Conftest test
conftest_testEvaluate Kubernetes manifests, Terraform plans, Dockerfiles, or any YAML/JSON/HCL against Rego policies with conftest, returning per-file pass, fail, and warn results.
Instructions
Evaluate configuration files (Kubernetes manifests, Terraform plans, Dockerfiles, Helm charts, or any YAML/JSON/HCL/TOML/INI) against Rego policies using conftest test. Returns per-file, per-namespace pass/fail/warn results so you can pinpoint exactly which policy rules fired. Requires conftest on PATH or CONFTEST_BINARY set; returns CONFTEST_NOT_FOUND otherwise. Provide config via files (disk paths) or inlineConfig (inline string). Provide policy via policy (disk path) or inlinePolicy (inline Rego source). Omit policy and inlinePolicy to use conftest's default ./policy directory. Policies are executed by conftest and can call OPA built-ins such as http.send. A run in which no rule was evaluated (wrong namespace, or no deny/violation/warn rules) is reported as passed: false with nothingEvaluated: true and the namespaces that do hold rules, where conftest itself would exit 0.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Paths to directories from which additional data will be loaded for the Rego policies. Each path must be inside an allowed root. | |
| files | No | Filesystem paths to configuration files to evaluate (YAML, JSON, HCL, Dockerfile, etc.). Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `inlineConfig`. | |
| parser | No | Force a specific parser for all input `files` via conftest's global `--parser` flag, overriding extension-based detection. Useful for files whose extension does not match their format (e.g. parse a `.tfstate` file as `json`). One of: cue, cyclonedx, dockerfile, dotenv, edn, groovy, hcl1, hcl2, hocon, ignore, ini, json, jsonc, jsonnet, nginx, properties, spdx, textproto, toml, vcl, xml, yaml. For `inlineConfig`, prefer `inlineConfigParser`. | |
| policy | No | Path to a directory or file containing Rego policies. Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `inlinePolicy`. Omit to let conftest use its default `./policy` directory. | |
| combine | No | Combine all configuration files into a single input document before evaluating. Useful when policies need to inspect relationships across multiple files. | |
| namespace | No | Rego namespace (package name) to test against. Defaults to `main`. Use `allNamespaces: true` to test all discovered namespaces instead. | |
| failOnWarn | No | Return `passed: false` even when only warnings (no hard failures) are present. | |
| inlineConfig | No | Inline configuration content to evaluate (e.g. a Kubernetes manifest as a YAML string). Mutually exclusive with `files`. Defaults to YAML format; set `inlineConfigParser` to override. | |
| inlinePolicy | No | Inline Rego policy source. Written to a temporary directory and passed as `--policy`. The policy should declare `package main` (or match the `namespace` parameter). Mutually exclusive with `policy`. | |
| v0Compatible | No | Read the policies as Rego v0 (`--rego-version v0`), the syntax before OPA 1.0: rules without `if`, `deny[msg] { ... }`. conftest reads v1 by default and refuses such a policy. | |
| allNamespaces | No | Test policies found in all discovered namespaces. Overrides `namespace`. | |
| inlineConfigParser | No | Parser to use for `inlineConfig`. One of: cue, cyclonedx, dockerfile, dotenv, edn, groovy, hcl1, hcl2, hocon, ignore, ini, json, jsonc, jsonnet, nginx, properties, spdx, textproto, toml, vcl, xml, yaml. Defaults to yaml. Ignored when `files` is used (conftest infers the parser from each file's extension, unless `parser` is set). |