Rego dependency analysis

Instructions

Implementation Reference

• src/tools/authoring/deps.ts:41-79 (handler)

  The `registerRegoDeps` function registers the 'rego_deps' tool on the MCP server. The handler (lines 52-77) validates paths, executes `opa deps` via the OPA CLI wrapper, parses the JSON output, and returns base/virtual document dependencies for the given Rego ref.

  export function registerRegoDeps(server: McpServer, config: Config): void {
    const opa = new OpaCli(config);
  
    server.registerTool(
      'rego_deps',
      {
        title: 'Rego dependency analysis',
        description:
          'Static dependency analysis for a Rego reference. Given a target ref like "data.example.allow", returns the base document references (input/data leaves) and virtual document references (rules) it depends on, transitively.',
        inputSchema: RegoDepsInput,
      },
      async ({ paths, ref }) => {
        return withToolEnvelope<RegoDepsOutput>(config, async () => {
          const validation = validatePaths(paths, config, { mustExist: true });
          if (!validation.ok) return validation.error;
  
          const result = await opa.deps({ paths: validation.resolved, ref });
          const subprocessFailure = mapSubprocessFailure(result, 'opa');
          if (subprocessFailure) return subprocessFailure;
  
          if (result.exitCode !== 0) {
            return err(
              'INVALID_REGO',
              'opa deps exited non-zero — the policy did not compile or the ref is invalid.',
              { details: { stderr: result.stderr.trim(), ref } },
            );
          }
  
          const parsed = tryParseJson<RegoDepsOutput>(result.stdout);
          if (parsed === undefined) {
            return err('UNKNOWN_ERROR', 'opa deps produced no parseable JSON output.', {
              details: { stdout: result.stdout.trim() },
            });
          }
          return ok<RegoDepsOutput>(parsed);
        });
      },
    );
  }

• src/tools/authoring/deps.ts:23-39 (schema)

  Input schema (`RegoDepsInput`) defines `paths` (array of strings, min 1) and `ref` (string, min 1) for the tool. Output interface (`RegoDepsOutput`) has optional `base` and `virtual` arrays.

  const RegoDepsInput = {
    paths: z
      .array(z.string())
      .min(1)
      .describe(
        'Policy / data paths to load before computing dependencies. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).',
      ),
    ref: z
      .string()
      .min(1)
      .describe('Reference to compute dependencies for, e.g. "data.example.allow".'),
  };
  
  export interface RegoDepsOutput {
    base?: unknown[];
    virtual?: unknown[];
  }

• src/tools/authoring/index.ts:13-27 (registration)

  The tool is imported from `./deps.js` and registered via `registerRegoDeps(server, config)` inside `registerAuthoringTools`.

  import { registerRegoDeps } from './deps.js';
  import { registerRegoFormat } from './format.js';
  import { registerRegoInspect } from './inspect.js';
  import { registerRegoLint } from './lint.js';
  import { registerRegoParseAst } from './parse.js';
  
  export function registerAuthoringTools(server: McpServer, config: Config): void {
    registerRegoFormat(server, config);
    registerRegoCheck(server, config);
    registerRegoLint(server, config);
    registerRegoParseAst(server, config);
    registerRegoInspect(server, config);
    registerRegoCapabilities(server, config);
    registerRegoDeps(server, config);
  }