Batch-evaluate OPA policy against input files
opa_execEvaluate policy decisions across multiple input files independently, returning per-file results for CI pipelines. Supports bundle or raw policy files, and CI gate conditions via fail flags.
Instructions
Evaluate a policy decision against one or more input files using opa exec --format=json. Unlike rego_eval (single input), opa exec processes every file independently and returns a per-file result -- ideal for CI pipelines that check many config files against a policy in one call. Supply bundle for bundle-based policies or dataPaths for raw policy files; these are mutually exclusive. Each file that fails evaluation appears in results with an error field rather than a result field. Set one of fail/failDefined/failNonEmpty to turn the call into a CI gate: the result then reports failed: true (instead of erroring) when the gate condition is met.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| inputPaths | Yes | One or more JSON/YAML input file paths, or a directory containing input files. OPA evaluates each file independently. Every path must be inside an allowed root. | |
| decision | Yes | The policy entrypoint to evaluate for each input, e.g. `"data.authz.allow"` or `"data.policy.violations"`. Must be a fully-qualified Rego reference. | |
| bundle | No | Path to an OPA bundle directory or `.tar.gz` archive to load as the policy source. Mutually exclusive with `dataPaths`. | |
| dataPaths | No | Policy and/or data file or directory paths, each loaded as an OPA bundle root (opa exec loads policy only via bundles). Mutually exclusive with `bundle`. | |
| fail | No | CI gate: report `failed: true` when any decision is undefined or errors. Mutually exclusive with `failDefined` and `failNonEmpty`. | |
| failDefined | No | CI gate: report `failed: true` when any decision is defined or errors. Use when a defined result means a violation. Mutually exclusive with `fail` and `failNonEmpty`. | |
| failNonEmpty | No | CI gate: report `failed: true` when any decision result is non-empty or errors. Mutually exclusive with `fail` and `failDefined`. | |
| timeout | No | Per-exec evaluation timeout as a Go duration, e.g. `"30s"` or `"5m"`. Still bounded by the server subprocess timeout (OPA_MCP_TIMEOUT_MS). | |
| v1Compatible | No | Opt in to OPA v1.0-compatible behaviors (`--v1-compatible`). |