access-rules-create-access-rule
Creates a new access rule config for the given group_id.
LABSCO SUMMARY
Access administration, including the approvals, as tool calls.
Read and write live behind the same connection here, and the write side reaches the settings that govern access itself — reviewers, reviewer stages, visibility, group membership. That makes the token choice the real decision: a read-only token turns this into an inventory and audit surface over apps, resources, groups and events, while a full-access one lets an agent approve a request or change who reviews a resource. Generate the narrower token first and widen it only for the flows that need it.
What it is
The Opal Security API exposed as tools, generated from its SDK. It covers the objects access management runs on — apps, resources, groups, bundles, owners, requests, tags and reviews — with reads and writes on each.
What you get
- Access requests listed, created, read and approved, so an approval flow can be driven from where the conversation is already happening
- Resources managed end to end: created, updated and deleted; their users added, changed, removed and their access status checked; their non-human identities, tags and scoped role permissions read and set
- Groups the same way, plus group membership, containing groups, resources granted through the group, and its users
- Reviewers and reviewer stages set on both resources and groups — the configuration that decides who has to approve what, and in which order
- Visibility set on resources, groups and bundles, which is what decides who can even see a thing to request it
- Bundles built and maintained: resources and groups added and removed, and the bundle's own visibility
- Owners created and updated, looked up by name as well as by id, and their user lists set
- Group bindings and IdP group mappings read and updated, for keeping Opal aligned with the identity provider
- Tags created and attached to users, groups and resources, and read back per object
- Message channels and on-call schedules listed, created and attached to a group or resource
- User access reviews listed and created, plus apps, their sync errors, non-human identities, users, sessions and the event log
Requirements
An Opal API token, generated in the Opal dashboard as an Admin under Settings, API Tokens — choose read-only when the agent should only look, and full-access only when it needs to create or change things, and set an expiry. The token is shown once and can be revoked from the same page. Node.js v20 or greater; it starts as npx -y --package opal-mcp -- mcp start --bearer-auth <YOUR_API_TOKEN>, or from the API_TOKEN environment variable. SERVER_URL defaults to https://api.opal.dev/v1, PORT to 32000 and LOG_LEVEL to info, and a Docker image and standalone binaries are provided as alternatives. MIT.
Setup effort
One command plus a key — npm add opal-mcp, then supply credentials
USE CASES
01
Handling an access request without opening the dashboard
List the pending requests, read the one in question with its context, and approve it in the same conversation.
02
Answering who has access to a resource
Read the resource, list its users and their access status, and check the tags and scoped role permissions attached to it.
03
Onboarding someone into the right groups
Find the group, add the user, and confirm what that membership grants by reading the resources the group carries.
04
Packaging a role as one requestable bundle
Create the bundle, add the resources and groups that make up the role, and set who can see it.
05
Fixing an approval chain that routes to the wrong people
Read the current reviewers and stages on the resource or group, then set the ones that should be approving.
06
Preparing a user access review
List the reviews already run, create the next one, and pull the event log for the period it covers.
07
Chasing a stale integration
List the connected apps and read the sync errors recorded since the last successful sync, rather than guessing why an object looks wrong.
122 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
access-rules-get-access-rule
Returns a list of access rule config given the group_id of the access rule.
access-rules-update-access-rule
Updates the access rule config for the given group_id.
apps-get-app
Returns an App object.
apps-get-apps
Returns a list of App objects.
apps-get-sync-errors
Returns a list of recent sync errors that have occurred since the last successful sync.
bundles-add-bundle-group
Adds a group to a bundle.
bundles-add-bundle-resource
Adds a resource to a bundle.
bundles-create-bundle
Creates a bundle.
bundles-delete-bundle
Deletes a bundle.
bundles-get-bundle
Returns a Bundle object.
bundles-get-bundle-groups
Returns a list of Group objects in a given bundle.
bundles-get-bundle-resources
Returns a list of Resource objects in a given bundle.
bundles-get-bundle-visibility
Gets the visibility of the bundle.
bundles-get-bundles
Returns a list of Bundle objects.
bundles-remove-bundle-group
Removes a group from a bundle.
bundles-remove-bundle-resource
Removes a resource from a bundle.
bundles-set-bundle-visibility
Sets the visibility of the bundle.
bundles-update-bundle
Updates a bundle.
configuration-templates-create-configuration-template
Creates a configuration template.
configuration-templates-delete-configuration-template
Deletes a configuration template.
configuration-templates-get-configuration-templates
Returns a list of ConfigurationTemplate objects.
configuration-templates-update-configuration-template
Update a configuration template.
events-events
Returns a list of Event objects.
group-bindings-create-group-binding
Creates a group binding.
group-bindings-delete-group-binding
Deletes a group binding.
group-bindings-get-group-binding
Returns a GroupBinding object.
group-bindings-get-group-bindings
Returns a list of GroupBinding objects.
group-bindings-update-group-bindings
Bulk updates a list of group bindings.
groups-add-group-containing-group
Creates a new containing group.
groups-add-group-resource
Adds a resource to a group.
groups-add-group-user
Adds a user to this group.
groups-create-group
Creates an Opal group or imports a remote group.
groups-delete-group
Deletes a group.
groups-delete-group-user
Removes a user's access from this group.
groups-get-group
Returns a Group object.
groups-get-group-containing-group
Gets a specific containing group for a group.
groups-get-group-containing-groups
Gets the list of groups that the group gives access to.
groups-get-group-message-channels
Gets the list of audit and reviewer message channels attached to a group.
groups-get-group-on-call-schedules
Gets the list of on call schedules attached to a group.
groups-get-group-resources
Gets the list of resources that the group gives access to.
groups-get-group-reviewer-stages
Gets the list of reviewer stages for a group.
groups-get-group-reviewers
Gets the list of owner IDs of the reviewers for a group.
groups-get-group-tags
Returns all tags applied to the group.
groups-get-group-users
Gets the list of users for this group.
groups-get-group-visibility
Gets the visibility of this group.
groups-get-groups
Returns a list of groups for your organization.
groups-remove-group-containing-group
Removes a containing group from a group.
groups-set-group-message-channels
Sets the list of audit message channels attached to a group.
groups-set-group-on-call-schedules
Sets the list of on call schedules attached to a group.
groups-set-group-resources
Sets the list of resources that the group gives access to.
groups-set-group-reviewer-stages
Sets the list of reviewer stages for a group.
groups-set-group-reviewers
Sets the list of reviewers for a group.
groups-set-group-visibility
Sets the visibility of this group.
groups-update-group-user
Updates a user's access level or duration in this group.
groups-update-groups
Bulk updates a list of groups.
idp-group-mappings-delete-idp-group-mappings
Deletes an IdpGroupMapping object.
idp-group-mappings-get-idp-group-mappings
Returns the configured set of available IdpGroupMapping objects for an Okta app.
idp-group-mappings-update-idp-group-mappings
Updates the list of available IdpGroupMapping objects for an Okta app.
message-channels-create-message-channel
Creates a MessageChannel objects.
message-channels-get-message-channel
Gets a MessageChannel object.
message-channels-get-message-channels
Returns a list of MessageChannel objects.
non-human-identities-get-nhis
Returns a list of non-human identities for your organization.
on-call-schedules-create-on-call-schedule
Creates a OnCallSchedule objects.
on-call-schedules-get-on-call-schedule
Gets a OnCallSchedule object.
on-call-schedules-get-on-call-schedules
Returns a list of OnCallSchedule objects.
owners-create-owner
Creates an owner.
owners-delete-owner
Deletes an owner.
owners-get-owner
Returns an Owner object.
owners-get-owner-from-name
Returns an Owner object. Does not support owners with / in their name, use /owners?name=... instead.
owners-get-owner-users
Gets the list of users for this owner, in escalation priority order if applicable.
owners-get-owners
Returns a list of Owner objects.
owners-set-owner-users
Sets the list of users for this owner. If escalation is enabled, the order of this list is the escalation priority order of the users. If the owner has a source group, adding or removing users from this list won't be possible.
owners-update-owners
Bulk updates a list of owners.
requests-approve-request
Approve an access request
requests-create-request
Create an access request
requests-get-request
Returns a request by ID.
requests-get-requests
Returns a list of requests for your organization that is visible by the admin.
requests-get-requests-relay
Returns a paginated list of requests using Relay-style cursor pagination.
resources-add-resource-nhi
Gives a non-human identity access to this resource.
resources-add-resource-user
Adds a user to this resource.
resources-create-resource
Creates a resource. See here for details about importing resources.
resources-delete-resource
Deletes a resource.
resources-delete-resource-nhi
Removes a non-human identity's direct access from this resource.
resources-delete-resource-user
Removes a user's direct access from this resource.
resources-get-resource
Retrieves a resource.
resources-get-resource-message-channels
Gets the list of audit message channels attached to a resource.
resources-get-resource-nhis
Gets the list of non-human identities with access to this resource.
resources-get-resource-reviewer-stages
Gets the list reviewer stages for a resource.
resources-get-resource-reviewers
Gets the list of owner IDs of the reviewers for a resource.
resources-get-resource-scoped-role-permissions
Returns all the scoped role permissions that apply to the given resource. Only OPAL_SCOPED_ROLE resource type supports this field.
resources-get-resource-tags
Returns all tags applied to the resource.
resources-get-resource-user
Returns information about a specific user's access to a resource.
resources-get-resource-users
Gets the list of users for this resource.
resources-get-resource-visibility
Gets the visibility of this resource.
resources-get-resources
Returns a list of resources for your organization.
resources-resource-user-access-status-retrieve
Get user's access status to a resource.
resources-set-resource-message-channels
Sets the list of audit message channels attached to a resource.
resources-set-resource-reviewer-stages
Sets the list of reviewer stages for a resource.
resources-set-resource-reviewers
Sets the list of reviewers for a resource.
resources-set-resource-scoped-role-permissions
Sets all the scoped role permissions on an OPAL_SCOPED_ROLE resource.
resources-set-resource-visibility
Sets the visibility of this resource.
resources-update-resource-user
Updates a user's access level or duration on this resource.
resources-update-resources
Bulk updates a list of resources.
sessions-sessions
Returns a list of Session objects.
tags-add-group-tag
Applies a tag to a group.
tags-add-resource-tag
Applies a tag to a resource.
tags-add-user-tag
Applies a tag to a user.
tags-create-tag
Creates a tag with the given key and value.
tags-delete-tag-by-ID
UNSTABLE. May be removed at any time. Deletes a tag with the given id.
tags-get-tag
Gets a tag with the given key and value.
tags-get-tag-by-ID
UNSTABLE. May be removed at any time. Gets a tag with the given id.
tags-get-tags
Returns a list of tags created by your organization.
tags-remove-group-tag
Removes a tag from a group.
tags-remove-resource-tag
Removes a tag from a resource.
tags-remove-user-tag
Removes a tag from a user.
uars-create-uar
Starts a User Access Review.
uars-get-UA-rs
Returns a list of UAR objects.
uars-get-uar
Retrieves a specific UAR.
users-get-user-tags
Returns all tags applied to the user.
users-get-users
Returns a list of users for your organization.
users-user
Retrieves detailed user information from Opal. This endpoint is designed to fetch user details by either user ID (UUID) or email address. The endpoint follows a strict precedence rule where user_id takes priority over email if both are provided.
Key Implementation Notes:
- Exactly one identifier (user_id OR email) must be provided
- Returns a complete User object with all associated metadata
- Suitable for user verification and profile data retrieval
- Recommended for MCP user synchronization workflows
Authentication:
- Requires valid API authentication
- Respects standard Opal authorization rules
BEFORE YOU INSTALL
What to know first
Tools you get
122 tools when we connected. getGroupReviewers, setGroupReviewers, getGroupReviewerStages, setGroupReviewerStages, getRequestsRelay and resourceUserAccessStatusRetrieve are deprecated but still registered; getTagByID and deleteTagByID are marked unstable.
Requires
- Node.js v20 or greater
- API_TOKEN in your environment
Where it runs
Both documented clients run the server on your machine.
CONTEXT COST
Heavy Standing cost
Rated by the size of the 122 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npm add opal-mcpMCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"OpalMcp": {
"command": "npx",
"args": [
"-y",
"--package",
"opal-mcp",
"--",
"mcp",
"start",
"--bearer-auth",
"<YOUR_API_TOKEN>"
]
}
}
}
