End User MCP Server

Opal’s End User MCP provides a set of tools that enables end users to leverage AI agents to request access to Opal resources, groups, and bundles . Use cases include:

Browse available resources, groups, and bundles
Create access requests for yourself or as part of a workflow
Check request status and view your current access
Use in combination with other MCP servers (e.g., request access to Retool, then use Retool’s MCP server to query data)

Installation

OAuth is the recommended way to connect. Omit the Authorization header below and your MCP client will prompt you to sign in to Opal in your browser — no stored secret. Find your Client ID under User → Settings → OAuth Grants (app.opal.dev/user/settings/oauth-grants), and use the OAuth resource/audience https://opal.dev/mcp. See Authentication for details. The commands below use an API token instead; create one first to use that method.

Self-hosted Opal deployments can host MCP servers as of version v1.1135.0. If you run self-hosted, remember to replace https://app.opal.dev with your own domain.

Claude Code
Cursor
Gemini CLI
Other

To install, run the following command in your shell:

claude mcp add --transport http opal-end-user https://app.opal.dev/mcp/end-user --header "Authorization: Bearer ${OPAL_API_TOKEN}" 

Then authenticate with Opal.

claude /mcp

To learn more, see Claude Code documentation.

To install, add the following to your ~/.cursor/mcp.json file:

{
  "mcpServers": {
    "opal-end-user": {
      "transport": "http",
      "url": "https://app.opal.dev/mcp/end-user",
      "headers": {
        "Authorization": "Bearer ${env:OPAL_API_TOKEN}"
      }
    }
  }
}

Define your OPAL_API_TOKEN, and make sure you open Cursor from the same shell.

export OPAL_API_TOKEN="secret"

open -a Cursor

To learn more, see Cursor documentation.

To install, add the following to your ~/.gemini/settings.json

{
  "mcpServers": {
    "opal-end-user": {
      "httpUrl": "https://app.opal.dev/mcp/end-user",
      "headers": {
        "Authorization": "Bearer ${OPAL_API_TOKEN}"
      }
    }
  }
}

To learn more, see Gemini documentation.

MCP is an open protocol supported by many other clients, and your specific client documentation can advise you how to connect. Key inputs:

Transport http
Endpoint https://app.opal.dev/mcp/end-user
Add the header Authorization: Bearer ${OPAL_API_TOKEN}.

Available Tools

Tool	Description
`opal_get_resources`	Returns a list of resources for your organization.
`opal_user`	Retrieves detailed user information from Opal. This endpoint is designed to fetch user details by either user ID (UUID) or email address.
`opal_get_users`	Returns a list of users for your organization.
`opal_get_resource_nhis`	Gets the list of non-human identities with access to this resource.
`opal_create_request`	Create an access request.
`opal_get_resource_users`	Gets the list of users for this resource.
`opal_get_requests`	Returns a list of requests for your organization that is visible by the admin.
`opal_get_request`	Returns a request by ID.
`opal_get_group_users`	Gets the list of users for this group.
`opal_get_groups`	Returns a list of groups for your organization.
`opal_get_group_containing_groups`	Gets the list of groups that the group gives access to.
`opal_get_group_resources`	Gets the list of resources that the group gives access to.
`opal_get_group`	Returns a `Group` object.
`opal_get_bundle_groups`	Returns a list of `Group` objects in a given bundle.
`opal_get_bundle_resources`	Returns a list of `Resource` objects in a given bundle.
`opal_get_apps`	Returns a list of `App` objects.
`opal_get_bundles`	Returns a list of `Bundle` objects.
`opal_get_bundle`	Returns a `Bundle` object.

Welcome

End user

Getting Started

Access Management

OpalScript

Paladin

OpalQuery

Auditing and Security

Custom Integrations

For Developers

Installation

Available Tools

​Installation

​Available Tools

Installation

Available Tools