Nowsecure

nowsecure1stars

A local Model Context Protocol (MCP) server for NowSecure.

1# Nowsecure

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: NOASSERTION
Last checked: 2026-10-28

Stars: 1
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Nowsecure?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Nowsecure need an API key?

No required environment variable is listed on this record.

What transport does Nowsecure use?

Nowsecure runs locally over stdio.

When was Nowsecure last checked?

Last checked 2026-10-28. A local Model Context Protocol (MCP) server for NowSecure.

From the publisher

Documentation

NowSecure MCP (beta)

A small Model Context Protocol (MCP) server for two NowSecure products — NowSecure Platform (DevSecOps triage of your own mobile app portfolio) and NowSecure MARI (Mobile App Risk Intelligence — vetting vendor/third-party apps). It gives an AI assistant a focused set of read-only tools for each — see Supported products and tools.

Install

For step-by-step setup guidance, see the NowSecure Support article Install and use the NowSecure MCP Server with Claude Desktop.

Claude Desktop: MCPB bundle (fastest)

Download the .mcpb asset from the latest release.
Open it in Claude Desktop and follow the guided setup.

That's it—the bundle includes nsmcp and configures it for you. There is no separate binary to install and no JSON to edit. It supports macOS (Apple silicon and Intel) and Windows x64.

One-click Platform install

Pick your client below — each button uses the client's native install link to prefill the nsmcp config, so you don't need to edit any JSON by hand.

Both buttons prefill a config with "command": "nsmcp", so nsmcp must already be on your PATH for it to launch (edit the command field to an absolute path otherwise). After installing, replace YOUR_TOKEN with a real token from https://app.nowsecure.com/account/tokens. The buttons configure Platform; for MARI, change the product value from platform to mari and name the entry nsmcp-mari.

Per-client setup

claude mcp add --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform

--scope controls where the entry is stored (defaults to local, i.e. ~/.claude.json keyed to this project directory):

claude mcp add --scope user  --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform   # global, all projects
claude mcp add --scope project --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform # .mcp.json, team-shared

Manage with claude mcp list / claude mcp get nsmcp-platform / claude mcp remove nsmcp-platform, or /mcp inside a session.

Download the .mcpb release asset and open it in Claude Desktop for a guided install. The single bundle supports macOS (arm64 and amd64) and Windows amd64; the installer asks for a product and stores your API token as a sensitive setting. Enter exactly platform to analyze mobile apps your organization develops and scans, or mari to evaluate the risk of vendor and other third-party mobile apps. No other product values are accepted.

For a manual installation, use Settings → Developer → Edit Config to open claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "/absolute/path/to/nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Restart Claude Desktop after editing.

Use the one-click button above, or edit ~/.cursor/mcp.json (global) or .cursor/mcp.json (project) by hand:

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

CLI:

code --add-mcp "{\"name\":\"nsmcp-platform\",\"command\":\"nsmcp\",\"args\":[\"serve\",\"--product\",\"platform\"],\"env\":{\"NOWSECURE_API_TOKEN\":\"YOUR_TOKEN\"}}"

Or .vscode/mcp.json, using VS Code's inputs prompt so the token isn't checked into the file:

{
  "servers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "${input:nsmcp_token}" }
    }
  },
  "inputs": [
    { "type": "promptString", "id": "nsmcp_token", "description": "NowSecure API Token", "password": true }
  ]
}

Command Palette → "Windsurf: Configure MCP Servers", or edit directly:

macOS/Linux: ~/.codeium/windsurf/mcp_config.json
Windows: %USERPROFILE%\.codeium\windsurf\mcp_config.json

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Windsurf config is global only (no per-project file).

gemini mcp add -e NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN nsmcp-platform nsmcp serve --product platform

Or ~/.gemini/settings.json (user) / .gemini/settings.json (project):

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

codex mcp add nsmcp-platform --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN -- nsmcp serve --product platform

Or ~/.codex/config.toml (note snake_case mcp_servers, unlike other clients):

[mcp_servers.nsmcp-platform]
command = "nsmcp"
args = ["serve", "--product", "platform"]
env = { NOWSECURE_API_TOKEN = "YOUR_TOKEN" }

Desktop app (Codex features) — local stdio, like other clients. The ChatGPT desktop app shares MCP configuration with Codex (~/.codex/config.toml), so the Codex CLI setup above also enables nsmcp here. Or add it in-app: Settings → MCP servers → Add server → STDIO, command nsmcp serve --product platform. This powers the app's Codex/agent features, not regular chat conversations. See docs for details.

settings.json (~/.config/zed/settings.json, or Command Palette → "zed: open settings") uses context_servers, not mcpServers:

{
  "context_servers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Supported products and tools

Each server process exposes exactly one product. Choose it explicitly with --product platform or --product mari; the flag is required. To use both products in one MCP client, configure two nsmcp server entries with different names and product values.

NowSecure Platform (`--product platform`)

Triage your own mobile app portfolio: scores, findings, fleet-wide impact, and remediation guidance.

The portfolio covers a rolling 12-month window: apps without a completed scan in the last 12 months are absent from list_apps and get_apps_affected_by_finding entirely. list_assessments is not windowed and still serves their older scan history.

Tool	Description
`list_apps`	List portfolio apps with their latest security score, rating, and open vulnerability count. The starting point for DevSecOps triage.
`list_assessments`	NowSecure Platform assessment history for one app, newest first, with score, rating, status, and finding counts by severity. Defaults to findings-capable Platform rows; select `store_monitor`, `external`, or `all` with `track` for other history.
`get_assessment_findings`	Findings for an assessment, sorted most-severe first, with supporting evidence and remediation guidance available when needed.
`get_finding`	Documentation for a single finding: description, steps to reproduce, testing method, and remediation guidance.
`search_findings`	Free-text search over the finding catalog (key, title, description, category) — returns finding keys when you only know a topic or risk.
`get_apps_affected_by_finding`	Fleet-wide impact: which portfolio apps' latest assessments are affected by a given finding.

NowSecure MARI (`--product mari`)

Vet vendor and third-party apps you didn't build, by risk score, letter rating, and findings.

Tool	Description
`list_mari_apps`	List third-party apps in your MARI catalog with risk score, letter rating (A–F), and risk category (LOW/MEDIUM/HIGH).
`get_mari_assessment`	Risk profile for one third-party app: score, rating, findings summary, and opt-in deep-dive sections (permissions, tracking domains, libraries/SDKs, AI usage, …).

Suggested prompts

Clients that support MCP prompts can show these workflow starters directly in their prompt picker. Each product mode advertises only its own prompts.

Platform prompts

Prompt	Purpose
`platform_triage_portfolio`	Prioritize the riskiest first-party apps and their remediation work.
`platform_review_app`	Review the latest scan and affected findings for an app title, package, ref, or URL.
`platform_investigate_finding`	Find fleet-wide impact and remediation guidance for a finding key, topic, or URL.

You can also ask your assistant in chat:

"Which high-severity findings affect my app?"
"Show me the evidence behind this finding."
"Use the scan evidence to help fix this finding in my source code."

Your assistant can retrieve scan observations and available code locations to explain a finding or guide a fix. Source changes and tests use the assistant's coding tools; a new scan is needed to verify the result.

MARI prompts

Prompt	Purpose
`mari_triage_catalog`	Prioritize third-party apps that need vendor-risk review.
`mari_review_app`	Review one third-party app's MARI risk profile.
`mari_compare_apps`	Compare two or more third-party apps and recommend the safer choice.

Security

Connecting an AI assistant to your NowSecure data creates powerful workflows but also structural risks. Any MCP client or server you enable (IDE plugins, desktop apps, other MCP servers running alongside nsmcp) can cause an AI agent to act on your behalf with your credentials.

Large language models are vulnerable to prompt injection and related attacks (indirect prompt injection, tool poisoning). Anything the model reads can carry instructions that steer the agent to exfiltrate data or take unintended actions you never asked for — and some of what nsmcp returns originates in third-party apps (titles, metadata, finding details), so treat it as untrusted content, not just results. nsmcp's tools are currently all read-only, which limits what an agent can change through this server — but review the tools your client actually lists rather than relying on this document: the tool set will evolve, and other NowSecure MCP servers may expose read-write tools. The vulnerability data nsmcp returns is sensitive regardless, and a compromised agent could leak it through other tools it has access to (file writes, web requests, messaging).

To reduce risk:

Only use trusted MCP clients, and review which other MCP servers and tools are enabled alongside nsmcp.
Apply least privilege: use short-lived, scoped tokens and revoke ones you no longer use at https://app.nowsecure.com/account/tokens.
Run only the product you need (--product platform or --product mari).
Require human confirmation for high-impact actions an agent takes in the same session it reads nsmcp data.

Quick start

Download a binary for your platform from the releases page, or build from source (see Build & run):
```
git clone [email protected]:nowsecure/nowsecure-mcp-server.git && cd nowsecure-mcp-server
make build   # -> ./nsmcp
```
Put ./nsmcp on your PATH, or use an absolute path in client configs below.

macOS: release binaries are unsigned; if Gatekeeper blocks a downloaded binary, clear the quarantine flag: xattr -d com.apple.quarantine ./nsmcp
Get credentials:
- Static token (works today): mint one at https://app.nowsecure.com/account/tokens and set NOWSECURE_API_TOKEN.
- nsmcp login (coming soon): OAuth device-code login — not usable until the dedicated Auth0 CLI client is provisioned; see Log in with your NowSecure account.
Choose a product: use --product platform for your own mobile app portfolio or --product mari for third-party app risk intelligence. Then configure your client from the list below.

Configuration

Env var	Purpose
`NOWSECURE_API_TOKEN`	API token (required unless you've run `nsmcp login`). Fallbacks: `NOWSECURE_API_KEY`, `NS_API_TOKEN`, `NSMCP_API_TOKEN`, `NSMCP_API_KEY`.
`NOWSECURE_API_URL`	Base URL override (default `https://api.nowsecure.com`). Must be `https`; plain `http` is allowed only for localhost.
`NOWSECURE_OAUTH_CLIENT_ID`	OAuth client ID used by `nsmcp login`. No default yet — see below.
`NOWSECURE_OAUTH_ISSUER`	OAuth issuer override for `nsmcp login` (default `https://id.nowsecure.com`). Only needed for non-production tenants, paired with `NOWSECURE_API_URL`.
`NOWSECURE_OAUTH_AUDIENCE`	OAuth audience override for `nsmcp login` (default `https://app.nowsecure.com`). Env-specific on non-production tenants.
`NSMCP_LOG_FILE`	Opt-in tool-call log path. When set, nsmcp opens it append-mode (`0600`) and writes one JSON line per tool call (tool name, `duration_ms`, error if any) plus one line at server start (version, transport, selected product) — never call arguments or results. Unset (the default): no logging, nothing written to stderr or stdout.

Mint a static token at https://app.nowsecure.com/account/tokens.

Flags (accepted before or after the subcommand): --token, --base-url, and the required --product value (platform or mari).

Log in with your NowSecure account (coming soon)

nsmcp login    # device-code OAuth flow
nsmcp whoami
nsmcp logout

nsmcp login opens a browser to a device-code confirmation page, then mints a scoped NowSecure platform API token named nsmcp/<hostname> and stores it in your OS keychain (falls back to a local file if no keychain is available). nsmcp serve --product platform (or --product mari) picks that token up automatically — no NOWSECURE_API_TOKEN needed. nsmcp logout revokes the stored token.

Login flags: --expiration-days (token lifetime, default 90, max 365), --token-name (default nsmcp/<hostname>), --client-id (else $NOWSECURE_OAUTH_CLIENT_ID), --no-browser (print the verification URL instead of opening a browser).

Caveat: this requires a dedicated Auth0 OAuth client for CLI login, which does not exist yet (it is being provisioned). Until it lands, nsmcp login cannot succeed for any client ID; once it does, set NOWSECURE_OAUTH_CLIENT_ID (a default will ship in a later release). The static token flow above works today with no extra setup.

nsmcp serve --product platform --http <addr> (or --product mari) runs a remote, OAuth-protected resource server instead of stdio (the MCP-spec OAuth 2.1 flow: clients discover the authorization server via /.well-known/oauth-protected-resource and drive the browser login themselves). It's a separate deployment mode, not needed for the local-client setups above.

Build & run

make build           # -> ./nsmcp
./nsmcp serve --product platform  # Platform MCP server over stdio
./nsmcp serve --product mari      # MARI MCP server over stdio
./nsmcp login             # OAuth device-code login (see above)
./nsmcp whoami
./nsmcp logout
./nsmcp version
./nsmcp profile apps     # call the REST API directly (endpoint verification)
./nsmcp completion zsh   # bash|zsh|fish|powershell

Build MCPB packages

Build the single installable bundle from a macOS development machine:

make mcpb VERSION=0.1.3
# -> dist/nsmcp.mcpb

The bundle asks for a product when installed. Enter exactly platform for mobile apps your organization develops and scans, or mari for vendor and other third-party mobile apps; no other values are accepted. It contains a universal macOS binary (arm64 + amd64) and a Windows amd64 binary, selected by the manifest's platform override. mcpb-checksums.txt is written alongside the bundle, and the bundle is attached to each GitHub release automatically.

go install isn't available yet — this module has no hosted module path, so download a prebuilt binary from the releases page or build from a clone (git clone + make build) as shown in Quick start. Homebrew is future work.

Development

make test    # go test ./...
make vet     # go vet ./...
make fmt     # gofmt -w .

For evidence retrieval details and the opt-in context consumption audit, see Evidence integration and testing.

License

This is proprietary software. Authorized NowSecure customers may download, build, and run unmodified copies solely for internal use with NowSecure services they are authorized to access, subject to their applicable agreement with NowSecure. See the NowSecure Customer Use License.

Nowsecure

nowsecure1stars

A local Model Context Protocol (MCP) server for NowSecure.

Mobile Development Devops

Install Run on PlugMCP

GitHub Website

Run on PlugMCP

1# Nowsecure

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: NOASSERTION
Last checked: 2026-10-28

Stars: 1
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Nowsecure?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Nowsecure need an API key?

No required environment variable is listed on this record.

What transport does Nowsecure use?

Nowsecure runs locally over stdio.

When was Nowsecure last checked?

Last checked 2026-10-28. A local Model Context Protocol (MCP) server for NowSecure.

From the publisher

Documentation

NowSecure MCP (beta)

Install

For step-by-step setup guidance, see the NowSecure Support article Install and use the NowSecure MCP Server with Claude Desktop.

Claude Desktop: MCPB bundle (fastest)

Download the .mcpb asset from the latest release.
Open it in Claude Desktop and follow the guided setup.

That's it—the bundle includes nsmcp and configures it for you. There is no separate binary to install and no JSON to edit. It supports macOS (Apple silicon and Intel) and Windows x64.

One-click Platform install

Pick your client below — each button uses the client's native install link to prefill the nsmcp config, so you don't need to edit any JSON by hand.

Per-client setup

claude mcp add --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform

--scope controls where the entry is stored (defaults to local, i.e. ~/.claude.json keyed to this project directory):

claude mcp add --scope user  --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform   # global, all projects
claude mcp add --scope project --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN --transport stdio nsmcp-platform -- nsmcp serve --product platform # .mcp.json, team-shared

Manage with claude mcp list / claude mcp get nsmcp-platform / claude mcp remove nsmcp-platform, or /mcp inside a session.

For a manual installation, use Settings → Developer → Edit Config to open claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "/absolute/path/to/nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Restart Claude Desktop after editing.

Use the one-click button above, or edit ~/.cursor/mcp.json (global) or .cursor/mcp.json (project) by hand:

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

CLI:

code --add-mcp "{\"name\":\"nsmcp-platform\",\"command\":\"nsmcp\",\"args\":[\"serve\",\"--product\",\"platform\"],\"env\":{\"NOWSECURE_API_TOKEN\":\"YOUR_TOKEN\"}}"

Or .vscode/mcp.json, using VS Code's inputs prompt so the token isn't checked into the file:

{
  "servers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "${input:nsmcp_token}" }
    }
  },
  "inputs": [
    { "type": "promptString", "id": "nsmcp_token", "description": "NowSecure API Token", "password": true }
  ]
}

Command Palette → "Windsurf: Configure MCP Servers", or edit directly:

macOS/Linux: ~/.codeium/windsurf/mcp_config.json
Windows: %USERPROFILE%\.codeium\windsurf\mcp_config.json

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Windsurf config is global only (no per-project file).

gemini mcp add -e NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN nsmcp-platform nsmcp serve --product platform

Or ~/.gemini/settings.json (user) / .gemini/settings.json (project):

{
  "mcpServers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

codex mcp add nsmcp-platform --env NOWSECURE_API_TOKEN=$NOWSECURE_API_TOKEN -- nsmcp serve --product platform

Or ~/.codex/config.toml (note snake_case mcp_servers, unlike other clients):

[mcp_servers.nsmcp-platform]
command = "nsmcp"
args = ["serve", "--product", "platform"]
env = { NOWSECURE_API_TOKEN = "YOUR_TOKEN" }

settings.json (~/.config/zed/settings.json, or Command Palette → "zed: open settings") uses context_servers, not mcpServers:

{
  "context_servers": {
    "nsmcp-platform": {
      "command": "nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": { "NOWSECURE_API_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Supported products and tools

NowSecure Platform (`--product platform`)

Triage your own mobile app portfolio: scores, findings, fleet-wide impact, and remediation guidance.

Tool	Description
`list_apps`	List portfolio apps with their latest security score, rating, and open vulnerability count. The starting point for DevSecOps triage.
`list_assessments`	NowSecure Platform assessment history for one app, newest first, with score, rating, status, and finding counts by severity. Defaults to findings-capable Platform rows; select `store_monitor`, `external`, or `all` with `track` for other history.
`get_assessment_findings`	Findings for an assessment, sorted most-severe first, with supporting evidence and remediation guidance available when needed.
`get_finding`	Documentation for a single finding: description, steps to reproduce, testing method, and remediation guidance.
`search_findings`	Free-text search over the finding catalog (key, title, description, category) — returns finding keys when you only know a topic or risk.
`get_apps_affected_by_finding`	Fleet-wide impact: which portfolio apps' latest assessments are affected by a given finding.

NowSecure MARI (`--product mari`)

Vet vendor and third-party apps you didn't build, by risk score, letter rating, and findings.

Tool	Description
`list_mari_apps`	List third-party apps in your MARI catalog with risk score, letter rating (A–F), and risk category (LOW/MEDIUM/HIGH).
`get_mari_assessment`	Risk profile for one third-party app: score, rating, findings summary, and opt-in deep-dive sections (permissions, tracking domains, libraries/SDKs, AI usage, …).

Suggested prompts

Clients that support MCP prompts can show these workflow starters directly in their prompt picker. Each product mode advertises only its own prompts.

Platform prompts

Prompt	Purpose
`platform_triage_portfolio`	Prioritize the riskiest first-party apps and their remediation work.
`platform_review_app`	Review the latest scan and affected findings for an app title, package, ref, or URL.
`platform_investigate_finding`	Find fleet-wide impact and remediation guidance for a finding key, topic, or URL.

You can also ask your assistant in chat:

"Which high-severity findings affect my app?"
"Show me the evidence behind this finding."
"Use the scan evidence to help fix this finding in my source code."

MARI prompts

Prompt	Purpose
`mari_triage_catalog`	Prioritize third-party apps that need vendor-risk review.
`mari_review_app`	Review one third-party app's MARI risk profile.
`mari_compare_apps`	Compare two or more third-party apps and recommend the safer choice.

Security

To reduce risk:

Only use trusted MCP clients, and review which other MCP servers and tools are enabled alongside nsmcp.
Apply least privilege: use short-lived, scoped tokens and revoke ones you no longer use at https://app.nowsecure.com/account/tokens.
Run only the product you need (--product platform or --product mari).
Require human confirmation for high-impact actions an agent takes in the same session it reads nsmcp data.

Quick start

Download a binary for your platform from the releases page, or build from source (see Build & run):
```
git clone [email protected]:nowsecure/nowsecure-mcp-server.git && cd nowsecure-mcp-server
make build   # -> ./nsmcp
```
Put ./nsmcp on your PATH, or use an absolute path in client configs below.

macOS: release binaries are unsigned; if Gatekeeper blocks a downloaded binary, clear the quarantine flag: xattr -d com.apple.quarantine ./nsmcp
Get credentials:
- Static token (works today): mint one at https://app.nowsecure.com/account/tokens and set NOWSECURE_API_TOKEN.
- nsmcp login (coming soon): OAuth device-code login — not usable until the dedicated Auth0 CLI client is provisioned; see Log in with your NowSecure account.
Choose a product: use --product platform for your own mobile app portfolio or --product mari for third-party app risk intelligence. Then configure your client from the list below.

Configuration

Env var	Purpose
`NOWSECURE_API_TOKEN`	API token (required unless you've run `nsmcp login`). Fallbacks: `NOWSECURE_API_KEY`, `NS_API_TOKEN`, `NSMCP_API_TOKEN`, `NSMCP_API_KEY`.
`NOWSECURE_API_URL`	Base URL override (default `https://api.nowsecure.com`). Must be `https`; plain `http` is allowed only for localhost.
`NOWSECURE_OAUTH_CLIENT_ID`	OAuth client ID used by `nsmcp login`. No default yet — see below.
`NOWSECURE_OAUTH_ISSUER`	OAuth issuer override for `nsmcp login` (default `https://id.nowsecure.com`). Only needed for non-production tenants, paired with `NOWSECURE_API_URL`.
`NOWSECURE_OAUTH_AUDIENCE`	OAuth audience override for `nsmcp login` (default `https://app.nowsecure.com`). Env-specific on non-production tenants.
`NSMCP_LOG_FILE`	Opt-in tool-call log path. When set, nsmcp opens it append-mode (`0600`) and writes one JSON line per tool call (tool name, `duration_ms`, error if any) plus one line at server start (version, transport, selected product) — never call arguments or results. Unset (the default): no logging, nothing written to stderr or stdout.

Mint a static token at https://app.nowsecure.com/account/tokens.

Flags (accepted before or after the subcommand): --token, --base-url, and the required --product value (platform or mari).

Log in with your NowSecure account (coming soon)

nsmcp login    # device-code OAuth flow
nsmcp whoami
nsmcp logout

Build & run

make build           # -> ./nsmcp
./nsmcp serve --product platform  # Platform MCP server over stdio
./nsmcp serve --product mari      # MARI MCP server over stdio
./nsmcp login             # OAuth device-code login (see above)
./nsmcp whoami
./nsmcp logout
./nsmcp version
./nsmcp profile apps     # call the REST API directly (endpoint verification)
./nsmcp completion zsh   # bash|zsh|fish|powershell

Build MCPB packages

Build the single installable bundle from a macOS development machine:

make mcpb VERSION=0.1.3
# -> dist/nsmcp.mcpb

Development

make test    # go test ./...
make vet     # go vet ./...
make fmt     # gofmt -w .

For evidence retrieval details and the opt-in context consumption audit, see Evidence integration and testing.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Nowsecure?

Does Nowsecure need an API key?

What transport does Nowsecure use?

When was Nowsecure last checked?

Documentation

NowSecure MCP (beta)

Install

Claude Desktop: MCPB bundle (fastest)

One-click Platform install

Per-client setup

Supported products and tools

NowSecure Platform (--product platform)

NowSecure MARI (--product mari)

Suggested prompts

Platform prompts

MARI prompts

Security

Quick start

Configuration

Log in with your NowSecure account (coming soon)

Build & run

Build MCPB packages

Development

License

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Nowsecure?

Does Nowsecure need an API key?

What transport does Nowsecure use?

When was Nowsecure last checked?

Documentation

NowSecure MCP (beta)

Install

Claude Desktop: MCPB bundle (fastest)

One-click Platform install

Per-client setup

Supported products and tools

NowSecure Platform (--product platform)

NowSecure MARI (--product mari)

Suggested prompts

Platform prompts

MARI prompts

Security

Quick start

Configuration

Log in with your NowSecure account (coming soon)

Build & run

Build MCPB packages

Development

License

NowSecure Platform (`--product platform`)

NowSecure MARI (`--product mari`)

NowSecure Platform (`--product platform`)

NowSecure MARI (`--product mari`)