@orygn/opa-mcp 0.1.9 → 0.1.10

package/dist/tools/conftest/test.js

@@ -0,0 +1,186 @@
+/**
+ * `conftest_test` -- evaluate configuration files against Rego policies
+ * using the `conftest test` command.
+ *
+ * Conftest is the standard CLI for policy-as-code testing of Kubernetes
+ * manifests, Terraform plans, Dockerfiles, Helm charts, and any other
+ * structured configuration. This tool surfaces pass/fail/warn results
+ * per file and per namespace so an LLM can explain exactly which policies
+ * fired and why.
+ *
+ * Exit code mapping:
+ *   null  -- conftest binary not found → CONFTEST_NOT_FOUND
+ *   0     -- all tests pass (ok: true, passed: true)
+ *   1     -- one or more failures (ok: true, passed: false)
+ *   2+    -- command error (bad args, policy not found, etc.)
+ */
+import { z } from 'zod';
+import { ConftestCli } from '../../lib/conftest-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const ConftestTestInput = {
+    files: z
+        .array(z.string())
+        .optional()
+        .describe('Filesystem paths to configuration files to evaluate (YAML, JSON, HCL, Dockerfile, etc.). ' +
+        'Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
+        'Mutually exclusive with `inlineConfig`.'),
+    inlineConfig: z
+        .string()
+        .optional()
+        .describe('Inline configuration content to evaluate (e.g. a Kubernetes manifest as a YAML string). ' +
+        'Mutually exclusive with `files`. Defaults to YAML format; set `inlineConfigParser` to override.'),
+    inlineConfigParser: z
+        .string()
+        .optional()
+        .describe('Parser to use for `inlineConfig`. Valid values: yaml (default), json, toml, hcl1, hcl2, ' +
+        'ini, xml, dotenv, cue, jsonnet, properties, dockerfile. ' +
+        "Ignored when `files` is used (conftest infers the parser from each file's extension)."),
+    policy: z
+        .string()
+        .optional()
+        .describe('Path to a directory or file containing Rego policies. ' +
+        'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
+        'Mutually exclusive with `inlinePolicy`. ' +
+        'Omit to let conftest use its default `./policy` directory.'),
+    inlinePolicy: z
+        .string()
+        .optional()
+        .describe('Inline Rego policy source. Written to a temporary directory and passed as `--policy`. ' +
+        'The policy should declare `package main` (or match the `namespace` parameter). ' +
+        'Mutually exclusive with `policy`.'),
+    namespace: z
+        .string()
+        .optional()
+        .describe('Rego namespace (package name) to test against. Defaults to `main`. ' +
+        'Use `allNamespaces: true` to test all discovered namespaces instead.'),
+    allNamespaces: z
+        .boolean()
+        .optional()
+        .describe('Test policies found in all discovered namespaces. Overrides `namespace`.'),
+    data: z
+        .array(z.string())
+        .optional()
+        .describe('Paths to directories from which additional data will be loaded for the Rego policies. ' +
+        'Each path must be inside an allowed root.'),
+    combine: z
+        .boolean()
+        .optional()
+        .describe('Combine all configuration files into a single input document before evaluating. ' +
+        'Useful when policies need to inspect relationships across multiple files.'),
+    failOnWarn: z
+        .boolean()
+        .optional()
+        .describe('Return `passed: false` even when only warnings (no hard failures) are present.'),
+};
+export function registerConftestTest(server, config) {
+    const conftest = new ConftestCli(config);
+    server.registerTool('conftest_test', {
+        title: 'Conftest test',
+        description: 'Evaluate configuration files (Kubernetes manifests, Terraform plans, Dockerfiles, Helm ' +
+            'charts, or any YAML/JSON/HCL/TOML/INI) against Rego policies using `conftest test`. ' +
+            'Returns per-file, per-namespace pass/fail/warn results so you can pinpoint exactly which ' +
+            'policy rules fired. Requires `conftest` on PATH or `CONFTEST_BINARY` set; returns ' +
+            'CONFTEST_NOT_FOUND otherwise. ' +
+            'Provide config via `files` (disk paths) or `inlineConfig` (inline string). ' +
+            'Provide policy via `policy` (disk path) or `inlinePolicy` (inline Rego source). ' +
+            "Omit `policy` and `inlinePolicy` to use conftest's default `./policy` directory.",
+        inputSchema: ConftestTestInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (input, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // ── Mutual exclusion checks ──────────────────────────────────────
+            if (input.files?.length && input.inlineConfig !== undefined) {
+                return err('INVALID_INPUT', '`files` and `inlineConfig` are mutually exclusive.');
+            }
+            if (!input.files?.length && input.inlineConfig === undefined) {
+                return err('INVALID_INPUT', 'Provide either `files` (array of config file paths) or `inlineConfig` (inline config string).');
+            }
+            if (input.policy !== undefined && input.inlinePolicy !== undefined) {
+                return err('INVALID_INPUT', '`policy` and `inlinePolicy` are mutually exclusive.');
+            }
+            // ── Path validation ──────────────────────────────────────────────
+            if (input.files?.length) {
+                const v = validatePaths(input.files, config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, files: v.resolved };
+            }
+            if (input.policy !== undefined) {
+                const v = validatePaths([input.policy], config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, policy: v.resolved[0] };
+            }
+            if (input.data?.length) {
+                const v = validatePaths(input.data, config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, data: v.resolved };
+            }
+            // ── Run conftest ─────────────────────────────────────────────────
+            const result = await conftest.test({
+                files: input.files,
+                inlineConfig: input.inlineConfig,
+                inlineConfigParser: input.inlineConfigParser,
+                policy: input.policy,
+                inlinePolicy: input.inlinePolicy,
+                namespace: input.namespace,
+                allNamespaces: input.allNamespaces,
+                data: input.data,
+                combine: input.combine,
+                failOnWarn: input.failOnWarn,
+            }, signal);
+            // ── Map universal subprocess failures ────────────────────────────
+            const subprocessFailure = mapSubprocessFailure(result, 'conftest');
+            if (subprocessFailure)
+                return subprocessFailure;
+            // ── Exit code 0 / 1: parse JSON results ─────────────────────────
+            // Exit 0 = all pass, exit 1 = failures present.
+            // Both produce valid JSON on stdout.
+            if (result.exitCode === 0 || result.exitCode === 1) {
+                const parsed = tryParseJson(result.stdout);
+                if (!parsed || !Array.isArray(parsed)) {
+                    return err('UNKNOWN_ERROR', 'conftest test produced no parseable JSON output.', {
+                        details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
+                    });
+                }
+                const summary = buildSummary(parsed);
+                return ok({
+                    passed: result.exitCode === 0,
+                    results: parsed,
+                    summary,
+                });
+            }
+            // ── Exit code 2+: command-level error ────────────────────────────
+            // Examples: policy directory not found, malformed Rego syntax,
+            // unknown --parser value, etc.
+            const detail = result.stderr.trim() || result.stdout.trim();
+            return err('UNKNOWN_ERROR', `conftest test failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+        });
+    });
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function buildSummary(results) {
+    let passed = 0;
+    let failed = 0;
+    let warnings = 0;
+    let skipped = 0;
+    for (const r of results) {
+        if (r.failures.length > 0) {
+            failed++;
+        }
+        else {
+            passed++;
+        }
+        warnings += r.warnings.length;
+        skipped += r.skipped.length;
+    }
+    return { passed, failed, warnings, skipped };
+}
+//# sourceMappingURL=test.js.map

package/dist/tools/conftest/test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F;QACzF,oEAAoE;QACpE,yCAAyC,CAC5C;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,iGAAiG,CACpG;IACH,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,0DAA0D;QAC1D,uFAAuF,CAC1F;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wDAAwD;QACtD,0DAA0D;QAC1D,0CAA0C;QAC1C,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,iFAAiF;QACjF,mCAAmC,CACtC;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,sEAAsE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF;QAChF,2EAA2E,CAC9E;IACH,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC;AAmBF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,yFAAyF;YACzF,sFAAsF;YACtF,2FAA2F;YAC3F,oFAAoF;YACpF,gCAAgC;YAChC,6EAA6E;YAC7E,kFAAkF;YAClF,kFAAkF;QACpF,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,GAAG,CACR,eAAe,EACf,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACrF,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,EACD,MAAM,CACP,CAAC;YAEF,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,mEAAmE;YACnE,gDAAgD;YAChD,qCAAqC;YACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAuB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,EAAE;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAqB;oBAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO,EAAE,MAAM;oBACf,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,+DAA+D;YAC/D,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAA6B;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/tools/conftest/verify.d.ts

@@ -0,0 +1,21 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+import { type ConftestFileResult } from '../../lib/conftest-cli.js';
+export interface ConftestVerifyOutput {
+    /** `true` when all `test_*` rules in all test files pass. */
+    passed: boolean;
+    /** Per-test-file results. */
+    results: ConftestFileResult[];
+    summary: {
+        /** Number of test files with zero failures. */
+        passed: number;
+        /** Number of test files with at least one failure. */
+        failed: number;
+        /** Total test cases that passed (sum of `successes` across all files). */
+        totalPassed: number;
+        /** Total test cases that failed (sum of `failures` across all files). */
+        totalFailed: number;
+    };
+}
+export declare function registerConftestVerify(server: McpServer, config: Config): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/tools/conftest/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA8BjF,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,6BAA6B;IAC7B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,+CAA+C;QAC/C,MAAM,EAAE,MAAM,CAAC;QACf,sDAAsD;QACtD,MAAM,EAAE,MAAM,CAAC;QACf,0EAA0E;QAC1E,WAAW,EAAE,MAAM,CAAC;QACpB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyE9E"}

package/dist/tools/conftest/verify.js

@@ -0,0 +1,112 @@
+/**
+ * `conftest_verify` -- run the `_test.rego` unit tests that live inside
+ * a conftest policy directory.
+ *
+ * Conftest verify is conftest's equivalent of `opa test`: it evaluates
+ * rules whose names begin with `test_` inside `*_test.rego` files within
+ * the policy directory. Use this to confirm that the policies themselves
+ * are correct before deploying them.
+ *
+ * Exit code mapping (same as conftest_test):
+ *   null  -- binary not found → CONFTEST_NOT_FOUND
+ *   0     -- all tests pass
+ *   1     -- one or more test failures
+ *   2+    -- command error
+ */
+import { z } from 'zod';
+import { ConftestCli } from '../../lib/conftest-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const ConftestVerifyInput = {
+    policy: z
+        .string()
+        .optional()
+        .describe('Path to the directory containing both the Rego policies and the `*_test.rego` test files. ' +
+        'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
+        "Omit to use conftest's default `./policy` directory."),
+    namespace: z
+        .string()
+        .optional()
+        .describe('Namespace to verify. Defaults to `main`. Omit to verify all namespaces.'),
+    data: z
+        .array(z.string())
+        .optional()
+        .describe('Paths to data directories. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).'),
+};
+export function registerConftestVerify(server, config) {
+    const conftest = new ConftestCli(config);
+    server.registerTool('conftest_verify', {
+        title: 'Conftest verify',
+        description: 'Run the `test_*` rules inside `*_test.rego` files within a conftest policy directory, ' +
+            'verifying that the policies themselves are correct. Equivalent to `opa test` but using ' +
+            "conftest's policy-loading machinery. Returns per-file pass/fail results. " +
+            'Requires `conftest` on PATH or `CONFTEST_BINARY` set; returns CONFTEST_NOT_FOUND otherwise.',
+        inputSchema: ConftestVerifyInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (input, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // ── Path validation ──────────────────────────────────────────────
+            if (input.policy !== undefined) {
+                const v = validatePaths([input.policy], config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, policy: v.resolved[0] };
+            }
+            if (input.data?.length) {
+                const v = validatePaths(input.data, config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, data: v.resolved };
+            }
+            // ── Run conftest verify ──────────────────────────────────────────
+            const result = await conftest.verify({
+                policy: input.policy,
+                namespace: input.namespace,
+                data: input.data,
+            }, signal);
+            const subprocessFailure = mapSubprocessFailure(result, 'conftest');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode === 0 || result.exitCode === 1) {
+                const parsed = tryParseJson(result.stdout);
+                if (!parsed || !Array.isArray(parsed)) {
+                    return err('UNKNOWN_ERROR', 'conftest verify produced no parseable JSON output.', {
+                        details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
+                    });
+                }
+                const summary = buildVerifySummary(parsed);
+                return ok({
+                    passed: result.exitCode === 0,
+                    results: parsed,
+                    summary,
+                });
+            }
+            const detail = result.stderr.trim() || result.stdout.trim();
+            return err('UNKNOWN_ERROR', `conftest verify failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+        });
+    });
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function buildVerifySummary(results) {
+    let passed = 0;
+    let failed = 0;
+    let totalPassed = 0;
+    let totalFailed = 0;
+    for (const r of results) {
+        if (r.failures.length > 0) {
+            failed++;
+        }
+        else {
+            passed++;
+        }
+        totalPassed += r.successes;
+        totalFailed += r.failures.length;
+    }
+    return { passed, failed, totalPassed, totalFailed };
+}
+//# sourceMappingURL=verify.js.map

package/dist/tools/conftest/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F;QAC1F,0DAA0D;QAC1D,sDAAsD,CACzD;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,yEAAyE,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,yFAAyF,CAC1F;CACJ,CAAC;AAmBF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,wFAAwF;YACxF,yFAAyF;YACzF,2EAA2E;YAC3E,6FAA6F;QAC/F,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAuB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,EAAE;wBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC3C,OAAO,EAAE,CAAuB;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO,EAAE,MAAM;oBACf,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,yCAAyC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACrE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,OAA6B;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;QACD,WAAW,IAAI,CAAC,CAAC,SAAS,CAAC;QAC3B,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/tools/index.d.ts

@@ -5,7 +5,7 @@
  * here in order; ordering doesn't affect behavior but keeps the
  * declaration site tidy.
  *
- * Tools planned (see SPEC.md / per-tool docs):
+ * Tools (47 total):
  *   Category A -- Authoring:        rego_format, rego_check, rego_lint,
  *                                   rego_parse_ast, rego_inspect,
  *                                   rego_capabilities, rego_deps
@@ -13,13 +13,14 @@
  *                                   rego_eval_with_profile,
  *                                   rego_eval_with_coverage, rego_test,
  *                                   rego_bench, rego_compile_query
- *   Category C -- Bundles:          opa_bundle_build, opa_bundle_sign
+ *   Category C -- Bundles:          opa_bundle_build, opa_bundle_sign,
+ *                                   opa_bundle_verify, opa_exec
  *   Category D -- Server mgmt:      opa_list_policies, opa_get_policy,
  *                                   opa_put_policy, opa_delete_policy,
  *                                   opa_get_data, opa_put_data,
- *                                   opa_patch_data, opa_query_decision,
- *                                   opa_compile_query, opa_health,
- *                                   opa_status, opa_config
+ *                                   opa_patch_data, opa_delete_data,
+ *                                   opa_query_decision, opa_compile_query,
+ *                                   opa_health, opa_status, opa_config
  *   Category E -- Helpers:          rego_explain_decision,
  *                                   rego_generate_test_skeleton,
  *                                   rego_describe_policy,
@@ -27,10 +28,11 @@
  *                                   rego_coverage_gaps,
  *                                   rego_security_audit,
  *                                   rego_infer_input_schema,
- *                                   rego_fix,
- *                                   rego_format_write,
- *                                   rego_policy_diff
- *   Category F -- Meta:             mcp_server_info
+ *                                   rego_fix, rego_format_write,
+ *                                   rego_migrate_v1, rego_policy_diff
+ *   Category F -- Conftest:         conftest_test, conftest_verify,
+ *                                   conftest_pull, conftest_push
+ *   Category G -- Meta:             mcp_server_info
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../config.js';

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAQ3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAOrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrE"}

package/dist/tools/index.js

@@ -1,5 +1,6 @@
 import { registerAuthoringTools } from './authoring/index.js';
 import { registerBundleTools } from './bundles/index.js';
+import { registerConftestTools } from './conftest/index.js';
 import { registerEvaluationTools } from './evaluation/index.js';
 import { registerHelperTools } from './helpers/index.js';
 import { registerMetaTools } from './meta/index.js';
@@ -10,6 +11,7 @@ export function registerTools(server, config) {
     registerBundleTools(server, config);
     registerServerManagementTools(server, config);
     registerHelperTools(server, config);
+    registerConftestTools(server, config);
     registerMetaTools(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/types.d.ts

@@ -2,7 +2,7 @@
  * Shared types used across tools, prompts, and resources.
  */
 /** Standard error codes returned by tools. */
-export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'HTTP_SEND_BLOCKED' | 'TIMEOUT' | 'CANCELLED' | 'UNKNOWN_ERROR';
+export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'HTTP_SEND_BLOCKED' | 'TIMEOUT' | 'CANCELLED' | 'UNKNOWN_ERROR';
 /** Structured error payload. */
 export interface ToolError {
     code: ToolErrorCode;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orygn/opa-mcp",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "mcpName": "io.github.OrygnsCode/opa-mcp",
   "description": "Model Context Protocol server for Open Policy Agent (OPA). Author, validate, debug, and explain Rego policies through any MCP-compatible client.",
   "type": "module",