{
  "markdown": "# Openlane MCP Server\n\n[![CI](https://github.com/GregDog/mcp-server-theopenlane/actions/workflows/ci.yml/badge.svg)](https://github.com/GregDog/mcp-server-theopenlane/actions/workflows/ci.yml)\n[![Go](https://img.shields.io/badge/Go-1.27-00ADD8?logo=go&logoColor=white)](https://go.dev/)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![CodeQL](https://github.com/GregDog/mcp-server-theopenlane/actions/workflows/codeql.yml/badge.svg)](https://github.com/GregDog/mcp-server-theopenlane/actions/workflows/codeql.yml)\n\nA secure, open-source [Model Context Protocol](https://modelcontextprotocol.io/) server for the [Openlane](https://www.theopenlane.io/) GRC platform.\n\nThis project is **not** an official Openlane product and is not endorsed by theopenlane, Inc.\n\n## Overview\n\n`openlane-mcp` lets MCP clients such as Cursor and Claude Desktop query Openlane over **stdio** (default) or **Streamable HTTP**. It talks to Openlane Cloud or a self-hosted instance through the [official Openlane Go client](https://github.com/theopenlane/go-client).\n\n```text\nMCP Client\n    → Openlane MCP Server (stdio or HTTP)\n        → Official Openlane Go Client\n            → Openlane API\n```\n\nThe server is read-only by default. Write and delete tools are opt-in and independent. Openlane authorization still applies to every request.\n\n## Features\n\n- Openlane MCP access for programs, controls, evidence, policies, risks, standards, tasks, entities (vendors), assets, contacts, findings, assessments, control implementations, groups, users, and workflows\n- Enriched get tools with vendor/security fields and compact relationship summaries\n- List filters on entities, risks, findings, evidence, programs, assessments, implementations, and workflows\n- Opt-in create/update tools for controls, evidence, policies, risks, tasks, workflow definitions, workflow assignments, and native policy lifecycle\n- Opt-in delete tools for the same domains plus workflow definitions (except programs and standards)\n- Openlane Cloud and self-hosted Openlane (configurable base URL)\n- stdio transport (default) and opt-in Streamable HTTP transport\n- Native Go binary\n- Docker image (published with GitHub Releases)\n- MCP Registry listing on tagged releases (`io.github.GregDog/mcp-server-theopenlane`)\n\n## Quick Start\n\nCreate an Openlane API token or PAT in console developer settings. Organization tokens start with `tola_`. Personal access tokens start with `tolp_`.\n\n```bash\nexport OPENLANE_API_TOKEN=\"tola_...\"\n# Optional for multi-org PATs:\nexport OPENLANE_ORGANIZATION_ID=\"...\"\n\nopenlane-mcp serve\n```\n\nThen connect an MCP client. See [Client configuration](#client-configuration).\n\n## Installation\n\n### From source\n\n```bash\ngo install github.com/GregDog/mcp-server-theopenlane/cmd/openlane-mcp@latest\n```\n\nRequires Go 1.27 or later.\n\n### GitHub Releases\n\nBinary archives will be published on tagged GitHub Releases (`linux`/`darwin` amd64+arm64, `windows` amd64) with SHA256 checksums.\n\n### Docker\n\n```bash\ndocker run --rm -i \\\n  -e OPENLANE_API_TOKEN \\\n  -e OPENLANE_ORGANIZATION_ID \\\n  ghcr.io/gregdog/mcp-server-theopenlane serve\n```\n\nImages are published with GitHub Releases to `ghcr.io/gregdog/mcp-server-theopenlane`.\n\n## Client configuration\n\n### Cursor (stdio, recommended)\n\nThis repository's `.cursor/mcp.json` uses `scripts/mcp-serve.sh`, which loads `.env` and runs the local binary:\n\n```json\n{\n  \"mcpServers\": {\n    \"openlane\": {\n      \"command\": \"bash\",\n      \"args\": [\"${workspaceFolder}/scripts/mcp-serve.sh\"]\n    }\n  }\n}\n```\n\nOr install globally and pass env vars directly:\n\n```json\n{\n  \"mcpServers\": {\n    \"openlane\": {\n      \"command\": \"openlane-mcp\",\n      \"args\": [\"serve\"],\n      \"env\": {\n        \"OPENLANE_API_TOKEN\": \"${env:OPENLANE_API_TOKEN}\",\n        \"OPENLANE_ORGANIZATION_ID\": \"${env:OPENLANE_ORGANIZATION_ID}\"\n      }\n    }\n  }\n}\n```\n\n### Cursor (HTTP)\n\nStart the server with `bash scripts/mcp-http.sh` (see [HTTP transport](#http-transport)), then use `examples/cursor-http.mcp.json` as a template.\n\n### Claude Desktop\n\nAdd to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"openlane\": {\n      \"command\": \"openlane-mcp\",\n      \"args\": [\"serve\"],\n      \"env\": {\n        \"OPENLANE_API_TOKEN\": \"tola_your_token_here\"\n      }\n    }\n  }\n}\n```\n\nPrefer environment substitution or a local secrets store over committing tokens. Examples in this repository use fictional values only.\n\n## Security\n\nRead tools are always available. Write tools require `OPENLANE_ALLOW_WRITE=true` or `--allow-write`. Delete tools require `OPENLANE_ALLOW_DELETE=true` or `--allow-delete`.\n\nA successful read still requires:\n\n1. An Openlane token with the relevant `object:read` scope (or equivalent PAT permissions)\n2. Openlane authorization for that object in the selected organization\n\nWrites and deletes additionally require server opt-in (`OPENLANE_ALLOW_WRITE` / `OPENLANE_ALLOW_DELETE`) and matching Openlane token permissions. Workflow definition writes, workflow assignment actions, native policy lifecycle actions, and workflow deletes also require `confirm: true` on the tool call.\n\nTokens are never logged. See [docs/security.md](docs/security.md).\n\n## Tool coverage\n\n| Tool | Description |\n| --- | --- |\n| `openlane_controls_list` | List controls |\n| `openlane_controls_search` | Search controls by ref code, title, or description |\n| `openlane_control_get` | Get a control by ID (with relationship summaries) |\n| `openlane_programs_list` | List programs (optional name filter) |\n| `openlane_program_get` | Get a program by ID (with relationship summaries) |\n| `openlane_evidence_list` | List evidence metadata (optional program/control filters) |\n| `openlane_evidence_get` | Get evidence metadata by ID |\n| `openlane_policies_list` | List internal policies (optional status filter) |\n| `openlane_policies_awaiting_approval` | List policies awaiting approval (native NEEDS_APPROVAL + your pending workflow assignments) |\n| `openlane_policy_get` | Get a policy by ID |\n| `openlane_risks_list` | List risks (optional program/entity/control/status filters) |\n| `openlane_risk_get` | Get a risk by ID (with relationship summaries) |\n| `openlane_findings_list` | List findings (optional program/assessment/open/status/severity filters) |\n| `openlane_finding_get` | Get a finding by ID |\n| `openlane_assessments_list` | List assessments |\n| `openlane_assessment_get` | Get an assessment by ID |\n| `openlane_control_implementations_list` | List control implementations |\n| `openlane_control_implementation_get` | Get a control implementation by ID |\n| `openlane_standards_list` | List standards / frameworks |\n| `openlane_standard_get` | Get a standard by ID |\n| `openlane_tasks_list` | List tasks |\n| `openlane_task_get` | Get a task by ID |\n| `openlane_entities_list` | List entities (vendors; optional risk/tier/review/security filters) |\n| `openlane_entity_get` | Get an entity by ID (vendor/security/commercial fields) |\n| `openlane_assets_list` | List assets |\n| `openlane_asset_get` | Get an asset by ID |\n| `openlane_contacts_list` | List contacts |\n| `openlane_contact_get` | Get a contact by ID |\n| `openlane_groups_list` | List groups (optional name filter) |\n| `openlane_group_get` | Get a group by ID |\n| `openlane_users_list` | List users (optional name/email filters) |\n| `openlane_user_get` | Get a user by ID |\n| `openlane_workflows_list` | List workflow definitions (optional schema/kind/active filters) |\n| `openlane_workflows_search` | Search workflow definitions by name or description |\n| `openlane_workflow_get` | Get a workflow definition by ID (with plain-English summary) |\n| `openlane_workflow_instances_list` | List workflow instances (optional definition/state/object filters) |\n| `openlane_workflow_instance_get` | Get a workflow instance by ID (assignments, events, proposal preview) |\n| `openlane_workflow_assignments_list` | List my workflow approval assignments |\n| `openlane_workflow_assignment_get` | Get a workflow assignment by ID (targets, due date, object context) |\n| `openlane_workflow_metadata_get` | Get workflow-eligible fields, edges, and resolver keys per object type |\n\nWrite tools (require `OPENLANE_ALLOW_WRITE=true` or `--allow-write`):\n\n| Tool | Description |\n| --- | --- |\n| `openlane_control_create` / `openlane_control_update` | Create or update a control |\n| `openlane_evidence_create` / `openlane_evidence_update` | Create or update evidence; optional base64 file uploads |\n| `openlane_policy_create` / `openlane_policy_update` | Create or update an internal policy |\n| `openlane_policy_submit_for_approval` / `openlane_policy_approve` / `openlane_policy_publish` / `openlane_policy_return_to_draft` | Native InternalPolicy status transitions (`confirm` required) |\n| `openlane_risk_create` / `openlane_risk_update` | Create or update a risk |\n| `openlane_task_create` / `openlane_task_update` | Create or update a task |\n| `openlane_workflow_create` / `openlane_workflow_update` | Create or update a WorkflowDefinition (`confirm` required) |\n| `openlane_workflow_assignment_approve` / `openlane_workflow_assignment_reject` | Approve or reject a WorkflowAssignment (`confirm` required) |\n| `openlane_workflow_assignment_request_changes` / `openlane_workflow_assignment_reassign` | Request changes or reassign an assignment (`confirm` required) |\n\nDelete tools (require `OPENLANE_ALLOW_DELETE=true` or `--allow-delete`):\n\n| Tool | Description |\n| --- | --- |\n| `openlane_control_delete` | Delete a control by ID |\n| `openlane_evidence_delete` | Delete evidence by ID |\n| `openlane_policy_delete` | Delete a policy by ID |\n| `openlane_risk_delete` | Delete a risk by ID |\n| `openlane_task_delete` | Delete a task by ID |\n| `openlane_workflow_delete` | Delete a workflow definition by ID (`confirm` required) |\n\nSee [docs/tools.md](docs/tools.md) for full details. With all modes enabled there are **66 tools** (40 read, 20 write, 6 delete).\n\nEnriched get tools return bounded relationship summaries (`count` + `items`) so agents can answer program, vendor, control, and finding questions without chaining dozens of shallow calls.\n\nList responses are paginated (`items`, `next_cursor`, `has_more`, `total_count`). Default page size is 20; maximum is 50.\n\nThere is no dedicated control search GraphQL operation in the current Openlane Go client. `openlane_controls_search` uses official `ControlWhereInput` contains-filters.\n\nFile contents and presigned download URLs are not returned from read tools. Write tools accept optional base64-encoded `files[]` on evidence create/update (default max 10 MiB decoded per file).\n\n## HTTP transport\n\nBy default the server uses stdio. For local HTTP testing:\n\n```bash\nexport OPENLANE_MCP_TRANSPORT=http\nexport OPENLANE_MCP_HTTP_ADDR=127.0.0.1:8090\nopenlane-mcp serve\n```\n\nThe default bind is **loopback only** (`127.0.0.1:8090`). Do not use `0.0.0.0` or bare `:port` addresses unless you understand the exposure.\n\n**HTTP mode has no built-in authentication.** Do not expose it directly to the public internet. Anyone who can reach the endpoint can use the server's Openlane token. For remote or shared-network deployment, place a trusted authentication reverse proxy (or equivalent private network controls) in front of the server. See [docs/security.md](docs/security.md).\n\nIncrease `OPENLANE_MCP_HTTP_MAX_BODY_BYTES` when uploading large evidence files over HTTP.\n\n## MCP Registry\n\nPublished to the [MCP Registry](https://registry.modelcontextprotocol.io/) as `io.github.GregDog/mcp-server-theopenlane` on each tagged release. The OCI package is `ghcr.io/gregdog/mcp-server-theopenlane`.\n\n## Development\n\n```bash\nmake test\nmake build\n./bin/openlane-mcp version\n```\n\nSee [docs/development.md](docs/development.md).\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md). To add or extend an MCP tool, see [docs/adding-tools.md](docs/adding-tools.md).\n\nIssues labeled `good first issue` or `help wanted` are a good place to start.\n\n## Licence\n\nApache License 2.0. See [LICENSE](LICENSE).\n\nOpenlane names are used only to describe compatibility. Do not copy Openlane logos or imply official endorsement.\n",
  "bytes": 12125,
  "sha": "cfed6d43aff25684e9a0cea1af63733659f5fa870efe28f1c7b3b79d64e0142b",
  "repo_slug": "gregdog/mcp-server-theopenlane",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_gregdog_mcp_server_theopenlane_4eb4c9d0/readme"
}