Skip to main content
As of May 26, 2026, Opal has moved to self-hosted MCPs. Any previously Gram-hosted MCPs are no longer maintained — please update your configurations accordingly.
Opal hosts our own specialized Model Context Protocol (MCP) servers that allow your AI agents to interact with Opal through Opal’s REST API.
Self-hosted Opal deployments can host MCP servers as of version v1.1135.0.
With these MCP servers, AI assistants can help you manage access through natural language. Natural language queries include “Show me all users in the Engineering group.”, “Create an access request for the Production database.”, “What access changes happened to our AWS resources this week?” Opal provides three specialized MCP servers, each designed for specialized end user or admin use cases.

End User MCP

Enable self service by requesting access through our MCP.

Admin Provisioning MCP

Manage user access through our MCP.

Admin Audit MCP

Investigate access and audit changes with our MCP.

​
Authentication

Opal MCP servers support two ways to authenticate. OAuth is recommended for interactive clients: you sign in through your browser and Opal issues a short-lived token scoped to your account, so no long-lived secret is stored in your client config. Use an API token for scripts and other non-interactive clients.

​
OAuth

OAuth support is in early beta and may change. If you hit issues, use an API token instead.
Most MCP clients discover and complete the OAuth flow automatically. Add the server URL without an Authorization header and trigger your client’s sign-in step; your client will redirect you to Opal to approve access, then receive a scoped access token it refreshes for you. Opal uses the OAuth 2.1 authorization code flow with PKCE. Per-client commands are on each server’s installation page. If your client asks you to configure OAuth manually, use these values:
Opal uses a single pre-registered public client and does not support Dynamic Client Registration. Find your Client ID, and review or revoke the tokens issued to your account, in Opal under User → Settings → OAuth Grants (app.opal.dev/user/settings/oauth-grants).

​
Connecting from a platform (Databricks, Glean, and similar)

Some platforms — Databricks, Glean, and similar tools that broker connections to external services — let you register one of Opal’s MCP servers as an external tool through their own OAuth connection UI, rather than through an MCP client’s built-in OAuth discovery. Since these platforms have you configure OAuth manually instead of performing full MCP discovery, a few settings need to be set explicitly:
  1. Allowlist the platform’s OAuth callback URL. In Opal, go to Settings → Authentication → MCP OAuth callback URLs and add the platform’s callback URL under Custom callback URLs. For Databricks, this is https://<your-workspace-url>/login/oauth/http.html; check your platform’s own documentation for its equivalent.
  2. Use OAuth User-to-Machine (per-user) authentication, if your platform distinguishes between OAuth types. Opal’s OAuth broker only supports the interactive authorization-code-with-PKCE flow — there’s no machine-to-machine/client-credentials support.
  3. Set the credential exchange (or client authentication) method to send the client ID in the request body, not in an Authorization header, if your platform asks. Opal’s token endpoint reads client_id from the request body.
  4. Client Secret doesn’t apply. Opal’s OAuth client is a public client with no secret (see the note above) — leave this field blank, or enter a placeholder if your platform requires a non-empty value.
  5. If your platform asks for a resource or audience value, use the value from this server’s protected-resource metadata (see the table above). Opal also accepts a request that omits this value entirely, so it’s fine to leave it blank if your platform has no field for it.
  6. Register the MCP server as a tool in your platform. Setting up the OAuth connection isn’t enough on its own — most platforms require a separate step to register or enable the MCP server as a usable tool before agents can call it.
  7. If your platform asks you to choose a transport protocol, choose Streamable HTTP. Some platforms, like Glean, let you pick between SSE and Streamable HTTP when registering the MCP server — Opal’s MCP servers support Streamable HTTP; SSE is not supported.
Register Opal as an external MCP server in Unity Catalog:
  1. Go to Catalog → Connections → Create connection, and choose type HTTP.
  2. Set the server URL to one of Opal’s MCP endpoints, e.g. https://app.opal.dev/mcp/end-user (swap in /mcp/admin-user-provisioning or /mcp/admin-auditing for the other servers).
  3. Choose authentication OAuth U2M per-user, with OAuth provider Manual configuration:
    • Authorization endpoint: https://app.opal.dev/authorize
    • Token endpoint: https://app.opal.dev/token
    • Client ID: your value from User → Settings → OAuth Grants
    • Client secret: not used — leave blank or use a placeholder
    • Credential exchange method: body_only
  4. Log in to complete the OAuth flow, then go to AI Gateway → MCPs → Register MCP Server and select this connection so its tools become available to agents.
See Databricks’ Register an external MCP server documentation for more detail.

​
API token

Create an API Token in your Opal environment and pass it to your client as an Authorization: Bearer ${OPAL_API_TOKEN} header, as shown in the installation steps for each server.
Last modified on September 9, 2026