Conftest pull
conftest_pullDownload Rego policies from an OCI registry or Git repository into a local directory to prepare for Conftest policy evaluation. Ensures policies are available locally before running tests.
Instructions
Download Rego policies from an OCI registry or Git repository into a local directory using conftest pull. Use this to hydrate a local policy/ directory before running conftest_test. Requires conftest on PATH or CONFTEST_BINARY set. The policy directory must be inside OPA_MCP_ALLOWED_PATHS. SECURITY: pulled policies are arbitrary Rego source that will be executed by conftest_test. Only pull from registries or repositories you own or explicitly trust -- malicious policy code can use OPA built-ins (http.send, opa.runtime) to exfiltrate data or make outbound network requests when the tests run.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Policy URL to pull. Supported schemes: `oci://registry/repo:tag` (OCI registry), `github.com/org/repo//path` (GitHub subdirectory), `git::https://example.com/repo//path` (generic Git). See https://www.conftest.dev/sharing/ for the full URL syntax. | |
| policy | No | Local directory where the pulled policies will be written. Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Defaults to `./policy` (conftest's convention). |