diff --git a/agents/tools/mcp_tools.py b/agents/tools/mcp_tools.py
index bf0cc67..eabb835 100644
--- a/agents/tools/mcp_tools.py
+++ b/agents/tools/mcp_tools.py
@@ -3,6 +3,7 @@ mcp_tools.py — MCP toolset integrations for OSVauco ADK agent.
 Supports:
   - Google BigQuery MCP (via StreamableHTTP, uses ADC/OAuth)
   - Google Maps MCP (via StreamableHTTP, uses API key)
+  - OPAX-MCP (Vauco intern CI/CD-kanal, uses MCP_SECRET + identity token)
   - Local stdio MCP server (dev/test only)
 
 Requires: google-adk >= 2.0.0, google-auth
@@ -53,6 +54,31 @@ def get_maps_mcp_toolset() -> MCPToolset:
         )
     )
 
+# --- OPAX-MCP (Vauco intern CI/CD-kanal) ---
+OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-zjbqp3prqq-uc.a.run.app")
+
+def get_opax_mcp_toolset() -> MCPToolset:
+    """
+    Connect to Vauco sin interne opax-mcp server.
+    Auth: Cloud Run identity token (Bearer) + X-MCP-Key header fra Secret Manager.
+    """
+    mcp_secret = os.environ.get("MCP_SECRET", "")
+    if not mcp_secret:
+        raise ValueError("MCP_SECRET env var ikke satt. Sjekk Secret Manager: mcp-server-key")
+
+    credentials, _ = google.auth.default()
+    credentials.refresh(google.auth.transport.requests.Request())
+
+    return MCPToolset(
+        connection_params=StreamableHTTPConnectionParams(
+            url=f"{OPAX_MCP_URL}/mcp",
+            headers={
+                "Authorization": f"Bearer {credentials.token}",
+                "X-MCP-Key": mcp_secret,
+            },
+        )
+    )
+
 # --- Local stdio MCP server (dev/test only) ---
 def get_local_stdio_toolset(command: str, args: list[str]) -> MCPToolset:
     """Connect to a local stdio MCP server for development and testing."""