Connectors · Identity & security
Opal Security MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Opal Security and the rest of your systems. It gives your agent 201 Opal Security actions (92 reads, 77 writes and 32 that wait for a confirmation) and holds the Opal Security credential itself, so the agent never does. It paces Opal Security's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "opal.users.list_users", intent: "check which Opal Security account is connected"}# List users · read · 1 upstream call- 201actionsin one signed file
- 92readlook, never change
- 77writecreate and update
- 32wait for a yesdestructive, confirmed first
Set up
Connect Opal Security in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Opal Security.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_tokenOpal API token
account { op: "connections.requirements", service: "opal" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "opal.users.list_users" }# list users · read · 1 upstream callcheck { action: "opal.users.invite_user", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Opal Security at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_token- Limits we pace to
- 10 calls a second, per connection
- API covered
- Opal API v1 (OpenAPI 3.1, api.opal.dev/v1)
api.opal.dev/v1 - Built from
- Opal Security's documentation, read 23 October 2026app.opal.devdocs.opal.dev
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 89 of 92 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line Opal Security up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Opal Security.
201 actions in 29 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 92readlook, never change
- 77writecreate and update
- 32destructivewait for a confirmation
Resources
3417 read · 12 write · 5 destructive
Gives a non-human identity access to this resource · Adds a user to this resource · Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources · Create resource custom access level
Groups
2914 read · 12 write · 3 destructive
Get groups · Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects) · Get group by ID · Deletes a group
Bundles
135 read · 5 write · 3 destructive
Adds a group to a bundle · Adds a resource to a bundle · Creates a bundle · Returns a list of `Group` objects in a given bundle
Requests
124 read · 7 write · 1 destructive
Create an access request · Get requests · Get request by ID · Approve an access request
Campaigns
114 read · 6 write · 1 destructive
Returns a list of `Campaign` objects · Create campaign · Get campaign by ID · Update campaign
Tags
113 read · 4 write · 4 destructive
Applies a tag to a group · Applies a tag to a resource · Applies a tag to a user · Creates a tag with the given key and value
Users
106 read · 2 write · 2 destructive
List users · Invites a user to your organization · Get user by ID · Deletes a user from your organization
Owners
84 read · 3 write · 1 destructive
Creates an owner · Gets the list of users for this owner, in escalation priority order if applicable · Get owners · Get owner by ID
21 more areas · 73 actions
- Paladin 8
- Scripts 6
- Apps 5
- Group bindings 5
- Idp group mappings 5
- Request templates 5
- Access rules 4
- Configuration templates 4
- Delegations 4
- Event streams 4
- Agents 3
- Message channels 3
- On call schedules 3
- Tokens 3
- Uars 3
- Events 2
- Role assignments 2
- Non human identities 1
- Queries 1
- Sessions 1
- Sync errors 1
Top actions
The Opal Security API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 34 of Opal Security's 36 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
opal.users.list_usersList users | List users. | read | identity.user.list474 connectors |
opal.groups.list_groupsGet groups | Get groups. | read | identity.group.list262 connectors |
opal.users.invite_userInvites a user to your organization | Invites a user to your organization. | write | identity.user.create262 connectors |
opal.groups.create_groupCreates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects) | Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects). | write | identity.group.create205 connectors |
opal.users.delete_userDeletes a user from your organization | Deletes a user from your organization. | destructive | identity.user.delete253 connectors |
opal.users.whoamiReturns the user that the provided API token authenticates as | Returns the user that the provided API token authenticates as. | read | identity.current_user.get307 connectors |
opal.groups.list_group_usersGets the list of users for this group | Gets the list of users for this group. | read | identity.group_member.list103 connectors |
opal.tokens.create_tokenCreate token | Create token. | write | identity.api_key.create100 connectors |
opal.tokens.list_tokensGet tokens | Get tokens. | read | identity.api_key.list96 connectors |
opal.events.list_eventsReturns a list of `Event` objects | Returns a list of `Event` objects. | read | identity.audit_event.list51 connectors |
opal.groups.update_group_userUpdates a user's access level or duration in this group | Updates a user's access level or duration in this group. | write | identity.group_member.update34 connectors |
opal.requests.create_requestCreate an access request | Create an access request. | write | identity.access_request.create12 connectors |
Try it
Prompts to paste into Claude.
Each one names the Opal Security actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in Opal Security? List every user and their role.
calls
opal.users.list_users - Writewrite
Invites a user to your organization in Opal Security. Show me exactly what you will send before you save it.
calls
opal.users.invite_user
Governance for Opal Security
Destructive actions wait for a yes.
32 Opal Security actions are destructive. The first 10:
- Deletes a user from your organization
opal.users.delete_user - Deletes a group
opal.groups.delete_group - Delete token
opal.tokens.delete_token - Removes a user's access from this group
opal.groups.delete_group_user - Deletes a delegation by its ID
opal.delegations.delete_delegation - Cancel request
opal.requests.cancel_request - Delete app
opal.apps.delete_app - UNSTABLE. May be removed at any time. Deletes a tag with the given id
opal.tags.delete_tag - Deletes an owner
opal.owners.delete_owner - Removes a tag from a user
opal.tags.remove_user_tag
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Deletes a user from your organization?
intent: the user asked me to deletes a user from your organization
account { op: "keys.create", name: "opal-agent", allowed_actions: ["opal.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "opal.users.delete_user", approver: "[email protected]" }, { match: "opal.groups.delete_group", approver: "[email protected]" }, { match: "opal.tokens.delete_token", approver: "[email protected]" } ]}Cost
What Opal Security costs on actionlake.
Every Opal Security action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Opal Security refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 201 Opal Security actions
- 201actions pageeach page of a long list is one call
- 89reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Opal Security action.
201 actions by area: the id your agent calls, what it does, and its effect.
Resources34
opal.resources.add_resource_nhiGives a non-human identity access to this resourcewriteopal.resources.add_resource_userAdds a user to this resourcewriteopal.resources.create_resourceCreates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resourceswriteopal.resources.create_resource_custom_access_levelCreate resource custom access levelwriteopal.resources.delete_resourceDeletes a resourcedestructiveopal.resources.delete_resource_custom_access_levelDelete resource custom access leveldestructiveopal.resources.delete_resource_nhiRemoves a non-human identity's direct access from this resourcedestructiveopal.resources.delete_resource_userRemoves a user's direct access from this resourcedestructiveopal.resources.get_resourceGet resource by IDreadopal.resources.get_resource_configuration_templateGet the ID of the configuration template linked to a resourcereadopal.resources.get_resource_userGet resource userreadopal.resources.get_resource_user_access_statusGet user's access status to a resourcereadopal.resources.get_resource_visibilityGets the visibility of this resourcereadopal.resources.list_resource_access_levelsGet resource access levelsreadopal.resources.list_resource_custom_access_levelsList resource custom access levelsreadopal.resources.list_resource_groupsReturns a list of groups that grant access to the resourcereadopal.resources.list_resource_message_channelsGets the list of audit message channels attached to a resourcereadopal.resources.list_resource_nhisGets the list of non-human identities with access to this resourcereadopal.resources.list_resource_reviewer_stagesGets the list reviewer stages for a resourcereadopal.resources.list_resource_reviewersGets the list of owner IDs of the reviewers for a resourcereadopal.resources.list_resource_scoped_role_permissionsList resource scoped role permissionsreadopal.resources.list_resource_tagsReturns all tags applied to the resourcereadopal.resources.list_resource_usersGet resource usersreadopal.resources.list_resourcesGet resourcesreadopal.resources.list_user_resourcesGets the list of resources for this userreadopal.resources.set_resource_message_channelsSets the list of audit message channels attached to a resourcewriteopal.resources.set_resource_reviewer_stagesSets the list of reviewer stages for a resourcewriteopal.resources.set_resource_reviewersSets the list of reviewers for a resourcewriteopal.resources.set_resource_scoped_role_permissionsSets all the scoped role permissions on an OPAL_SCOPED_ROLE resourcedestructiveopal.resources.set_resource_visibilitySets the visibility of this resourcewriteopal.resources.update_resource_configuration_templateSet the ID of the configuration template linked to a resourcewriteopal.resources.update_resource_custom_access_levelUpdate resource custom access levelwriteopal.resources.update_resource_userUpdates a user's access level or duration on this resourcewriteopal.resources.update_resourcesBulk updates a list of resourceswrite
Groups29
opal.groups.add_group_containing_groupCreates a new containing groupwriteopal.groups.add_group_resourceAdds a resource to a groupwriteopal.groups.add_group_userAdds a user to this groupwriteopal.groups.create_groupCreates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects)writeopal.groups.delete_groupDeletes a groupdestructiveopal.groups.delete_group_userRemoves a user's access from this groupdestructiveopal.groups.get_groupGet group by IDreadopal.groups.get_group_containing_groupGet nested group by IDreadopal.groups.get_group_visibilityGets the visibility of this groupreadopal.groups.list_group_access_levelsGet group access levelsreadopal.groups.list_group_containing_groupsGet nested groupsreadopal.groups.list_group_message_channelsGets the list of audit and reviewer message channels attached to a groupreadopal.groups.list_group_on_call_schedulesGets the list of on call schedules attached to a groupreadopal.groups.list_group_resourcesGets the list of resources that the group gives access toreadopal.groups.list_group_reviewer_stagesGets the list of reviewer stages for a groupreadopal.groups.list_group_reviewersGets the list of owner IDs of the reviewers for a groupreadopal.groups.list_group_tagsReturns all tags applied to the groupreadopal.groups.list_group_usersGets the list of users for this groupreadopal.groups.list_groupsGet groupsreadopal.groups.list_user_groupsReturns all groups that the user is a member ofreadopal.groups.remove_group_containing_groupRemoves a containing group from a groupdestructiveopal.groups.set_group_message_channelsSets the list of audit message channels attached to a groupwriteopal.groups.set_group_on_call_schedulesSets the list of on call schedules attached to a groupwriteopal.groups.set_group_resourcesSets the list of resources that the group gives access towriteopal.groups.set_group_reviewer_stagesSets the list of reviewer stages for a groupwriteopal.groups.set_group_reviewersSets the list of reviewers for a groupwriteopal.groups.set_group_visibilitySets the visibility of this groupwriteopal.groups.update_group_userUpdates a user's access level or duration in this groupwriteopal.groups.update_groupsBulk updates a list of groupswrite
Bundles13
opal.bundles.add_bundle_groupAdds a group to a bundlewriteopal.bundles.add_bundle_resourceAdds a resource to a bundlewriteopal.bundles.create_bundleCreates a bundlewriteopal.bundles.delete_bundleDeletes a bundledestructiveopal.bundles.get_bundleGet bundle by IDreadopal.bundles.get_bundle_visibilityGets the visibility of the bundlereadopal.bundles.list_bundle_groupsReturns a list of `Group` objects in a given bundlereadopal.bundles.list_bundle_resourcesReturns a list of `Resource` objects in a given bundlereadopal.bundles.list_bundlesGet bundlesreadopal.bundles.remove_bundle_groupRemoves a group from a bundledestructiveopal.bundles.remove_bundle_resourceRemoves a resource from a bundledestructiveopal.bundles.set_bundle_visibilitySets the visibility of the bundlewriteopal.bundles.update_bundleUpdates a bundlewrite
Requests12
opal.requests.approve_requestApprove an access requestwriteopal.requests.cancel_requestCancel requestdestructiveopal.requests.create_requestCreate an access requestwriteopal.requests.create_request_commentComment on an access requestwriteopal.requests.deny_requestDeny an access requestwriteopal.requests.escalate_requestEscalate request to skip-managerwriteopal.requests.get_requestGet request by IDreadopal.requests.list_request_commentsReturns a list of comments for a specific requestreadopal.requests.list_requestsGet requestsreadopal.requests.list_requests_relayGet requests via Relayreadopal.requests.remind_requestSend request reminderwriteopal.requests.remind_request_reviewerSend reminder to a reviewerwrite
Campaigns11
opal.campaigns.create_campaignCreate campaignwriteopal.campaigns.end_campaignEnd campaignwriteopal.campaigns.get_campaignGet campaign by IDreadopal.campaigns.list_campaign_itemsList campaign itemsreadopal.campaigns.list_campaign_viewer_itemsList viewer campaign itemsreadopal.campaigns.list_campaignsReturns a list of `Campaign` objectsreadopal.campaigns.review_campaign_itemsSubmit campaign item review decisionswriteopal.campaigns.start_campaignStart campaignwriteopal.campaigns.stop_campaignStop campaigndestructiveopal.campaigns.update_campaignUpdate campaignwriteopal.campaigns.update_campaign_item_reviewersUpdate campaign item reviewerswrite
Tags11
opal.tags.add_group_tagApplies a tag to a groupwriteopal.tags.add_resource_tagApplies a tag to a resourcewriteopal.tags.add_user_tagApplies a tag to a userwriteopal.tags.create_tagCreates a tag with the given key and valuewriteopal.tags.delete_tagUNSTABLE. May be removed at any time. Deletes a tag with the given iddestructiveopal.tags.get_tagGet tag by IDreadopal.tags.get_tag_by_keyGets a tag with the given key and valuereadopal.tags.list_tagsGet tagsreadopal.tags.remove_group_tagRemoves a tag from a groupdestructiveopal.tags.remove_resource_tagRemoves a tag from a resourcedestructiveopal.tags.remove_user_tagRemoves a tag from a userdestructive
Users10
opal.users.delete_userDeletes a user from your organizationdestructiveopal.users.get_userGet user by IDreadopal.users.invite_userInvites a user to your organizationwriteopal.users.list_remote_usersReturns a list of remote users for your organizationreadopal.users.list_user_tagsReturns all tags applied to the userreadopal.users.list_usersList usersreadopal.users.lookup_userReturns a `User` objectreadopal.users.reset_user_mfaReset a user's Opal MFAdestructiveopal.users.update_userUpdates a user's position or managerwriteopal.users.whoamiReturns the user that the provided API token authenticates asread
Owners8
opal.owners.create_ownerCreates an ownerwriteopal.owners.delete_ownerDeletes an ownerdestructiveopal.owners.get_ownerGet owner by IDreadopal.owners.get_owner_by_nameReturns an `Owner` object. Does not support owners with `/` in their name, use /owners?name=... insteadreadopal.owners.list_owner_usersGets the list of users for this owner, in escalation priority order if applicablereadopal.owners.list_ownersGet ownersreadopal.owners.set_owner_usersSet owner userswriteopal.owners.update_ownersBulk updates a list of ownerswrite
Paladin8
opal.paladin.create_paladinCreate Paladinwriteopal.paladin.create_paladin_context_sourceAdd a Paladin context sourcewriteopal.paladin.delete_paladinDelete Paladindestructiveopal.paladin.delete_paladin_context_sourceRemove a Paladin context sourcedestructiveopal.paladin.get_paladinGet Paladin by IDreadopal.paladin.get_paladin_by_nameGet Paladins by namereadopal.paladin.list_paladin_context_sourcesList Paladin context sourcesreadopal.paladin.update_paladinUpdate Paladinwrite
Scripts6
opal.scripts.create_opal_scriptCreate OpalScriptwriteopal.scripts.delete_opal_scriptDelete OpalScriptdestructiveopal.scripts.get_opal_scriptGet OpalScript by IDreadopal.scripts.get_opal_script_by_nameGet OpalScript by namereadopal.scripts.list_opal_scriptsList OpalScriptsreadopal.scripts.update_opal_scriptUpdate OpalScriptwrite
Apps5
opal.apps.create_appCreate appwriteopal.apps.delete_appDelete appdestructiveopal.apps.get_appGet app by IDreadopal.apps.list_appsGet appsreadopal.apps.update_appUpdate appwrite
Group bindings5
opal.group_bindings.create_group_bindingCreates a group bindingwriteopal.group_bindings.delete_group_bindingDeletes a group bindingdestructiveopal.group_bindings.get_group_bindingGet group binding by IDreadopal.group_bindings.list_group_bindingsGet group bindingsreadopal.group_bindings.update_group_bindingsBulk updates a list of group bindingswrite
Idp group mappings5
opal.idp_group_mappings.create_idp_group_mappingCreate idp group mappingwriteopal.idp_group_mappings.delete_idp_group_mappingsDeletes an `IdpGroupMapping` objectdestructiveopal.idp_group_mappings.get_idp_group_mappingGets an `IdpGroupMapping` object for an Okta app and groupreadopal.idp_group_mappings.list_idp_group_mappingsReturns the configured set of available `IdpGroupMapping` objects for an Okta appreadopal.idp_group_mappings.update_idp_group_mappingsUpdates the list of available `IdpGroupMapping` objects for an Okta appwrite
Request templates5
opal.request_templates.create_request_templateCreates a request templatewriteopal.request_templates.delete_request_templateDeletes a request templatedestructiveopal.request_templates.get_request_templateReturns a `RequestTemplate` objectreadopal.request_templates.list_request_templatesReturns a list of `RequestTemplate` objectsreadopal.request_templates.update_request_templateUpdates a request templatewrite
Access rules4
opal.access_rules.create_access_ruleCreates a new access rule config for the given group_idwriteopal.access_rules.get_access_ruleReturns a list of access rule config given the group_id of the access rulereadopal.access_rules.list_access_rulesReturns a list of access rules for your organizationreadopal.access_rules.update_access_ruleUpdates the access rule config for the given group_idwrite
Configuration templates4
opal.configuration_templates.create_configuration_templateCreates a configuration templatewriteopal.configuration_templates.delete_configuration_templateDeletes a configuration templatedestructiveopal.configuration_templates.list_configuration_templatesReturns a list of `ConfigurationTemplate` objectsreadopal.configuration_templates.update_configuration_templateUpdate a configuration templatewrite
Delegations4
opal.delegations.create_delegationCreates a new request reviewer delegation to delegate access review requests from one user to anotherwriteopal.delegations.delete_delegationDeletes a delegation by its IDdestructiveopal.delegations.get_delegationGet delegation by IDreadopal.delegations.list_delegationsGet delegationsread
Event streams4
opal.event_streams.create_event_streamCreate event streamwriteopal.event_streams.delete_event_streamDelete event streamdestructiveopal.event_streams.list_event_streamsGet event streamsreadopal.event_streams.update_event_streamUpdate event streamwrite
Agents3
opal.agents.get_agent_kill_switchGet the agent kill switchreadopal.agents.report_agent_activityReport agent activitywriteopal.agents.set_agent_kill_switchSet the agent kill switchwrite
Message channels3
opal.message_channels.create_message_channelCreates a `MessageChannel` objectswriteopal.message_channels.get_message_channelGet message channel by IDreadopal.message_channels.list_message_channelsGet message channelsread
On call schedules3
opal.on_call_schedules.create_on_call_scheduleCreates a `OnCallSchedule` objectswriteopal.on_call_schedules.get_on_call_scheduleGet on call schedule by IDreadopal.on_call_schedules.list_on_call_schedulesGet on call schedulesread
Tokens3
opal.tokens.create_tokenCreate tokenwriteopal.tokens.delete_tokenDelete tokendestructiveopal.tokens.list_tokensGet tokensread
Uars3
opal.uars.create_uarStarts a User Access Review. Deprecated in favor of `POST /campaigns`writeopal.uars.get_uarRetrieves a specific UAR. Deprecated in favor of `GET /campaigns/{campaign_id}`readopal.uars.list_uarsReturns a list of `UAR` objects. Deprecated in favor of `GET /campaigns`read
Events2
opal.events.get_eventGet event by IDreadopal.events.list_eventsReturns a list of `Event` objectsread
Role assignments2
opal.role_assignments.add_role_assignmentsAdd role assignmentsdestructiveopal.role_assignments.list_role_assignmentsList role assignmentsread
Non human identities1
opal.non_human_identities.list_nhisReturns a list of non-human identities for your organizationread
Queries1
opal.queries.run_queryRun an ad-hoc OpalQueryread
Sessions1
opal.sessions.list_sessionsReturns a list of `Session` objectsread
Sync errors1
opal.sync_errors.list_sync_errorsReturns a list of recent sync errors that have occurred since the last successful syncread
Questions
The Opal Security MCP server, answered.
Is there an Opal Security MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 201 Opal Security actions across resources, groups, bundles and requests, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Opal Security.
What do I need to connect Opal Security?
Opal API token. The free call account { op: "connections.requirements", service: "opal" } lists exactly what to paste.
Can an AI agent delete or change things in Opal Security?
Only if its key allows it, and only with an explicit confirmation. 32 Opal Security actions are destructive, including deletes a user from your organization, deletes a group and delete token. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Opal Security API limit?
actionlake paces every call to the limits in the Opal Security service file: 10 calls a second per connection. Repeated reads are answered from cache (89 Opal Security actions can be), which never reaches Opal Security.
What does an Opal Security action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (201 Opal Security actions page). Cache hits, searches, dry runs and calls Opal Security refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Opal Security API does it cover?
The Opal API v1 (OpenAPI 3.1, api.opal.dev/v1) at api.opal.dev/v1. It is built from Opal Security's documentation as read on 23 October 2026. 201 actions in 29 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Opal Security data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Opal Security credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Opal Security today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
