diff --git a/.gitignore b/.gitignore
index 9216c3e3..1a57305e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,7 @@ pip-log.txt
 
 # Unit test / coverage reports
 cover/
+.mypy_cache/
 .coverage*
 !.coveragerc
 .tox
diff --git a/lower-constraints.txt b/lower-constraints.txt
index a032c7ca..7c453f28 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -21,6 +21,7 @@ MarkupSafe==1.0
 mccabe==0.2.1
 mock==3.0.0
 mox3==0.20.0
+mypy==0.720
 netaddr==0.7.18
 openstackdocstheme==1.20.0
 os-client-config==1.28.0
diff --git a/setup.cfg b/setup.cfg
index 65dd9667..fdb567cf 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -34,3 +34,14 @@ oslo.config.opts =
 oslo.config.driver =
     remote_file = oslo_config.sources._uri:URIConfigurationSourceDriver
 
+[mypy]
+show_column_numbers = true
+show_error_context = true
+ignore_missing_imports = true
+follow_imports = skip
+incremental = true
+check_untyped_defs = true
+warn_unused_ignores = true
+
+[mypy-oslo_config.tests.*]
+ignore_errors = true
diff --git a/test-requirements.txt b/test-requirements.txt
index 2d1247de..47086b2b 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -9,6 +9,7 @@ testscenarios>=0.4 # Apache-2.0/BSD
 stestr>=2.1.0 # Apache-2.0
 testtools>=2.2.0 # MIT
 oslotest>=3.2.0 # Apache-2.0
+mypy>=0.720 # MIT
 
 # oslo.log can't be a runtime dep because it would cause a circular dependency,
 # but we can optionally make use of it so we want to have it installed in our
diff --git a/tox.ini b/tox.ini
index add6bd7e..92466fcc 100644
--- a/tox.ini
+++ b/tox.ini
@@ -32,8 +32,8 @@ deps =
 [testenv:pep8]
 commands =
   flake8
-  # Run security linter
-  bandit -r oslo_config -x tests -n5
+  # TODO(stephenfin): Add mypy here once it's passing
+  {[testenv:bandit]commands}
 
 [testenv:cover]
 setenv =
@@ -58,13 +58,13 @@ commands =
   rm -fr doc/build
   sphinx-build -W --keep-going -b html doc/source doc/build/html {posargs}
 
-[testenv:bandit]
-commands = bandit -r oslo_config -x tests -n5
+[testenv:mypy]
+commands =
+  mypy oslo_config
 
-[flake8]
-show-source = True
-enable-extensions = H203,H106
-exclude = .tox,dist,doc,*.egg,build
+[testenv:bandit]
+commands =
+  bandit -r oslo_config -x tests -n5
 
 [testenv:releasenotes]
 whitelist_externals =
@@ -76,3 +76,8 @@ commands =
 
 [hacking]
 import_exceptions = oslo_config._i18n
+
+[flake8]
+show-source = True
+enable-extensions = H203,H106
+exclude = .tox,dist,doc,*.egg,build