Skip to main content
Glama
OrygnsCode

opa-mcp-server

by OrygnsCode
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Explain why a Rego query is undefined

rego_explain_undefined

Diagnose why a Rego query returns no value or its default by tracing evaluation and analyzing conditions to pinpoint the exact rule body expression that blocks each rule.

Instructions

Diagnose why a fully-qualified Rego query (e.g. "data.authz.allow") produces no value, or falls back to its default. Combines a plain eval, a full-trace eval, and per-condition AST analysis to identify the exact body expression blocking each rule. Handles both runtime failures (trace-based) and indexer elimination (standalone condition eval). A rule written with default allow := false always has a value, so queryResult reports default for it and the same per-rule breakdown follows: the question "why is allow false" is the question this answers. Returns a structured breakdown of which conditions blocked each rule plus a human-readable summary.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
inputNoInput document (JSON value) for the query.
pathsNoPolicy .rego file paths to load. Mutually exclusive with source.
queryYesFully-qualified rule reference to explain, e.g. "data.authz.allow". Must match the path you would pass to rego_eval.
sourceNoInline Rego source to analyse. Mutually exclusive with paths.
inputPathNoPath to an input JSON file.
v0CompatibleNoRead the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load. Where the tool also takes a query, the query is read as v0 too, with the future keywords imported so `in`, `every` and `some x in` still work in it.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv0.8.0
    • addedInput schema / properties / v0Compatible
      Added value: +{
+  "description": "Read the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load. Where the tool also takes a query, the query is read as v0 too, with the future keywords imported so `in`, `every` and `some x in` still work in it.",
+  "type": "boolean"
+}
  2. Addedv0.1.14

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations marking this readOnlyHint=false and openWorldHint=true, the bar is lower, and the description adds real context: it combines three analysis passes, covers both runtime failures (trace-based) and indexer elimination (standalone condition eval), and explains how `default` rules are reported via `queryResult`. It also states the return shape (structured breakdown plus a human-readable summary), which matters because there is no output schema. It does not explain why the tool is flagged non-read-only, a minor omission.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and mechanism, and most sentences carry information. The middle sentence about `default allow := false` and `queryResult` is convoluted and ends on a tautology ('the question ... is the question this answers'), which is the one place that does not earn its space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter diagnostic tool with no output schema, the description does the necessary work: it explains the two failure classes handled and summarizes the return payload. It stops short of describing behavior when the query is actually defined (does it error, return empty, or succeed silently), which an agent would want to know before calling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the description largely restates it (fully-qualified query, defaults, v0 compatibility is covered in the schema). It adds only marginal param meaning, e.g. the requirement that the query path match what you would pass to rego_eval. Baseline 3 is correct when the schema carries the documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (diagnose/explain) and a precise resource/scope: a fully-qualified Rego query that produces no value or falls back to a default. It further distinguishes the scenario from a generic eval by describing the mechanism (plain eval + full-trace + per-condition AST analysis). It does not, however, name the nearby siblings it must be distinguished from (rego_eval_with_explain, rego_explain_decision), so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the tool is for the case where a query is undefined or returns a default. There is no explicit 'when not to use this' or a named alternative such as rego_eval or rego_explain_decision for the case where the query does produce a value. The awkward restatement that 'why is allow false' is the question this answers adds scenario color but not routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools