MCP_OPA_EVAL_TIMEOUT
Wall-clock limit on a single Rego evaluation, as a Go duration. Default 5s.
MCP_OPA_ALLOW_NETWORK_BUILTINS
Re-enable http.send, net.lookup_ip_addr and opa.runtime inside evaluated policies. Off by default: policy source evaluated here comes from a model and runs inside the server process.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.2.1"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<YOUR_AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<YOUR_AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<YOUR_MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<YOUR_MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.2.1"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<YOUR_AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<YOUR_AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<YOUR_MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<YOUR_MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "mcp-opa-authz": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.2.1"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<YOUR_AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<YOUR_AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<YOUR_MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<YOUR_MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "mcp-opa-authz": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kanywst/mcp-opa-authz:0.2.1"
      ],
      "env": {
        "AUTHZEN_PDP_URL": "<YOUR_AUTHZEN_PDP_URL>",
        "AUTHZEN_PDP_TOKEN": "<YOUR_AUTHZEN_PDP_TOKEN>",
        "AUTHZEN_PDP_TIMEOUT": "<YOUR_AUTHZEN_PDP_TIMEOUT>",
        "MCP_OPA_EVAL_TIMEOUT": "<YOUR_MCP_OPA_EVAL_TIMEOUT>",
        "MCP_OPA_ALLOW_NETWORK_BUILTINS": "<YOUR_MCP_OPA_ALLOW_NETWORK_BUILTINS>"
      }
    }
  }
}

Claude Code

claude mcp add mcp-opa-authz --env AUTHZEN_PDP_URL=<YOUR_AUTHZEN_PDP_URL> --env AUTHZEN_PDP_TOKEN=<YOUR_AUTHZEN_PDP_TOKEN> --env AUTHZEN_PDP_TIMEOUT=<YOUR_AUTHZEN_PDP_TIMEOUT> --env MCP_OPA_EVAL_TIMEOUT=<YOUR_MCP_OPA_EVAL_TIMEOUT> --env MCP_OPA_ALLOW_NETWORK_BUILTINS=<YOUR_MCP_OPA_ALLOW_NETWORK_BUILTINS> -- docker run -i --rm ghcr.io/kanywst/mcp-opa-authz:0.2.1