Admin Auditing MCP Server

Opal’s admin auditing MCP provides a set of tools that enables admins to use AI agents to view Opal events and syncs to investigate access and audit changes. Use cases include:

Investigate historical access patterns and anomalous access
Audit changes in organizational structure or role assignments
Review sync errors and propagation status
Monitor access requests and approvals
Track user access reviews and compliance activities

Installation

OAuth is the recommended way to connect. The OAuth commands below sign you in to Opal in your browser — no stored secret. Find your Client ID under User → Settings → OAuth Grants (app.opal.dev/user/settings/oauth-grants); if your client asks for a resource or audience value, read it from this server’s protected-resource metadata at https://app.opal.dev/.well-known/oauth-protected-resource/mcp/admin-auditing. See Authentication for details. To use an API token instead, create one first.

Self-hosted Opal deployments can host MCP servers as of version v1.1135.0. If you run self-hosted, remember to replace https://app.opal.dev with your own domain.

Claude Code
Cursor
Gemini CLI
Other

OAuth (recommended): add the server with no Authorization header, then sign in.

claude mcp add --transport http opal-admin-auditing https://app.opal.dev/mcp/admin-auditing

claude mcp login opal-admin-auditing

Claude Code also prompts you to sign in the first time it calls a tool from this server. Check server status any time with claude /mcp.API token: pass the token as a header when you add the server.

claude mcp add --transport http opal-admin-auditing https://app.opal.dev/mcp/admin-auditing --header "Authorization: Bearer ${OPAL_API_TOKEN}"

To learn more, see Claude Code documentation.

OAuth (recommended): add the following to your ~/.cursor/mcp.json file, with no Authorization header:

{
  "mcpServers": {
    "opal-admin-auditing": {
      "transport": "http",
      "url": "https://app.opal.dev/mcp/admin-auditing"
    }
  }
}

Open Cursor Settings → MCP, and click Needs login next to the server to sign in through your browser.API token: add an Authorization header instead.

{
  "mcpServers": {
    "opal-admin-auditing": {
      "transport": "http",
      "url": "https://app.opal.dev/mcp/admin-auditing",
      "headers": {
        "Authorization": "Bearer ${env:OPAL_API_TOKEN}"
      }
    }
  }
}

Define your OPAL_API_TOKEN, and make sure you open Cursor from the same shell.

export OPAL_API_TOKEN="secret"

open -a Cursor

To learn more, see Cursor documentation.

OAuth (recommended): add the following to your ~/.gemini/settings.json, with no Authorization header, then follow the sign-in prompt on first use:

{
  "mcpServers": {
    "opal-admin-auditing": {
      "httpUrl": "https://app.opal.dev/mcp/admin-auditing"
    }
  }
}

API token: add an Authorization header instead.

{
  "mcpServers": {
    "opal-admin-auditing": {
      "httpUrl": "https://app.opal.dev/mcp/admin-auditing",
      "headers": {
        "Authorization": "Bearer ${OPAL_API_TOKEN}"
      }
    }
  }
}

To learn more, see Gemini documentation.

MCP is an open protocol supported by many other clients, and your specific client documentation can advise you how to connect. Key inputs:

Transport http
Endpoint https://app.opal.dev/mcp/admin-auditing
OAuth (recommended): omit the Authorization header — most clients discover Opal’s OAuth support automatically and prompt you to sign in.
API token: add the header Authorization: Bearer ${OPAL_API_TOKEN}.

Available Tools

Tool	Description
`get_resource`	Retrieves a resource.
`search_resources`	Searches for resources in your organization by name, resource type, or connection ID.
`get_sync_errors`	Returns a list of recent sync errors that have occurred since the last successful sync.
`get_resource_visibility`	Gets the visibility of this resource.
`get_uar`	Retrieves a specific UAR.
`get_uars`	Returns a list of `UAR` objects.
`get_on_call_schedules`	Returns a list of `OnCallSchedule` objects.
`get_message_channels`	Returns a list of `MessageChannel` objects.
`get_tags`	Returns a list of tags created by your organization.
`get_sessions`	Returns a list of `Session` objects.
`get_user_tags`	Returns all tags applied to the user.
`get_users`	Returns a list of users for your organization.
`get_resource_scoped_role_permissions`	Returns all the scoped role permissions that apply to the given resource. Only `OPAL_SCOPED_ROLE` resource type supports this field.
`list_resource_tags`	Returns all tags applied to the specified resources.
`get_resource_nhis`	Gets the list of non-human identities with access to this resource.
`get_resource_users`	Gets the list of users for this resource.
`get_nhis`	Returns a list of non-human identities for your organization.
`get_resource_reviewer_stages`	Gets the list of reviewer stages for a resource.
`get_resource_reviewers`	Gets the list of owner IDs of the reviewers for a resource.
`get_resource_message_channels`	Gets the list of audit message channels attached to a resource.
`list_requests`	Returns a paginated list of access requests across your organization.
`get_request`	Returns a request by ID.
`get_owner_users`	Gets the list of users for this owner, in escalation priority order if applicable.
`get_owners`	Returns a list of `Owner` objects.
`get_idp_group_mappings`	Returns the configured set of available `IdpGroupMapping` objects for an Okta app.
`get_group_users`	Gets the list of users for this group.
`get_group_reviewer_stages`	Gets the list of reviewer stages for a group.
`get_group_reviewers`	Gets the list of owner IDs of the reviewers for a group.
`get_group_visibility`	Gets the visibility of this group.
`get_events`	Returns a list of `Event` objects.
`search_groups`	Searches for groups in your organization by name or connection ID.
`get_group_containing_groups`	Gets the list of groups that the group gives access to.
`get_group_on_call_schedules`	Gets the list of on call schedules attached to a group.
`get_group_resources`	Gets the list of resources that the group gives access to.
`get_group_message_channels`	Gets the list of audit and reviewer message channels attached to a group.
`get_bundle_groups`	Returns a list of `Group` objects in a given bundle.
`get_bundle_visibility`	Gets the visibility of the bundle.
`get_bundle_resources`	Returns a list of `Resource` objects in a given bundle.
`get_apps`	Returns a list of `App` objects.
`get_configuration_templates`	Returns a list of `ConfigurationTemplate` objects.
`get_bundles`	Returns a list of `Bundle` objects.

Tool Parameters

get_resource

Param	Type	Notes
`resource_id`	string	required. UUID of the resource to look up

search_resources

Param	Type	Notes
`name_filter`	string	required. Text search on resource name
`resource_types`	string[]	Optional: restrict results to these resource types
`connection_ids`	string[]	Optional: restrict results to these connection IDs

get_sync_errors

Param	Type	Notes
`connection_id`	string	UUID of the connection to fetch sync errors for
`resource_id`	string	UUID of the resource to fetch sync errors for
`group_id`	string	UUID of the group to fetch sync errors for
`limit`	integer	Maximum number of sync errors to return
`include_dismissed`	boolean	Include sync errors that have been dismissed (default: false)

get_resource_visibility

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

get_uar

Param	Type	Notes
`access_review_id`	string	required. UUID of the access review

get_uars

Param	Type	Notes
`status`	string	Optional status filter: STARTED or COMPLETED
`search_query`	string	Optional search query to filter by name
`limit`	integer	Maximum number of access reviews to return

get_on_call_schedules

Param	Type	Notes
`include_deleted`	boolean	Include deleted on-call schedules (default: false)

get_message_channels

Param	Type	Notes
`include_deleted`	boolean	Include deleted message channels (default: false)

get_tags

Param	Type	Notes
`search_query`	string	Search query to filter tags by key or value
`limit`	integer	Maximum number of tags to return (default: 100)

get_sessions

Param	Type	Notes
`resource_id`	string	required. UUID of the resource to list sessions for
`user_id`	string	Optional UUID of the user to filter sessions by

get_user_tags

Param	Type	Notes
`user_id`	string	required. UUID of the user

get_users

Param	Type	Notes
`cursor`	string	Opaque pagination cursor from a previous response
`page_size`	integer	Maximum number of users to return (default 100)

get_resource_scoped_role_permissions

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

list_resource_tags

Param	Type	Notes
`resource_ids`	string[]	required. UUIDs of resources to list tags for

get_resource_nhis

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

get_resource_users

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

get_nhis

Param	Type	Notes
`limit`	integer	Maximum number of NHIs to return (default 100)

get_resource_reviewer_stages

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

get_resource_reviewers

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

get_resource_message_channels

Param	Type	Notes
`resource_id`	string	required. UUID of the resource

list_requests

Param	Type	Notes
`entity_ids`	string[]	List of UUIDs of resources or groups to filter requests by
`requester_ids`	string[]	UUIDs of users who made the requests
`target_user_ids`	string[]	UUIDs of users the requests are for
`search_query`	string	Search query to filter requests
`start_date`	string	Filter requests created after this date (RFC3339 format)
`end_date`	string	Filter requests created before this date (RFC3339 format)
`show_pending_only`	boolean	Only show pending requests
`cursor`	string	Opaque pagination cursor from previous response
`limit`	integer	Maximum number of requests to return (default: 100, max: 1000)

get_request

Param	Type	Notes
`request_id`	string	required. UUID of the access request

get_owner_users

Param	Type	Notes
`owner_id`	string	required. UUID of the owner

get_owners

Param	Type	Notes
`search_query`	string	Search query to filter owners by name
`limit`	integer	Maximum number of owners to return

get_idp_group_mappings

Param	Type	Notes
`app_resource_id`	string	UUID of the app resource to filter mappings by
`group_id`	string	UUID of the group to filter mappings by

get_group_users

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_group_reviewer_stages

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_group_reviewers

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_group_visibility

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_events

Param	Type	Notes
`actor_user_id`	string	UUID of the actor (user) to filter events by
`limit`	integer	Maximum number of events to return (default: 100, max: 1000)

search_groups

Param	Type	Notes
`name_filter`	string	required. Text search on group name
`connection_ids`	string[]	Optional: restrict results to these connection IDs

get_group_containing_groups

Param	Type	Notes
`group_id`	string	required. UUID of the member group to find containing (parent) groups for

get_group_on_call_schedules

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_group_resources

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_group_message_channels

Param	Type	Notes
`group_id`	string	required. UUID of the group

get_bundle_groups

Param	Type	Notes
`bundle_id`	string	required. UUID of the bundle

get_bundle_visibility

Param	Type	Notes
`bundle_id`	string	required. UUID of the bundle

get_bundle_resources

Param	Type	Notes
`bundle_id`	string	required. UUID of the bundle

get_apps

Param	Type	Notes
`search_query`	string	Text search on app name

get_configuration_templates

Param	Type	Notes
`admin_owner_id`	string	Optional UUID of the admin owner to filter templates by

get_bundles

Param	Type	Notes
`search_query`	string	Text search on bundle name

Welcome

End user

Getting Started

Access Management

AI Agent Governance

OpalScript

Paladin

OpalQuery

Auditing and Security

Custom Integrations

For Developers

Installation

Available Tools

Tool Parameters

​Installation

​Available Tools

​Tool Parameters

Installation

Available Tools

Tool Parameters