Conftest test
conftest_testEvaluate Kubernetes manifests, Terraform plans, or any YAML/JSON/HCL files against Rego policies. Returns per-file pass/fail/warn results to pinpoint policy rule violations.
Instructions
Evaluate configuration files (Kubernetes manifests, Terraform plans, Dockerfiles, Helm charts, or any YAML/JSON/HCL/TOML/INI) against Rego policies using conftest test. Returns per-file, per-namespace pass/fail/warn results so you can pinpoint exactly which policy rules fired. Requires conftest on PATH or CONFTEST_BINARY set; returns CONFTEST_NOT_FOUND otherwise. Provide config via files (disk paths) or inlineConfig (inline string). Provide policy via policy (disk path) or inlinePolicy (inline Rego source). Omit policy and inlinePolicy to use conftest's default ./policy directory.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Filesystem paths to configuration files to evaluate (YAML, JSON, HCL, Dockerfile, etc.). Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `inlineConfig`. | |
| inlineConfig | No | Inline configuration content to evaluate (e.g. a Kubernetes manifest as a YAML string). Mutually exclusive with `files`. Defaults to YAML format; set `inlineConfigParser` to override. | |
| inlineConfigParser | No | Parser to use for `inlineConfig`. Valid values: yaml (default), json, toml, hcl1, hcl2, ini, xml, dotenv, cue, jsonnet, properties, dockerfile. Ignored when `files` is used (conftest infers the parser from each file's extension). | |
| policy | No | Path to a directory or file containing Rego policies. Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `inlinePolicy`. Omit to let conftest use its default `./policy` directory. | |
| inlinePolicy | No | Inline Rego policy source. Written to a temporary directory and passed as `--policy`. The policy should declare `package main` (or match the `namespace` parameter). Mutually exclusive with `policy`. | |
| namespace | No | Rego namespace (package name) to test against. Defaults to `main`. Use `allNamespaces: true` to test all discovered namespaces instead. | |
| allNamespaces | No | Test policies found in all discovered namespaces. Overrides `namespace`. | |
| data | No | Paths to directories from which additional data will be loaded for the Rego policies. Each path must be inside an allowed root. | |
| combine | No | Combine all configuration files into a single input document before evaluating. Useful when policies need to inspect relationships across multiple files. | |
| failOnWarn | No | Return `passed: false` even when only warnings (no hard failures) are present. |