If you tried Opal's MCP servers when we first shipped them, they are worth another look. We rebuilt the foundation, and the version you get today is faster to trust, easier to scope, and does more of the work for you.

Here is what that means in practice.

Your access data stays inside your boundary

The servers are now hosted by Opal, not a third party. When you ask an agent to check your access or file a request, that traffic runs through Opal and your own environment. If you run Opal self-hosted, you can host the servers yourself, so nothing leaves your infrastructure at all.

You only get the tools your job needs

Instead of one server that does everything, there are now three, each scoped to a role:

• End User. Browse what is available, request access for yourself or inside a workflow, and check where your requests stand.

• Admin Provisioning. Manage access: pull someone's full picture, add or remove them, adjust levels and durations.

• Admin Auditing. Investigate access, review changes, and pull the evidence compliance asks for.

Approvers can close the loop without leaving the conversation

The provisioning server can now approve and deny requests, not just create and read them. So an approver can clear their queue from inside the agent they are already using. A request comes in, they ask the agent for context, they approve it, done. No tab switching, no waiting for someone to open a dashboard, no access sitting idle while people are heads down.

What this looks like day to day

You stay in your flow and ask in plain language:

• "Show me all users in the Engineering group."

• "Create an access request for the Production database."

• "What access changes happened to our AWS resources this week?"

The agent handles the rest through Opal, inside the same policies, approvals, and audit trail as any other request. If you could not do it yourself, the agent cannot either, and everything it does is on the record.

One pattern worth trying: chain Opal with another tool's MCP. Request access to Retool through Opal, then use Retool's own MCP to query the data, all in one conversation.

Getting started

Create an API token in your Opal environment, then point your client at the server you need. For Claude Code, the end user server is one command:

claude mcp add --transport http opal-end-user https://app.opal.dev/mcp/end-user --header "Authorization: Bearer ${OPAL_API_TOKEN}"

Run claude /mcp to authenticate. The provisioning and auditing servers install the same way, and setup for Cursor, Gemini CLI, and other clients is in the docs. If you run self-hosted, swap app.opal.dev for your own domain.

Full setup and the tool list for each server: docs.opal.dev/docs/mcp/overview.

Connect with us

Want to connect with our team to discuss further? Schedule a live demo.