Read and write live behind the same connection here, and the write side reaches the settings that govern access itself — reviewers, reviewer stages, visibility, group membership. That makes the token choice the real decision: a read-only token turns this into an inventory and audit surface over apps, resources, groups and events, while a full-access one lets an agent approve a request or change who reviews a resource. Generate the narrower token first and widen it only for the flows that need it.
The Opal Security API exposed as tools, generated from its SDK. It covers the objects access management runs on — apps, resources, groups, bundles, owners, requests, tags and reviews — with reads and writes on each.
- Access requests listed, created, read and approved, so an approval flow can be driven from where the conversation is already happening
- Resources managed end to end: created, updated and deleted; their users added, changed, removed and their access status checked; their non-human identities, tags and scoped role permissions read and set
- Groups the same way, plus group membership, containing groups, resources granted through the group, and its users
- Reviewers and reviewer stages set on both resources and groups — the configuration that decides who has to approve what, and in which order
- Visibility set on resources, groups and bundles, which is what decides who can even see a thing to request it
- Bundles built and maintained: resources and groups added and removed, and the bundle's own visibility
- Owners created and updated, looked up by name as well as by id, and their user lists set
- Group bindings and IdP group mappings read and updated, for keeping Opal aligned with the identity provider
- Tags created and attached to users, groups and resources, and read back per object
- Message channels and on-call schedules listed, created and attached to a group or resource
- User access reviews listed and created, plus apps, their sync errors, non-human identities, users, sessions and the event log
An Opal API token, generated in the Opal dashboard as an Admin under Settings, API Tokens — choose read-only when the agent should only look, and full-access only when it needs to create or change things, and set an expiry. The token is shown once and can be revoked from the same page. Node.js v20 or greater; it starts as npx -y --package opal-mcp -- mcp start --bearer-auth <API_TOKEN>, or from the API_TOKEN environment variable. SERVER_URL defaults to https://api.opal.dev/v1, PORT to 32000 and LOG_LEVEL to info, and a Docker image and standalone binaries are provided as alternatives. MIT.
One command plus a key — npm add opal-mcp, then supply credentials