@orygn/opa-mcp 0.3.0 → 0.5.0

package/README.md

@@ -22,10 +22,20 @@ environment.
 +--------------------+  52 tools  +-----------------+            +---------------------+
 ```
 
-> **Status:** v0.3.0. Tool surface, error codes, and
+> **Status:** v0.4.0. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
+> **Upgrading to 0.4.0:** subprocesses no longer inherit the server's
+> environment. A policy that read a variable through `opa.runtime().env`
+> will no longer see it; name the variable in `OPA_MCP_PASSTHROUGH_ENV` if
+> it is genuinely needed. See the security section for why.
+
+> **Upgrading to 0.3.0:** the bundled OPA is now 1.19, so Rego v0 policies
+> no longer parse (`if` is required before a rule body, `contains` before a
+> partial set). Run `rego_migrate_v1` to convert them. If you supply your own
+> binary via `OPA_BINARY` or `PATH`, nothing changes.
+
 ---
 
 ## Table of contents
@@ -66,7 +76,7 @@ Once an MCP client is connected, an agent can:
   deployable bundle, optionally signing it. Output is a regular `.tar.gz`
   the agent can hand to your delivery system.
 - **Lint.** `rego_lint` runs Regal across a directory or a single file
-  and returns categorized findings (style, bugs, performance, idioms).
+  and returns each finding with its category, level and location.
 
 A walk-through of a typical session lives in [Cookbook](#cookbook).
 
@@ -225,8 +235,10 @@ which opa && which regal                                    # macOS / Linux
 Get-Command opa, regal | Select-Object Source              # Windows
 ```
 
-This does not affect the **Docker** or **MCPB** install paths; those
-ship `opa` and `regal` inside the bundle and bypass `PATH` entirely.
+This does not affect the **Docker** install path, which ships `opa` and
+`regal` in the image and bypasses `PATH` entirely. The **MCPB** bundle
+carries neither, and unlike the npm install has no bundled fallback: set
+`OPA_BINARY` or put `opa` on `PATH`.
 See [Troubleshooting](#troubleshooting) for full detail.
 
 ## Configuration
@@ -235,20 +247,23 @@ The server reads its configuration from environment variables. Every
 variable is optional; defaults are sensible for a local OPA on
 `http://localhost:8181`.
 
-| Variable                     | Default                      | Purpose                                                                                                                                                                                                                                                                 |
-| ---------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `OPA_URL`                    | `http://localhost:8181`      | Base URL of an OPA REST endpoint, used by `opa_*` tools.                                                                                                                                                                                                                |
-| `OPA_TOKEN`                  | _(unset)_                    | Bearer token for OPA, if your instance requires auth. Treated as a secret. Never echoed in logs or tool responses.                                                                                                                                                      |
-| `OPA_BINARY`                 | `opa` (on `PATH`)            | Path to the `opa` CLI, used by `rego_*` tools.                                                                                                                                                                                                                          |
-| `REGAL_BINARY`               | `regal` (on `PATH`)          | Path to the `regal` linter. Only required by `rego_lint`.                                                                                                                                                                                                               |
-| `CONFTEST_BINARY`            | `conftest` (on `PATH`)       | Path to the `conftest` binary. Only required by `conftest_*` tools. Returns `CONFTEST_NOT_FOUND` if absent.                                                                                                                                                             |
-| `OPA_MCP_ALLOWED_PATHS`      | _(unset)_                    | Comma- or semicolon-separated list of directories the server is allowed to read policies from. **When unset, file-based tools refuse to read from disk.**                                                                                                               |
-| `OPA_MCP_LOG_FILE`           | `<tmpdir>/orygn-opa-mcp.log` | Path the server appends logs to. The server never writes to stdout; that channel is reserved for the MCP protocol.                                                                                                                                                      |
-| `OPA_MCP_LOG_LEVEL`          | `info`                       | One of `debug`, `info`, `warn`, `error`.                                                                                                                                                                                                                                |
-| `OPA_MCP_MAX_RESPONSE_BYTES` | `100000`                     | Hard cap on a single tool response. Larger payloads are truncated with a `__truncated: true` marker.                                                                                                                                                                    |
-| `OPA_MCP_TIMEOUT_MS`         | `30000`                      | Hard timeout for any spawned subprocess (`opa`, `regal`). After this, the child gets `SIGTERM` and then `SIGKILL`.                                                                                                                                                      |
-| `OPA_MCP_HTTP_TIMEOUT_MS`    | `15000`                      | Timeout for HTTP requests to the OPA REST API.                                                                                                                                                                                                                          |
-| `OPA_MCP_NO_TELEMETRY`       | _(unset)_                    | Set to `1` to disable the anonymous startup ping. The ping sends the server version, OS platform, and a random install ID. The install ID is stored at `~/.orygn/opa-mcp/install-id` and is generated once on first run. No policy content or file paths are ever sent. |
+| Variable                       | Default                      | Purpose                                                                                                                                                                                                                                                                                      |
+| ------------------------------ | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OPA_URL`                      | `http://localhost:8181`      | Base URL of an OPA REST endpoint, used by `opa_*` tools.                                                                                                                                                                                                                                     |
+| `OPA_TOKEN`                    | _(unset)_                    | Bearer token for OPA, if your instance requires auth. Treated as a secret. Never echoed in logs or tool responses.                                                                                                                                                                           |
+| `OPA_BINARY`                   | `opa` (on `PATH`)            | Path to the `opa` CLI, used by `rego_*` tools.                                                                                                                                                                                                                                               |
+| `REGAL_BINARY`                 | `regal` (on `PATH`)          | Path to the `regal` linter. Required by `rego_lint`, `rego_fix`, and `rego_security_audit`.                                                                                                                                                                                                  |
+| `CONFTEST_BINARY`              | `conftest` (on `PATH`)       | Path to the `conftest` binary. Only required by `conftest_*` tools. Returns `CONFTEST_NOT_FOUND` if absent.                                                                                                                                                                                  |
+| `OPA_MCP_ALLOWED_PATHS`        | _(unset)_                    | Comma- or semicolon-separated list of directories the server is allowed to read policies from. **When unset, file-based tools refuse to read from disk.**                                                                                                                                    |
+| `OPA_MCP_LOG_FILE`             | `<tmpdir>/orygn-opa-mcp.log` | Path the server appends logs to. The server never writes to stdout; that channel is reserved for the MCP protocol.                                                                                                                                                                           |
+| `OPA_MCP_LOG_LEVEL`            | `info`                       | One of `debug`, `info`, `warn`, `error`.                                                                                                                                                                                                                                                     |
+| `OPA_MCP_MAX_RESPONSE_BYTES`   | `100000`                     | Hard cap on a single tool response. Larger payloads are truncated with a `__truncated: true` marker.                                                                                                                                                                                         |
+| `OPA_MCP_TIMEOUT_MS`           | `30000`                      | Hard timeout for any spawned subprocess (`opa`, `regal`). After this, the child gets `SIGTERM` and then `SIGKILL`.                                                                                                                                                                           |
+| `OPA_MCP_HTTP_TIMEOUT_MS`      | `15000`                      | Timeout for HTTP requests to the OPA REST API.                                                                                                                                                                                                                                               |
+| `OPA_MCP_NO_TELEMETRY`         | _(unset)_                    | Set to `1` to disable the anonymous startup ping. The ping sends the server version, OS platform, and a random install ID. The install ID is stored at `~/.orygn/opa-mcp/install-id` and is generated once on first run. No policy content or file paths are ever sent.                      |
+| `OPA_MCP_MAX_SUBPROCESS_BYTES` | `33554432` (32 MiB)          | Maximum bytes captured from a subprocess's stdout and stderr, counted separately. On overflow the stream is clamped, the child is stopped, and the tool returns `OUTPUT_TOO_LARGE`. Distinct from `OPA_MCP_MAX_RESPONSE_BYTES`, which trims the reply after the output is already in memory. |
+| `OPA_MCP_PASSTHROUGH_ENV`      | _(unset)_                    | Comma-separated variable names to pass through to `opa`, `regal` and `conftest`. Everything else is withheld. **Anything named here is readable by any policy the server evaluates**, via `opa.runtime().env`, so use it only for values that are safe in that position.                     |
+| `OPA_MCP_BLOCK_ENV`            | _(unset)_                    | Comma-separated variable names to withhold from `opa`, `regal` and `conftest` even when they are on the built-in allow-list. Applied last, so it also overrides `OPA_MCP_PASSTHROUGH_ENV`. Use it to drop the proxy variables, which can carry credentials, at the cost of proxy support.    |
 
 Paths in `OPA_MCP_ALLOWED_PATHS` and the `*_BINARY` variables must be
 absolute. Relative paths and missing binaries are rejected with structured
@@ -265,11 +280,10 @@ Every tool returns a JSON envelope:
 
 Stable error codes: `INVALID_INPUT`, `INVALID_REGO`, `INVALID_BUNDLE`,
 `EVAL_ERROR`, `OPA_BINARY_NOT_FOUND`, `REGAL_NOT_FOUND`,
-`REGAL_VERSION_TOO_OLD`, `CONFTEST_NOT_FOUND`, `OPA_UNREACHABLE`,
-`OPA_AUTH_FAILED`, `POLICY_NOT_FOUND`, `DATA_NOT_FOUND`, `PATH_NOT_ALLOWED`,
-`PATH_NOT_FOUND`, `DEPENDENCY_CONFLICT`, `NO_TESTS_FOUND`,
-`COVERAGE_BELOW_THRESHOLD`, `OPA_VERSION_UNSUPPORTED`, `VERIFY_INCONCLUSIVE`,
-`Z3_INIT_ERROR`, `GITHUB_TOKEN_MISSING`, `GIST_CREATE_FAILED`, `TIMEOUT`,
+`CONFTEST_NOT_FOUND`, `OPA_UNREACHABLE`, `OPA_AUTH_FAILED`,
+`POLICY_NOT_FOUND`, `DATA_NOT_FOUND`, `PATH_NOT_ALLOWED`, `PATH_NOT_FOUND`,
+`NO_TESTS_FOUND`, `COVERAGE_BELOW_THRESHOLD`, `OPA_VERSION_UNSUPPORTED`,
+`GITHUB_TOKEN_MISSING`, `GIST_CREATE_FAILED`, `OUTPUT_TOO_LARGE`, `TIMEOUT`,
 `CANCELLED`, `UNKNOWN_ERROR`.
 
 ### Category A: Authoring & static analysis
@@ -282,10 +296,10 @@ Operate on Rego source code without needing a running OPA server. Wrap
 | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `rego_format`       | Format Rego source. Wraps `opa fmt`. Idempotent.                                                                                                                                                        |
 | `rego_check`        | Type-check and validate Rego. Wraps `opa check`.                                                                                                                                                        |
-| `rego_lint`         | Run Regal across a file or directory. Returns findings grouped by category. **Requires `regal` on `PATH` or `REGAL_BINARY` set.**                                                                       |
+| `rego_lint`         | Run Regal across a file or directory. Returns each violation with its category, level and location. **Requires `regal` on `PATH` or `REGAL_BINARY` set.**                                               |
 | `rego_parse_ast`    | Parse Rego to AST JSON. Wraps `opa parse`.                                                                                                                                                              |
 | `rego_inspect`      | Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.                                                                                                                       |
-| `rego_capabilities` | Return the capabilities (built-ins, future keywords) understood by the bundled OPA.                                                                                                                     |
+| `rego_capabilities` | List the built-ins and features the resolved `opa` binary understands (`OPA_BINARY`, then `PATH`, then the bundled copy)                                                                                |
 | `rego_deps`         | Static dependency analysis: rule-level data references and cross-package calls.                                                                                                                         |
 | `rego_migrate_v1`   | Migrate Rego v0 source to v1 syntax. Runs `opa fmt --rego-v1` then validates with `opa check --v1-compatible`. Returns `{ original, migrated, changed, valid, errors }`.                                |
 | `rego_check_schema` | Check Rego against a JSON Schema. Validates that every `input.*` field the policy reads exists in the schema using `opa check --schema`. Accepts inline schema or a path to a JSON Schema file on disk. |
@@ -295,7 +309,7 @@ Operate on Rego source code without needing a running OPA server. Wrap
 ```jsonc
 // Input
 {
-  "source": "package x\nallow{input.user==\"admin\"}"
+  "source": "package x\nallow if input.user==\"admin\""
 }
 
 // Output (ok)
@@ -338,17 +352,17 @@ Operate on Rego source code without needing a running OPA server. Wrap
 Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 `opa bench`.
 
-| Tool                      | What it does                                                                                                                                                                                                 |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.                                                                                                                                      |
-| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                                                                                                                                                |
-| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.                                                                                                                                  |
-| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                                                                                                                                                     |
-| `rego_test`               | Run `opa test` over a directory. Returns pass/fail per test, with optional coverage.                                                                                                                         |
-| `rego_bench`              | Run `opa bench` and return statistical timing data.                                                                                                                                                          |
-| `rego_compile_query`      | Partially evaluate a query against a policy.                                                                                                                                                                 |
-| `opa_exec`                | Batch-evaluate a decision against multiple input files. Returns per-file results with `successCount` and `errorCount`.                                                                                       |
-| `rego_test_multiroot`     | Run Rego tests across multiple roots. Solves OPA's package-conflict problem for repos with multiple independent namespaces. Supports `explicit` root lists and `scan` mode (auto-discovers leaf test roots). |
+| Tool                      | What it does                                                                                                                                                                                                                                 |
+| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.                                                                                                                                                                      |
+| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                                                                                                                                                                                |
+| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.                                                                                                                                                                  |
+| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                                                                                                                                                                                     |
+| `rego_test`               | Run Rego unit tests with `opa test`. Returns pass, fail, skip and error counts plus per-test records; `errored` counts tests OPA could not evaluate. With `coverage` or `threshold` OPA emits a coverage report instead of per-test records. |
+| `rego_bench`              | Run `opa bench` and return statistical timing data.                                                                                                                                                                                          |
+| `rego_compile_query`      | Partially evaluate a query against a policy.                                                                                                                                                                                                 |
+| `opa_exec`                | Batch-evaluate a decision against multiple input files. Returns per-file results with `successCount` and `errorCount`.                                                                                                                       |
+| `rego_test_multiroot`     | Run `opa test` once per root and aggregate. Use when `opa test .` hits package conflicts. Totals include `totalErrored`.                                                                                                                     |
 
 #### Featured: `rego_eval`
 
@@ -371,55 +385,55 @@ Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 
 ### Category C: Bundle operations
 
-Package and sign deployable bundles. Wrap `opa build` and `opa sign`.
+Package, sign, and verify deployable bundles. Wrap `opa build`, `opa sign`, and `opa build --verification-key`.
 
-| Tool                | What it does                                                                                      |
-| ------------------- | ------------------------------------------------------------------------------------------------- |
-| `opa_bundle_build`  | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`.             |
-| `opa_bundle_sign`   | Sign a bundle with a private key. Returns `.signatures.json` content.                             |
-| `opa_bundle_verify` | Verify the signature of a signed bundle using a public key. Returns `{ bundle, verified: true }`. |
+| Tool                | What it does                                                                                                                                                                                                            |
+| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `opa_bundle_build`  | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`.                                                                                                                                   |
+| `opa_bundle_sign`   | Sign a bundle directory in place, or an archive beside itself, with a private key. A directory signature stays valid wherever the directory is placed under the same name. Returns the path, algorithm, and file count. |
+| `opa_bundle_verify` | Verify a signed bundle with a public key through `opa build --verification-key`. Failures name the reason: wrong key, scope, modified, added, missing or unparseable file, unsigned, or a bundle that does not load.    |
 
 ### Category D: OPA server management
 
 Talk to a running OPA server over its REST API. Require `OPA_URL` to
 point at a reachable server.
 
-| Tool                 | What it does                                           |
-| -------------------- | ------------------------------------------------------ |
-| `opa_list_policies`  | List policies registered on the server.                |
-| `opa_get_policy`     | Get a single policy by ID.                             |
-| `opa_put_policy`     | Upload or replace a policy.                            |
-| `opa_delete_policy`  | Delete a policy by ID.                                 |
-| `opa_get_data`       | Read a path from the data hierarchy.                   |
-| `opa_put_data`       | Write to a path in the data hierarchy.                 |
-| `opa_patch_data`     | Apply a JSON Patch to the data hierarchy.              |
-| `opa_delete_data`    | Delete a document from the data hierarchy.             |
-| `opa_query_decision` | POST to a `/v1/data/...` decision endpoint with input. |
-| `opa_compile_query`  | Partially evaluate a query against the running server. |
-| `opa_health`         | Liveness / readiness check.                            |
-| `opa_status`         | Bundle / decision-log status.                          |
-| `opa_config`         | Server configuration (without secrets).                |
+| Tool                 | What it does                                                                                                                                                                |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `opa_list_policies`  | List the policy IDs registered on the server, with a count. `includeSource` and `includeAst` add the Rego text or the parsed AST.                                           |
+| `opa_get_policy`     | Get a single policy by ID. Returns the Rego source; `includeAst` adds OPA's parsed AST.                                                                                     |
+| `opa_put_policy`     | Upload or replace a policy.                                                                                                                                                 |
+| `opa_delete_policy`  | Delete a policy by ID.                                                                                                                                                      |
+| `opa_get_data`       | Read a path from the data hierarchy.                                                                                                                                        |
+| `opa_put_data`       | Write to a path in the data hierarchy.                                                                                                                                      |
+| `opa_patch_data`     | Apply a JSON Patch to the data hierarchy.                                                                                                                                   |
+| `opa_delete_data`    | Delete a document from the data hierarchy.                                                                                                                                  |
+| `opa_query_decision` | POST to a `/v1/data/...` decision endpoint with input.                                                                                                                      |
+| `opa_compile_query`  | Partially evaluate a query against the running server.                                                                                                                      |
+| `opa_health`         | Liveness / readiness check. A server that answers reports `healthy: true` or `healthy: false` with OPA's reason; `OPA_UNREACHABLE` means it could not be reached at all.    |
+| `opa_status`         | The same `GET /v1/config` document as `opa_config`, under a `status` key. Bundle and decision-log status (`/v1/status`) is not exposed. Service header values are redacted. |
+| `opa_config`         | Server configuration from `GET /v1/config`. OPA drops the `credentials` block but returns service headers verbatim, so header values are redacted here and the names kept.  |
 
 ### Category E: Higher-level helpers
 
 The differentiation surface. These compose lower-level primitives into
 the tasks agents are actually asked to do.
 
-| Tool                          | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `rego_explain_decision`       | Walk through every rule that fired (and didn't) for a given query. Wraps `rego_eval_with_explain` and produces a step-by-step natural-language trace.                                                                                                                                                                                                                                                                                                                                                                           |
-| `rego_generate_test_skeleton` | Given a policy, generate a `_test.rego` skeleton covering each rule.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `rego_describe_policy`        | Summarize what a policy does, its inputs, decisions, and assumptions.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `rego_suggest_fix`            | For a failed `rego_check` or `rego_lint`, propose minimal patches.                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `rego_coverage_gaps`          | Run `opa test --coverage` and return per-file uncovered line ranges, sorted worst first. Use `threshold` to focus on files below a target percentage.                                                                                                                                                                                                                                                                                                                                                                           |
-| `rego_security_audit`         | Run regal lint restricted to `security` and `bugs` categories across a directory. Returns severity-grouped findings with remediation guidance.                                                                                                                                                                                                                                                                                                                                                                                  |
-| `rego_infer_input_schema`     | Statically analyse a policy (or directory of policies) with `opa parse` and return a JSON Schema describing every `input.*` field the policy reads. No running OPA required. Correct starting point for writing integration tests or configuring `opa check --schema`.                                                                                                                                                                                                                                                          |
-| `rego_fix`                    | Run `regal fix` to auto-apply mechanical fixes: `opa-fmt`, `use-rego-v1`, `use-assignment-operator`, `no-whitespace-comment`, and `directory-package-mismatch`. Use `dryRun: true` to preview changes first. Returns a per-file breakdown of which rules were applied and, for `directory-package-mismatch`, the new path the file was moved to.                                                                                                                                                                                |
-| `rego_format_write`           | Run `opa fmt --write` to canonically format one or more Rego files or directories in place. Use `dryRun: true` to list which files would change without modifying them. Validates all files parse successfully before writing any. Supports `regoV1`, `v0Compatible`, and `v1Compatible` flags. Only requires `opa`.                                                                                                                                                                                                            |
-| `rego_policy_diff`            | Evaluate the same query against two policies in parallel and compare the results. Returns `equal: true/false`, the raw value from each side (`resultA`/`resultB`), and `changedPaths` -- dot/bracket JSON paths that differ. Each side takes inline source or a file/directory path. Useful for verifying refactor equivalence or mapping divergence between two policy versions.                                                                                                                                               |
-| `rego_verify`                 | Formally verify a property about a Rego rule using SMT solving (Microsoft Z3 via WASM). Unlike testing, this checks ALL possible inputs mathematically and either proves the property holds or returns a concrete counterexample. Supports `always_true`, `never_true`, and `satisfiable` property kinds. Handles equality, comparison, string built-ins (`startswith`, `endswith`, `contains`, `regex.match`), multi-clause rules, and cross-rule inlining. Reports `INCONCLUSIVE` for negation-as-failure and comprehensions. |
-| `rego_explain_undefined`      | Explain why a Rego query is undefined. Combines a plain eval, a full-trace eval, and per-condition AST analysis to identify the exact body expression blocking each rule. Returns a structured breakdown of which conditions blocked each rule plus a human-readable summary.                                                                                                                                                                                                                                                   |
-| `rego_playground_share`       | Publish a policy (and optional input) as a secret GitHub Gist and return the link, for sharing a reproduction. Requires `GITHUB_TOKEN` with the `gist` scope; returns `GITHUB_TOKEN_MISSING` otherwise.                                                                                                                                                                                                                                                                                                                         |
+| Tool                          | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `rego_explain_decision`       | Turn an evaluation trace into a structured per-rule summary of what fired and what did not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `rego_generate_test_skeleton` | Given a policy, generate a `_test.rego` skeleton covering each rule.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `rego_describe_policy`        | Summarize a policy's package, imports and per-rule structure from its AST. For the input references a policy reads, use `rego_infer_input_schema`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `rego_suggest_fix`            | For a failed `rego_check` or `rego_lint`, propose minimal patches.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `rego_coverage_gaps`          | Run `opa test --coverage` and return per-file uncovered line ranges, sorted worst first. Use `threshold` to focus on files below a target percentage.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `rego_security_audit`         | Run regal lint restricted to `security` and `bugs` categories across a directory. Returns severity-grouped findings with remediation guidance.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `rego_infer_input_schema`     | Statically analyse a policy (or directory of policies) with `opa parse` and return a JSON Schema describing every `input.*` field the policy reads. No running OPA required. Correct starting point for writing integration tests or configuring `opa check --schema`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `rego_fix`                    | Run `regal fix` to auto-apply mechanical fixes: `opa-fmt`, `use-rego-v1`, `use-assignment-operator`, `no-whitespace-comment`, and `directory-package-mismatch`. Use `dryRun: true` to preview changes first. Returns a per-file breakdown of which rules were applied and, for `directory-package-mismatch`, the new path the file was moved to.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `rego_format_write`           | Run `opa fmt --write` to canonically format one or more Rego files or directories in place. Use `dryRun: true` to list which files would change without modifying them. Validates all files parse successfully before writing any. Supports `regoV1`, `v0Compatible`, and `v1Compatible` flags. Only requires `opa`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `rego_policy_diff`            | Evaluate the same query against two policies in parallel and compare the results. Returns `equal: true/false`, the raw value from each side (`resultA`/`resultB`), and `changedPaths` -- dot/bracket JSON paths that differ. Each side takes inline source or a file/directory path. Useful for verifying refactor equivalence or mapping divergence between two policy versions.                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `rego_verify`                 | Formally verify a property about a Rego rule using SMT solving (Microsoft Z3 via WASM). Unlike testing, this checks ALL possible inputs mathematically and either proves the property holds or returns a concrete counterexample. Supports `always_true`, `never_true`, and `satisfiable` property kinds. Handles equality, comparison, string built-ins (`startswith`, `endswith`, `contains`, `regex.match`), multi-clause rules, rule defaults, non-boolean head values, and cross-rule inlining. Reports `INCONCLUSIVE` rather than guessing for negation-as-failure, comprehensions, partial set and object rules, functions, else chains, and complex regex. A body reading an absent field is undefined rather than true, so `always_true` requires the rule to hold for an empty input too. |
+| `rego_explain_undefined`      | Explain why a Rego query is undefined. Combines a plain eval, a full-trace eval, and per-condition AST analysis to identify the exact body expression blocking each rule. Returns a structured breakdown of which conditions blocked each rule plus a human-readable summary.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `rego_playground_share`       | Publish a policy (and optional input) as a secret GitHub Gist and return the link, for sharing a reproduction. Requires `GITHUB_TOKEN` with the `gist` scope; returns `GITHUB_TOKEN_MISSING` otherwise.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### Category F: Conftest (configuration policy testing)
 
@@ -428,12 +442,12 @@ YAML/JSON/HCL/TOML/INI against Rego policies using
 [conftest](https://www.conftest.dev/). Requires `conftest` on `PATH` or
 `CONFTEST_BINARY` set; all four tools return `CONFTEST_NOT_FOUND` otherwise.
 
-| Tool              | What it does                                                                                                                                                                                                                              |
-| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `conftest_test`   | Evaluate configuration files against policies with `conftest test`. Accepts file paths or `inlineConfig` (inline YAML/JSON/HCL/etc) and `policy` path or `inlinePolicy` source. Returns per-file pass/fail/warn results and a summary.    |
-| `conftest_verify` | Run `test_*` rules inside `*_test.rego` files to verify the policies themselves are correct. Equivalent to `opa test` but using conftest's policy-loading machinery.                                                                      |
-| `conftest_pull`   | Pull a policy bundle from an OCI registry or Git repo into a local directory with `conftest pull`. The target directory need not exist; conftest creates it.                                                                              |
-| `conftest_push`   | Package a local policy directory as an OCI artifact and push to a registry with `conftest push`. Registry credentials come from the host environment (`docker login`, ORAS keychain, etc.) -- credentials are never passed through tools. |
+| Tool              | What it does                                                                                                                                                                                                                                                                                                                   |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `conftest_test`   | Evaluate config files or an inline document against Rego policies with `conftest test`. Per-file, per-namespace results with arrays always present, and a summary that counts files by name. Parser names are a closed set.                                                                                                    |
+| `conftest_verify` | Run the `test_*` rules in a conftest policy directory with `conftest verify`. Reports per-rule results and `NO_TESTS_FOUND` when there are none.                                                                                                                                                                               |
+| `conftest_pull`   | Pull a policy bundle from an OCI registry or Git repo into a local directory with `conftest pull`. The target directory need not exist; conftest creates it, and empties it first, so do not point it at one holding anything else. Omitting `policy` uses the conftest default, which must itself sit inside an allowed root. |
+| `conftest_push`   | Package a local policy directory as an OCI artifact and push to a registry with `conftest push`. Registry credentials come from the host environment (`docker login`, ORAS keychain, etc.) -- credentials are never passed through tools.                                                                                      |
 
 #### Featured: `conftest_test` with inline config
 
@@ -441,7 +455,7 @@ YAML/JSON/HCL/TOML/INI against Rego policies using
 // Input
 {
   "inlineConfig": "apiVersion: v1\nkind: Pod\nspec:\n  containers:\n  - name: app\n    image: nginx:latest",
-  "inlinePolicy": "package main\ndeny[msg] { input.spec.containers[_].image == \"nginx:latest\"; msg := \"pin your image tag\" }"
+  "inlinePolicy": "package main\ndeny contains msg if { input.spec.containers[_].image == \"nginx:latest\"; msg := \"pin your image tag\" }"
 }
 
 // Output
@@ -567,18 +581,29 @@ Agent: Done. Policy `rbac` is live on staging at $OPA_URL.
 └───────────────────────────────────────────────────────────────────────────────────────┘
 ```
 
-Three things worth knowing if you're going to operate this:
+Four things worth knowing if you're going to operate this:
 
 1. **stdout is the protocol channel.** The server logs to a file via
    `lib/logger.ts` and never writes to stdout. If you see stray stdout
    bytes, the client disconnects; the MCP transport layer is strict.
 2. **No tool throws.** Every tool catches its own exceptions and returns
    a structured `{ ok: false, error: ... }` envelope. The agent sees a
-   stable error vocabulary, not a stack trace.
-3. **Subprocesses are tightly bounded.** `lib/subprocess.ts` runs `opa`
-   and `regal` with `shell: false`, a hard timeout, and `SIGTERM`-then-
-   `SIGKILL` escalation. There is no path through the server where an
-   agent can construct a shell command.
+   stable error vocabulary, not a stack trace. Decoding subprocess output
+   happens inside an async callback, where a throw would bypass those
+   handlers entirely, so that path is bounded by bytes rather than left to
+   a `try`/`catch` that could not see it.
+3. **Subprocesses are bounded in time, size, and environment.**
+   `lib/subprocess.ts` runs the binaries with `shell: false`, a hard
+   timeout with `SIGTERM`-then-`SIGKILL` escalation, and a per-stream byte
+   cap. There is no path through the server where an agent can construct a
+   shell command. The timeout alone is not enough: `opa` buffers a result
+   in memory and writes it in one burst at exit, so a command that finishes
+   well inside the timeout can still deliver hundreds of megabytes.
+4. **Children do not inherit the server's environment.** `lib/child-env.ts`
+   builds an explicit allow-list instead. Rego can read its interpreter's
+   environment through `opa.runtime().env`, so anything passed down is
+   readable by any policy the server evaluates, the proxy variables on the
+   list included.
 
 ## Security
 
@@ -588,8 +613,22 @@ be exposed on the network.
 
 - File-based tools refuse to read anything outside `OPA_MCP_ALLOWED_PATHS`.
   When that variable is unset, file tools return `PATH_NOT_ALLOWED`.
-- Subprocesses run with `shell: false` and a hard timeout.
-- `OPA_TOKEN` is never echoed in tool responses or log entries.
+- Subprocesses run with `shell: false`, a hard timeout, and a byte cap on
+  captured output.
+- **Evaluated policy cannot read the server's environment.** Rego exposes the
+  environment of the `opa` process through `opa.runtime().env`, so a child that
+  inherited `process.env` would hand `OPA_TOKEN`, `GITHUB_TOKEN`, and every
+  other variable to any policy it evaluated. Since `rego_eval` accepts inline
+  source, no filesystem access is needed to reach that, which puts it one
+  prompt injection away from any untrusted Rego an agent reads. Children get an
+  explicit allow-list instead (`lib/child-env.ts`). The list holds no cloud or
+  repository token, but it is not free of credentials: `HTTP_PROXY` and its
+  siblings are on it, and a proxy URL can embed a username and password.
+  They are there because dropping them breaks everyone behind a corporate
+  proxy. Name them in `OPA_MCP_BLOCK_ENV` to withhold them anyway.
+  `OPA_MCP_PASSTHROUGH_ENV` opts individual variables back in.
+- `OPA_TOKEN` is never echoed in tool responses or log entries, and is not
+  passed to any child process.
 - Releases are published with
   [npm provenance](https://docs.npmjs.com/generating-provenance-statements);
   the Docker image is built reproducibly from the committed `Dockerfile`.
@@ -634,8 +673,9 @@ is not enough -- the spawned server gets a reduced `PATH`. The
 [`examples/`](./examples) configs already include these env vars; just
 edit the placeholder paths.
 
-This issue does **not** affect the Docker or MCPB install paths. Those
-bundle `opa` and `regal` and bypass `PATH` entirely.
+This issue does **not** affect the Docker install path, which bundles
+`opa` and `regal` and bypasses `PATH` entirely. The MCPB bundle resolves
+`opa` from `OPA_BINARY` or `PATH`, so it can hit this.
 
 **The server starts, then the client says "disconnected."**
 
@@ -654,12 +694,6 @@ path(s) you want the server to read from, comma-separated.
 `OPA_URL` (default `http://localhost:8181`) must point at a running OPA
 server (`opa run --server ...`). Check with `curl $OPA_URL/health`.
 
-**Regal "version too old."**
-
-We track the current Regal release. If `REGAL_VERSION_TOO_OLD` fires,
-upgrade Regal: `brew upgrade regal` or download from the
-[Regal releases](https://github.com/StyraInc/regal/releases) page.
-
 **`directory-package-mismatch` violation when linting inline source.**
 
 Since v0.1.1, the server auto-disables this rule for inline-source calls.
@@ -695,7 +729,7 @@ npm run build             # compile to dist/
 ```
 
 CI runs lint, typecheck, build, and unit tests on every push and PR
-across Ubuntu, macOS, and Windows on Node 20, 22, and 24. Integration
+across Ubuntu and Windows on Node 20, 22 and 24, plus macOS on Node 22. Integration
 tests run on Linux against pinned `opa` and `regal` releases.
 
 For the full contributor workflow (adding tools, naming conventions,
@@ -716,7 +750,7 @@ Breaking changes will be:
 
 Pinned versions of the upstream toolchain (`opa` and `regal`) are treated
 as part of the build, not as a dependency the operator manages. The
-Dockerfile, MCPB bundle, and CI all use the same pin; bumps go through
+Dockerfile and CI use the same pin; bumps go through
 Dependabot or a manual PR.
 
 ## License

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiC1C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAiD/C;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAMA"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiC1C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAsD/C;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAMA"}

package/dist/cli.js

@@ -39,12 +39,17 @@ export function formatHelp(col) {
         ['OPA_MCP_LOG_FILE', 'log file path', '<tmpdir>/orygn-opa-mcp.log'],
         ['OPA_MCP_LOG_LEVEL', 'log level  (debug|info|warn|error)', 'info'],
         ['OPA_MCP_MAX_RESPONSE_BYTES', 'max response size in bytes', '100000'],
+        ['OPA_MCP_MAX_SUBPROCESS_BYTES', 'max bytes captured per stream', '33554432'],
+        ['OPA_MCP_PASSTHROUGH_ENV', 'extra env names to pass to child processes', ''],
+        ['OPA_MCP_NO_TELEMETRY', 'set to 1 to disable the anonymous startup ping', ''],
     ];
-    // Pad name to 28 and description to 38 so the default column lines up.
+    // Pad the name to 30 and the description to 40 so the default column lines
+    // up. The widest entries are OPA_MCP_MAX_SUBPROCESS_BYTES (28) and its
+    // description (39).
     const envLines = rows
         .map(([name, desc, def]) => {
-        const namePad = name.padEnd(28);
-        const descPad = desc.padEnd(38);
+        const namePad = name.padEnd(30);
+        const descPad = desc.padEnd(40);
         const defStr = def ? `${d('default: ' + def)}` : '';
         return `  ${namePad}${descPad}${defStr}`;
     })

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AAEjF,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,EAAE,GAAG,UAAU,CAAC;AAEtB,SAAS,CAAC,CAAC,EAAW,EAAE,GAAG,KAAe;IACxC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,iFAAiF;AAEjF,2DAA2D;AAC3D,8CAA8C;AAC9C,sEAAsE;AAEtE,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,GAAG,GACP,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAExD,MAAM,IAAI,GAA+B;QACvC,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAK,CAAC;QACxC,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC9C,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,UAAU,CAAC;QACvD,CAAC,SAAS,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAC3D,CAAC,WAAW,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC7C,CAAC,uBAAuB,EAAE,wDAAwD,EAAE,EAAE,CAAC;QACvF,CAAC,oBAAoB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAC3D,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAChE,CAAC,kBAAkB,EAAE,eAAe,EAAE,4BAA4B,CAAC;QACnE,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,MAAM,CAAC;QACnE,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,QAAQ,CAAC;KACvE,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,SAAS,CAAC,GAAG,CAAC;QACd,EAAE;QACF,gDAAgD;QAChD,2DAA2D;QAC3D,EAAE;QACF,CAAC,CAAC,wCAAwC,CAAC;QAC3C,EAAE;QACF,QAAQ;QACR,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,8CAA8C;QAC9C,yCAAyC;QACzC,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,sBAAsB;QACtB,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAY;IAC9D,MAAM,KAAK,GACT,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAExF,MAAM,MAAM,GAAG;QACb,OAAO,MAAM,CAAC,SAAS,EAAE;QACzB,SAAS,MAAM,CAAC,WAAW,EAAE;QAC7B,SAAS,KAAK,EAAE;QAChB,OAAO,MAAM,CAAC,OAAO,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAEjD,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAc;IAKzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AAEjF,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,EAAE,GAAG,UAAU,CAAC;AAEtB,SAAS,CAAC,CAAC,EAAW,EAAE,GAAG,KAAe;IACxC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,iFAAiF;AAEjF,2DAA2D;AAC3D,8CAA8C;AAC9C,sEAAsE;AAEtE,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,GAAG,GACP,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAExD,MAAM,IAAI,GAA+B;QACvC,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAK,CAAC;QACxC,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC9C,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,UAAU,CAAC;QACvD,CAAC,SAAS,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAC3D,CAAC,WAAW,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC7C,CAAC,uBAAuB,EAAE,wDAAwD,EAAE,EAAE,CAAC;QACvF,CAAC,oBAAoB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAC3D,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAChE,CAAC,kBAAkB,EAAE,eAAe,EAAE,4BAA4B,CAAC;QACnE,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,MAAM,CAAC;QACnE,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,QAAQ,CAAC;QACtE,CAAC,8BAA8B,EAAE,+BAA+B,EAAE,UAAU,CAAC;QAC7E,CAAC,yBAAyB,EAAE,4CAA4C,EAAE,EAAE,CAAC;QAC7E,CAAC,sBAAsB,EAAE,gDAAgD,EAAE,EAAE,CAAC;KAC/E,CAAC;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,SAAS,CAAC,GAAG,CAAC;QACd,EAAE;QACF,gDAAgD;QAChD,2DAA2D;QAC3D,EAAE;QACF,CAAC,CAAC,wCAAwC,CAAC;QAC3C,EAAE;QACF,QAAQ;QACR,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,8CAA8C;QAC9C,yCAAyC;QACzC,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,sBAAsB;QACtB,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAY;IAC9D,MAAM,KAAK,GACT,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAExF,MAAM,MAAM,GAAG;QACb,OAAO,MAAM,CAAC,SAAS,EAAE;QACzB,SAAS,MAAM,CAAC,WAAW,EAAE;QAC7B,SAAS,KAAK,EAAE;QAChB,OAAO,MAAM,CAAC,OAAO,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAEjD,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAc;IAKzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/config.d.ts

@@ -20,7 +20,7 @@ declare const ConfigSchema: z.ZodObject<{
      * default -- file-based tools refuse to read from disk until the
      * operator explicitly opts in via `OPA_MCP_ALLOWED_PATHS`.
      */
-    allowedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    allowedPaths: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     /** Path to the log file. Defaults to OS tmpdir + orygn-opa-mcp.log. */
     logFile: z.ZodDefault<z.ZodString>;
     /** Log level for the file logger. */
@@ -31,6 +31,16 @@ declare const ConfigSchema: z.ZodObject<{
      * write to a file path the agent specifies.
      */
     maxResponseBytes: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Maximum bytes captured from a subprocess's stdout and stderr, each counted
+     * separately. On overflow the stream is clamped and the child is killed.
+     *
+     * This is a memory bound, distinct from `maxResponseBytes`, which trims the
+     * response after the output has already been read into the heap. A capture
+     * past V8's max string length cannot be decoded at all, and the throw would
+     * land in an async callback where no tool can catch it.
+     */
+    maxSubprocessBytes: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     opaUrl: string;
     opaBinary: string;
@@ -40,8 +50,9 @@ declare const ConfigSchema: z.ZodObject<{
     httpTimeoutMs: number;
     allowedPaths: string[];
     logFile: string;
-    logLevel: "debug" | "info" | "warn" | "error";
+    logLevel: "error" | "debug" | "info" | "warn";
     maxResponseBytes: number;
+    maxSubprocessBytes: number;
     opaToken?: string | undefined;
 }, {
     opaUrl?: string | undefined;
@@ -53,8 +64,9 @@ declare const ConfigSchema: z.ZodObject<{
     httpTimeoutMs?: number | undefined;
     allowedPaths?: string[] | undefined;
     logFile?: string | undefined;
-    logLevel?: "debug" | "info" | "warn" | "error" | undefined;
+    logLevel?: "error" | "debug" | "info" | "warn" | undefined;
     maxResponseBytes?: number | undefined;
+    maxSubprocessBytes?: number | undefined;
 }>;
 export type Config = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): Config;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyBlD,wBAAgB,UAAU,IAAI,MAAM,CAqCnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAQlE,mDAAmD;;IAQnD;;;;;OAKG;;IAcH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;IAGH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyClD,wBAAgB,UAAU,IAAI,MAAM,CAsCnC"}