@orygn/opa-mcp 0.1.4 → 0.1.5

package/dist/tools/helpers/format-write.js

@@ -0,0 +1,111 @@
+/**
+ * `rego_format_write` -- run `opa fmt --write` to format Rego files in place.
+ *
+ * Two-phase execution:
+ *   1. `opa fmt --list` identifies which files are not already canonical.
+ *      If any file cannot be parsed this phase exits non-zero and we bail
+ *      before touching the filesystem.
+ *   2. `opa fmt --write` rewrites only those files (skipping the write when
+ *      dryRun: true).
+ *
+ * NOTE: `--list` and `--write` are mutually exclusive OPA flags -- combining
+ * them suppresses the write. The two calls are intentional.
+ *
+ * Supports `--rego-v1`, `--v0-compatible`, and `--v1-compatible` pass-through.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoFormatWriteInput = {
+    paths: z
+        .array(z.string())
+        .min(1)
+        .describe('Policy files or directories to format in place. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).'),
+    dryRun: z
+        .boolean()
+        .optional()
+        .describe('Preview which files would be reformatted without modifying them. Recommended before the first real run.'),
+    regoV1: z
+        .boolean()
+        .optional()
+        .describe('Format module(s) to be compatible with both Rego v1 and the current OPA version. Adds `import rego.v1` where missing.'),
+    v0Compatible: z
+        .boolean()
+        .optional()
+        .describe('Use OPA behaviors and syntax prior to the v1.0 release.'),
+    v1Compatible: z.boolean().optional().describe('Use OPA v1.0-compatible behaviors.'),
+};
+/**
+ * Parse the newline-delimited stdout produced by `opa fmt --list` into an
+ * array of absolute file paths.
+ */
+export function parseFmtListOutput(stdout) {
+    return stdout
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+}
+export function registerRegoFormatWrite(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_format_write', {
+        title: 'Format Rego files in place',
+        description: 'Run `opa fmt --write` to canonically format one or more Rego files or directories in place. Use `dryRun: true` to preview which files would change without modifying them. Returns a list of files that were (or would be) reformatted. Unlike `rego_format` which returns formatted source as a string, this tool writes directly to disk. Supports `regoV1`, `v0Compatible`, and `v1Compatible` flags for version-specific formatting. If any file cannot be parsed, the operation is aborted and no files are written.',
+        inputSchema: RegoFormatWriteInput,
+    }, async ({ paths, dryRun, regoV1, v0Compatible, v1Compatible }) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths(paths, config, { mustExist: true });
+            if (!validation.ok)
+                return validation.error;
+            const fmtInput = {
+                paths: validation.resolved,
+                regoV1,
+                v0Compatible,
+                v1Compatible,
+            };
+            // Phase 1: identify which files would change. Also validates that all
+            // files parse successfully before we touch the filesystem.
+            const listResult = await opa.fmtList(fmtInput);
+            const listFailure = mapSubprocessFailure(listResult, 'opa');
+            if (listFailure)
+                return listFailure;
+            if (listResult.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa fmt could not parse one or more files.', {
+                    details: { stderr: listResult.stderr.trim(), exitCode: listResult.exitCode },
+                });
+            }
+            const formattedFiles = parseFmtListOutput(listResult.stdout);
+            if (dryRun) {
+                return ok({
+                    formattedFiles,
+                    formattedCount: formattedFiles.length,
+                    dryRun: true,
+                });
+            }
+            // Phase 2: nothing to write -- skip the subprocess call.
+            if (formattedFiles.length === 0) {
+                return ok({
+                    formattedFiles: [],
+                    formattedCount: 0,
+                    dryRun: false,
+                });
+            }
+            // Phase 2: write.
+            const writeResult = await opa.fmtWrite(fmtInput);
+            const writeFailure = mapSubprocessFailure(writeResult, 'opa');
+            if (writeFailure)
+                return writeFailure;
+            if (writeResult.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa fmt --write failed.', {
+                    details: { stderr: writeResult.stderr.trim(), exitCode: writeResult.exitCode },
+                });
+            }
+            return ok({
+                formattedFiles,
+                formattedCount: formattedFiles.length,
+                dryRun: false,
+            });
+        });
+    });
+}
+//# sourceMappingURL=format-write.js.map

package/dist/tools/helpers/format-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-write.js","sourceRoot":"","sources":["../../../src/tools/helpers/format-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,8GAA8G,CAC/G;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yGAAyG,CAC1G;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,uHAAuH,CACxH;IACH,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,yDAAyD,CAAC;IACtE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CACpF,CAAC;AAWF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,2fAA2f;QAC7f,WAAW,EAAE,oBAAoB;KAClC,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QAC9D,OAAO,gBAAgB,CAAwB,MAAM,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,QAAQ,GAAG;gBACf,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,MAAM;gBACN,YAAY;gBACZ,YAAY;aACb,CAAC;YAEF,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,GAAG,CAAC,cAAc,EAAE,4CAA4C,EAAE;oBACvE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE7D,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,CAAwB;oBAC/B,cAAc;oBACd,cAAc,EAAE,cAAc,CAAC,MAAM;oBACrC,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,CAAwB;oBAC/B,cAAc,EAAE,EAAE;oBAClB,cAAc,EAAE,CAAC;oBACjB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;YAED,kBAAkB;YAClB,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjD,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YAEtC,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,CAAC,cAAc,EAAE,yBAAyB,EAAE;oBACpD,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAwB;gBAC/B,cAAc;gBACd,cAAc,EAAE,cAAc,CAAC,MAAM;gBACrC,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQ9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAW3E"}

package/dist/tools/helpers/index.js

@@ -1,7 +1,11 @@
 import { registerRegoCoverageGaps } from './coverage-gaps.js';
 import { registerRegoDescribePolicy } from './describe-policy.js';
 import { registerRegoExplainDecision } from './explain-decision.js';
+import { registerRegoFix } from './fix.js';
+import { registerRegoFormatWrite } from './format-write.js';
 import { registerRegoGenerateTestSkeleton } from './generate-test-skeleton.js';
+import { registerRegoInferInputSchema } from './infer-input-schema.js';
+import { registerRegoPolicyDiff } from './policy-diff.js';
 import { registerRegoSecurityAudit } from './security-audit.js';
 import { registerRegoSuggestFix } from './suggest-fix.js';
 export function registerHelperTools(server, config) {
@@ -11,5 +15,9 @@ export function registerHelperTools(server, config) {
     registerRegoSuggestFix(server, config);
     registerRegoCoverageGaps(server, config);
     registerRegoSecurityAudit(server, config);
+    registerRegoInferInputSchema(server, config);
+    registerRegoFix(server, config);
+    registerRegoFormatWrite(server, config);
+    registerRegoPolicyDiff(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/tools/helpers/infer-input-schema.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoInferInputSchemaOutput {
+    /** JSON Schema draft-07 object describing the inferred input shape. */
+    schema: object;
+    /** Human-readable list of every input.* path found, e.g. ["input.action", "input.user.role"]. */
+    inputPaths: string[];
+    /** Number of .rego files analysed. */
+    filesAnalyzed: number;
+}
+export declare function registerRegoInferInputSchema(server: McpServer, config: Config): void;
+//# sourceMappingURL=infer-input-schema.d.ts.map

package/dist/tools/helpers/infer-input-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-input-schema.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/infer-input-schema.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAkC9C,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;CACvB;AAkGD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyFpF"}

package/dist/tools/helpers/infer-input-schema.js

@@ -0,0 +1,206 @@
+/**
+ * `rego_infer_input_schema` -- statically analyse Rego source and return
+ * a JSON Schema describing every input.* field the policy reads.
+ *
+ * Uses `opa parse --format=json` to get the module AST, then walks the
+ * tree for Ref nodes whose first term is the `input` var. String-keyed
+ * path components become nested object properties; variable-keyed
+ * components (array wildcards like `_`) mark the parent field as an
+ * array type.
+ *
+ * The result is not a validation schema -- it cannot infer scalar types
+ * without semantic analysis -- but it gives the complete set of fields a
+ * policy touches, which is the correct starting point for writing
+ * integration tests or setting up `opa check --schema`.
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoInferInputSchemaInput = {
+    source: z
+        .string()
+        .optional()
+        .describe('Inline Rego source to analyse. Mutually exclusive with paths.'),
+    paths: z
+        .array(z.string())
+        .optional()
+        .describe('Policy files or directories to analyse. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Directories are walked recursively for *.rego files.'),
+};
+/**
+ * Recursively walk an OPA parse AST (arbitrary JSON) and collect every
+ * Ref whose first term is the `input` variable. Each collected ref is an
+ * array of path parts: string for a named key, null for a variable/wildcard.
+ */
+function collectInputRefs(node, refs) {
+    if (node === null || node === undefined || typeof node !== 'object')
+        return;
+    if (Array.isArray(node)) {
+        for (const item of node)
+            collectInputRefs(item, refs);
+        return;
+    }
+    const obj = node;
+    if (obj['type'] === 'ref' && Array.isArray(obj['value'])) {
+        const terms = obj['value'];
+        if (terms.length >= 2 && terms[0]?.type === 'var' && terms[0]?.value === 'input') {
+            const path = [];
+            for (let i = 1; i < terms.length; i++) {
+                const t = terms[i];
+                if (!t)
+                    break;
+                if (t.type === 'string' && typeof t.value === 'string') {
+                    path.push(t.value);
+                }
+                else if (t.type === 'var') {
+                    path.push(null); // array wildcard (e.g. `_` or a named loop variable)
+                }
+                else {
+                    break; // computed/dynamic key -- cannot statically resolve
+                }
+            }
+            if (path.length > 0)
+                refs.push(path);
+        }
+    }
+    for (const val of Object.values(obj)) {
+        collectInputRefs(val, refs);
+    }
+}
+/**
+ * Insert a single input path into the growing schema tree.
+ * A null part signals array access; everything else is an object key.
+ */
+function mergePath(node, path, idx) {
+    if (idx >= path.length)
+        return;
+    const part = path[idx];
+    if (part === null || part === undefined) {
+        if (node.type !== 'array') {
+            node.type = 'array';
+            node.items = { type: 'object', properties: {} };
+            delete node.properties;
+        }
+        if (idx + 1 < path.length && node.items) {
+            mergePath(node.items, path, idx + 1);
+        }
+        return;
+    }
+    if (!node.properties)
+        node.properties = {};
+    if (node.type !== 'array')
+        node.type = 'object';
+    if (!node.properties[part])
+        node.properties[part] = {};
+    if (idx + 1 < path.length)
+        mergePath(node.properties[part], path, idx + 1);
+}
+function buildSchema(allPaths) {
+    const seen = new Set();
+    const root = { type: 'object', properties: {} };
+    for (const path of allPaths) {
+        const key = JSON.stringify(path);
+        if (!seen.has(key)) {
+            seen.add(key);
+            mergePath(root, path, 0);
+        }
+    }
+    return { $schema: 'http://json-schema.org/draft-07/schema#', ...root };
+}
+function pathToString(path) {
+    return 'input.' + path.map((p) => (p === null ? '[]' : p)).join('.');
+}
+async function findRegoFiles(root) {
+    const files = [];
+    const entries = await readdir(root, { withFileTypes: true });
+    for (const entry of entries) {
+        const full = join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...(await findRegoFiles(full)));
+        }
+        else if (entry.isFile() && extname(entry.name) === '.rego') {
+            files.push(full);
+        }
+    }
+    return files;
+}
+export function registerRegoInferInputSchema(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_infer_input_schema', {
+        title: 'Infer input schema',
+        description: 'Statically analyse one or more Rego policies and return a JSON Schema (draft-07) object describing every input.* field the policies read. Uses opa parse for AST-level analysis -- no running OPA server required. Correct starting point for writing integration tests, configuring opa check --schema validation, or documenting a policy API. Accepts inline source, individual files, or directories (walked recursively for *.rego files).',
+        inputSchema: RegoInferInputSchemaInput,
+    }, async ({ source, paths }) => {
+        return withToolEnvelope(config, async () => {
+            if (source === undefined && (!paths || paths.length === 0)) {
+                return err('UNKNOWN_ERROR', 'rego_infer_input_schema requires either source or at least one path.');
+            }
+            const allRefs = [];
+            let filesAnalyzed = 0;
+            if (source !== undefined) {
+                const result = await opa.parse({ source });
+                const failure = mapSubprocessFailure(result, 'opa');
+                if (failure)
+                    return failure;
+                if (result.exitCode !== 0) {
+                    return err('INVALID_REGO', 'opa parse failed -- check the policy for syntax errors.', {
+                        details: { stderr: result.stderr.trim() },
+                    });
+                }
+                const ast = tryParseJson(result.stdout);
+                if (ast)
+                    collectInputRefs(ast, allRefs);
+                filesAnalyzed = 1;
+            }
+            else {
+                const validation = validatePaths(paths, config, { mustExist: true });
+                if (!validation.ok)
+                    return validation.error;
+                const filePaths = [];
+                for (const p of validation.resolved) {
+                    const s = await stat(p);
+                    if (s.isDirectory()) {
+                        filePaths.push(...(await findRegoFiles(p)));
+                    }
+                    else {
+                        filePaths.push(p);
+                    }
+                }
+                for (const filePath of filePaths) {
+                    const result = await opa.run(['parse', '--format=json', filePath]);
+                    const failure = mapSubprocessFailure(result, 'opa');
+                    if (failure)
+                        return failure;
+                    // Skip files that fail to parse (e.g. test files with syntax issues)
+                    // rather than aborting the entire analysis.
+                    if (result.exitCode === 0) {
+                        const ast = tryParseJson(result.stdout);
+                        if (ast) {
+                            collectInputRefs(ast, allRefs);
+                            filesAnalyzed++;
+                        }
+                    }
+                }
+            }
+            const schema = buildSchema(allRefs);
+            const seen = new Set();
+            const inputPaths = [];
+            for (const p of allRefs) {
+                const s = pathToString(p);
+                if (!seen.has(s)) {
+                    seen.add(s);
+                    inputPaths.push(s);
+                }
+            }
+            inputPaths.sort();
+            const warnings = [];
+            if (inputPaths.length === 0) {
+                warnings.push('No input.* references found. The policy may not read from input at all, or may use dynamic keys (e.g. input[key]) that cannot be statically resolved.');
+            }
+            return ok({ schema, inputPaths, filesAnalyzed }, warnings);
+        });
+    });
+}
+//# sourceMappingURL=infer-input-schema.js.map

package/dist/tools/helpers/infer-input-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-input-schema.js","sourceRoot":"","sources":["../../../src/tools/helpers/infer-input-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,yBAAyB,GAAG;IAChC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2JAA2J,CAC5J;CACJ,CAAC;AAsBF;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAa,EAAE,IAAiC;IACxE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAE5E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAc,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,OAAO,EAAE,CAAC;YACjF,MAAM,IAAI,GAAyB,EAAE,CAAC;YACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;qBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,qDAAqD;gBACxE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,oDAAoD;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAgB,EAAE,IAA0B,EAAE,GAAW;IAC1E,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAC/B,MAAM,IAAI,GAA8B,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;YACpB,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,QAAqC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,yCAAyC,EAAE,GAAG,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B;IAC9C,OAAO,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAiB,EAAE,MAAc;IAC5E,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,ibAAib;QACnb,WAAW,EAAE,yBAAyB;KACvC,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAA6B,MAAM,EAAE,KAAK,IAAI,EAAE;YACrE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,GAAG,CACR,eAAe,EACf,sEAAsE,CACvE,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAgC,EAAE,CAAC;YAChD,IAAI,aAAa,GAAG,CAAC,CAAC;YAEtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,yDAAyD,EAAE;wBACpF,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;qBAC1C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,GAAG;oBAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACxC,aAAa,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,aAAa,CAAC,KAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAE5C,MAAM,SAAS,GAAa,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;wBACpB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;yBAAM,CAAC;wBACN,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;oBACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBACpD,IAAI,OAAO;wBAAE,OAAO,OAAO,CAAC;oBAC5B,qEAAqE;oBACrE,4CAA4C;oBAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;wBAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACxC,IAAI,GAAG,EAAE,CAAC;4BACR,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;4BAC/B,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,UAAU,CAAC,IAAI,EAAE,CAAC;YAElB,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,uJAAuJ,CACxJ,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAA6B,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/policy-diff.d.ts

@@ -0,0 +1,41 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+/** Raw value extracted from one side of an OPA eval result. */
+type ResultValue = unknown;
+export interface RegoPolicyDiffOutput {
+    /** The query that was evaluated. */
+    query: string;
+    /** True when resultA and resultB are structurally identical. */
+    equal: boolean;
+    /** Value extracted from policy A's evaluation. Undefined when the query is undefined for that policy. */
+    resultA: ResultValue;
+    /** Value extracted from policy B's evaluation. */
+    resultB: ResultValue;
+    /**
+     * Dot/bracket paths that differ between resultA and resultB.
+     * Empty when equal is true. "." denotes a root-level scalar difference.
+     */
+    changedPaths: string[];
+}
+/**
+ * Extract the meaningful value from `opa eval --format=json` stdout.
+ *
+ * - Single result, single expression: returns expressions[0].value
+ * - Multiple result rows (iteration binding): returns the full result array
+ * - Empty result (`{}` or `{"result":[]}`) or parse failure: returns undefined
+ */
+export declare function extractResultValue(stdout: string): ResultValue;
+/**
+ * Return the set of dot/bracket paths where `a` and `b` differ.
+ *
+ * Rules:
+ * - Identical values (JSON.stringify equal): []
+ * - Different types, nulls, or undefined on either side: [path || '.']
+ * - Both arrays with different lengths: [path || '.']
+ * - Both arrays, same length: recurse per index using `[i]` notation
+ * - Both plain objects: recurse per key using dot notation
+ */
+export declare function diffValues(a: unknown, b: unknown, path?: string): string[];
+export declare function registerRegoPolicyDiff(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=policy-diff.d.ts.map

package/dist/tools/helpers/policy-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-diff.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/policy-diff.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAgD9C,+DAA+D;AAC/D,KAAK,WAAW,GAAG,OAAO,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACnC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,yGAAyG;IACzG,OAAO,EAAE,WAAW,CAAC;IACrB,kDAAkD;IAClD,OAAO,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAwB9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,MAAM,EAAE,CAqCtE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiH9E"}