As of May 26, 2026, Opal has moved to self-hosted MCPs. Any previously
Gram-hosted MCPs are no longer maintained — please update your configurations
accordingly.
Self-hosted Opal deployments can host MCP servers as of version v1.1135.0.
End User MCP
Enable self service by requesting access through our MCP.
Admin Provisioning MCP
Manage user access through our MCP.
Admin Audit MCP
Investigate access and audit changes with our MCP.
Authentication
Opal MCP servers support two ways to authenticate. OAuth is recommended for interactive clients: you sign in through your browser and Opal issues a short-lived token scoped to your account, so no long-lived secret is stored in your client config. Use an API token for scripts and other non-interactive clients.OAuth
Most MCP clients discover and complete the OAuth flow automatically. Add the server URL without anAuthorization header and trigger your client’s sign-in step; your client will redirect you to Opal to approve access, then receive a scoped access token it refreshes for you. Opal uses the OAuth 2.1 authorization code flow with PKCE. Per-client commands are on each server’s installation page.
If your client asks you to configure OAuth manually, use these values:
Opal uses a single pre-registered public client and does not support Dynamic Client Registration. Find your Client ID, and review or revoke the tokens issued to your account, in Opal under User → Settings → OAuth Grants (
app.opal.dev/user/settings/oauth-grants).API token
Create an API Token in your Opal environment and pass it to your client as anAuthorization: Bearer ${OPAL_API_TOKEN} header, as shown in the installation steps for each server.