Potencia tu agente
Instalación del publicador. No es un endpoint de PlugMCP.
Host a copy with our keys and logs.
Aún no hay una versión empaquetada en el registro. Sigue el README del repositorio.
¿URL remota o un comando en tu máquina? En qué se diferencian las dos instalaciones
Ejecutar en PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
AbrirDel publicador
A small Model Context Protocol (MCP) server for two NowSecure products — NowSecure Platform (DevSecOps triage of your own mobile app portfolio) and NowSecure MARI (Mobile App Risk Intelligence — vetting vendor/third-party apps). It gives an AI assistant a focused set of read-only tools for each — see .
A local Model Context Protocol (MCP) server for NowSecure.
For step-by-step setup guidance, see the NowSecure Support article Install and use the NowSecure MCP Server with Claude Desktop.
.mcpb asset from the
latest release.That's it—the bundle includes nsmcp and configures it for you. There is no separate binary to install and no JSON to edit. It supports macOS (Apple silicon and Intel) and Windows x64.
Pick your client below — each button uses the client's native install link to prefill the nsmcp config, so you don't need to edit any JSON by hand.
Both buttons prefill a config with "command": "nsmcp", so nsmcp must
already be on your PATH for it to launch (edit the command field to an
absolute path otherwise). After installing, replace YOUR_TOKEN with a real
token from https://app.nowsecure.com/account/tokens. The buttons configure
Platform; for MARI, change the product value from platform to mari and
name the entry nsmcp-mari.
claude mcp add --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform
--scope controls where the entry is stored (defaults to local,
i.e. ~/.claude.json keyed to this project directory):
claude mcp add --scope user --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform # global, all projects
claude mcp add --scope project --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform # .mcp.json, team-shared
Manage with claude mcp list / claude mcp get nsmcp-platform /
claude mcp remove nsmcp-platform, or /mcp inside a session.
Download the .mcpb release asset and open it in Claude Desktop for a guided
install. The single bundle supports macOS (arm64 and amd64) and Windows
amd64; the installer asks for a product and stores your API token as a
sensitive setting. Enter exactly platform to analyze mobile apps your
organization develops and scans, or mari to evaluate the risk of vendor and
other third-party mobile apps. No other product values are accepted.
For a manual installation, use Settings → Developer → Edit Config to open
claude_desktop_config.json:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"nsmcp-platform": {
"command": "/absolute/path/to/nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
}
}
}
Restart Claude Desktop after editing.
Use the one-click button above, or edit
~/.cursor/mcp.json (global) or .cursor/mcp.json (project) by hand:
{
"mcpServers": {
"nsmcp-platform": {
"command": "nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
}
}
}
CLI:
code --add-mcp "{\"name\":\"nsmcp-platform\",\"command\":\"nsmcp\",\"args\":[\"serve\",\"--product\",\"platform\"],\"env\":{\"NOWSECURE_API_TOKEN\":\"YOUR_TOKEN\"}}"
Or .vscode/mcp.json, using VS Code's inputs prompt so the token isn't
checked into the file:
{
"servers": {
"nsmcp-platform": {
"command": "nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "${input:nsmcp_token}" }
}
},
"inputs": [
{ "type": "promptString", "id": "nsmcp_token", "description": "NowSecure API Token", "password": true }
]
}
Command Palette → "Windsurf: Configure MCP Servers", or edit directly:
~/.codeium/windsurf/mcp_config.json%USERPROFILE%\.codeium\windsurf\mcp_config.json{
"mcpServers": {
"nsmcp-platform": {
"command": "nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
}
}
}
Windsurf config is global only (no per-project file).
gemini mcp add -e NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN nsmcp-platform nsmcp serve --product platform
Or ~/.gemini/settings.json (user) / .gemini/settings.json (project):
{
"mcpServers": {
"nsmcp-platform": {
"command": "nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
}
}
}
codex mcp add nsmcp-platform --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN -- nsmcp serve --product platform
Or ~/.codex/config.toml (note snake_case mcp_servers, unlike other clients):
[mcp_servers.nsmcp-platform]
command = "nsmcp"
args = ["serve", "--product", "platform"]
env = { NOWSECURE_API_TOKEN = "YOUR_TOKEN" }
Desktop app (Codex features) — local stdio, like other clients. The
ChatGPT desktop app shares MCP configuration with Codex
(~/.codex/config.toml), so the Codex CLI setup above also enables nsmcp
here. Or add it in-app: Settings → MCP servers → Add server →
STDIO, command nsmcp serve --product platform. This powers the app's Codex/agent
features, not regular chat conversations. See
docs for
details.
settings.json (~/.config/zed/settings.json, or Command Palette → "zed: open settings")
uses context_servers, not mcpServers:
{
"context_servers": {
"nsmcp-platform": {
"command": "nsmcp",
"args": ["serve", "--product", "platform"],
"env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
}
}
}
Each server process exposes exactly one product. Choose it explicitly with
--product platform or --product mari; the flag is required. To use both
products in one MCP client, configure two nsmcp server entries with different
names and product values.
--product platform)Triage your own mobile app portfolio: scores, findings, fleet-wide impact, and remediation guidance.
The portfolio covers a rolling 12-month window: apps without a completed scan
in the last 12 months are absent from list_apps and
get_apps_affected_by_finding entirely. list_assessments is not windowed
and still serves their older scan history.
--product mari)Vet vendor and third-party apps you didn't build, by risk score, letter rating, and findings.
Clients that support MCP prompts can show these workflow starters directly in their prompt picker. Each product mode advertises only its own prompts.
You can also ask your assistant in chat:
Your assistant can retrieve scan observations and available code locations to explain a finding or guide a fix. Source changes and tests use the assistant's coding tools; a new scan is needed to verify the result.
Connecting an AI assistant to your NowSecure data creates powerful workflows but also structural risks. Any MCP client or server you enable (IDE plugins, desktop apps, other MCP servers running alongside nsmcp) can cause an AI agent to act on your behalf with your credentials.
Large language models are vulnerable to prompt injection and related attacks (indirect prompt injection, tool poisoning). Anything the model reads can carry instructions that steer the agent to exfiltrate data or take unintended actions you never asked for — and some of what nsmcp returns originates in third-party apps (titles, metadata, finding details), so treat it as untrusted content, not just results. nsmcp's tools are currently all read-only, which limits what an agent can change through this server — but review the tools your client actually lists rather than relying on this document: the tool set will evolve, and other NowSecure MCP servers may expose read-write tools. The vulnerability data nsmcp returns is sensitive regardless, and a compromised agent could leak it through other tools it has access to (file writes, web requests, messaging).
To reduce risk:
--product platform or --product mari).Download a binary for your platform from the releases page, or build from source (see Build & run):
git clone [email protected]:nowsecure/nowsecure-mcp-server.git && cd nowsecure-mcp-server
make build # -> ./nsmcp
Put ./nsmcp on your PATH, or use an absolute path in client configs below.
macOS: release binaries are unsigned; if Gatekeeper blocks a downloaded binary, clear the quarantine flag:
xattr -d com.apple.quarantine ./nsmcp
Get credentials:
NOWSECURE_API_TOKEN.nsmcp login (coming soon): OAuth device-code login — not usable
until the dedicated Auth0 CLI client is provisioned; see
Log in with your NowSecure account.Choose a product: use --product platform for your own mobile app portfolio
or --product mari for third-party app risk intelligence. Then configure
your client from the list below.
Mint a static token at https://app.nowsecure.com/account/tokens.
Flags (accepted before or after the subcommand): --token, --base-url, and
the required --product value (platform or mari).
nsmcp login # device-code OAuth flow
nsmcp whoami
nsmcp logout
nsmcp login opens a browser to a device-code confirmation page, then mints a
scoped NowSecure platform API token named nsmcp/<hostname> and stores it in
your OS keychain (falls back to a local file if no keychain is available).
nsmcp serve --product platform (or --product mari) picks that token up
automatically — no NOWSECURE_API_TOKEN needed. nsmcp logout revokes the
stored token.
Login flags: --expiration-days (token lifetime, default 90, max 365),
--token-name (default nsmcp/<hostname>), --client-id (else
$NOWSECURE_OAUTH_CLIENT_ID), --no-browser (print the verification URL
instead of opening a browser).
Caveat: this requires a dedicated Auth0 OAuth client for CLI login, which
does not exist yet (it is being provisioned). Until it lands, nsmcp login
cannot succeed for any client ID; once it does, set
NOWSECURE_OAUTH_CLIENT_ID (a default will ship in a later release). The
static token flow above works today with no extra setup.
nsmcp serve --product platform --http <addr> (or --product mari) runs a
remote, OAuth-protected resource server instead of stdio (the MCP-spec OAuth 2.1 flow:
clients discover the
authorization server via /.well-known/oauth-protected-resource and drive the
browser login themselves). It's a separate deployment mode, not needed for the
local-client setups above.
make build # -> ./nsmcp
./nsmcp serve --product platform # Platform MCP server over stdio
./nsmcp serve --product mari # MARI MCP server over stdio
./nsmcp login # OAuth device-code login (see above)
./nsmcp whoami
./nsmcp logout
./nsmcp version
./nsmcp profile apps # call the REST API directly (endpoint verification)
./nsmcp completion zsh # bash|zsh|fish|powershell
Build the single installable bundle from a macOS development machine:
make mcpb VERSION=0.1.3
# -> dist/nsmcp.mcpb
The bundle asks for a product when installed. Enter exactly platform for
mobile apps your organization develops and scans, or mari for vendor and
other third-party mobile apps; no other values are accepted.
It contains a universal macOS binary (arm64 + amd64) and a Windows amd64
binary, selected by the manifest's platform override. mcpb-checksums.txt is
written alongside the bundle, and the bundle is attached to each GitHub
release automatically.
go install isn't available yet — this module has no hosted module path, so
download a prebuilt binary from the
releases page or
build from a clone (git clone + make build) as shown in
Quick start. Homebrew is future work.
make test # go test ./...
make vet # go vet ./...
make fmt # gofmt -w .
For evidence retrieval details and the opt-in context consumption audit, see Evidence integration and testing.
Copyright © 2026 NowSecure, Inc. All rights reserved.
This is proprietary software. Authorized NowSecure customers may download, build, and run unmodified copies solely for internal use with NowSecure services they are authorized to access, subject to their applicable agreement with NowSecure. See the NowSecure Customer Use License.
A local Model Context Protocol (MCP) server for NowSecure.
Herramientas
Aún no hay lista de herramientas. Los servidores remotos la reciben tras la primera comprobación de estado.
Preguntas frecuentes
Copia en esta página la configuración stdio para Cursor, Claude Desktop, Claude Code o VS Code. Usa la instalación del publicador, no un proxy de PlugMCP.
Este registro no indica ninguna variable de entorno obligatoria.
Nowsecure se ejecuta localmente por stdio.
Última comprobación: 2026-10-28. A local Model Context Protocol (MCP) server for NowSecure.