Netskope NPA MCP Server

What is Netskope NPA MCP Server?

A comprehensive Model Context Protocol (MCP) server for managing Netskope Private Access (NPA) infrastructure through AI-powered automation. It provides 84 specialized tools across 10 categories for tasks such as publisher management, private app lifecycle, policy management, SCIM integration, and compliance auditing.

How to use Netskope NPA MCP Server?

Set environment variables (NETSKOPE_BASE_URL, NETSKOPE_API_TOKEN), then install and run via npm (npm install, npm run build, npm start) or Docker. Connect your MCP client using a JSON config that points to the server’s command or URL, optionally passing credentials as headers.

Key features of Netskope NPA MCP Server

• AI-native design with parameter validation and rich error context
• Workflow orchestration with built-in retry and error recovery
• Schema-driven input validation using Zod
• Rate limiting and API quota management
• SCIM integration for identity resolution
• Streamable HTTP transport with liveness endpoint

Use cases of Netskope NPA MCP Server

• Set up complete NPA infrastructure for a new office (publishers, brokers, apps, policies)
• Emergency lockdown of sensitive applications during a security incident
• Perform a comprehensive compliance audit of the entire NPA environment
• Automate identity and access management via SCIM integration
• Schedule and manage upgrade profiles across publishers

FAQ from Netskope NPA MCP Server

What runtime is required?

The server runs on Node.js. Install dependencies with npm install, then build and start with npm run build and npm start.

How do I authenticate?

Supply NETSKOPE_BASE_URL and NETSKOPE_API_TOKEN as environment variables, or pass the token via an Authorization header and tenant URL via X-Netskope-Tenant header in the MCP client configuration.

What transport does it use?

It exposes a streamable HTTP endpoint at /mcp and a liveness endpoint at /healthz. A generic JSON client config can target a URL like https://YOUR-MCP-HOST.example.com/mcp.

Is there rate limiting or error handling?

Yes. The server includes built-in rate limiting, API quota management, retry logic with exponential backoff, and graceful degradation for partial failures.

Can I run it in Docker?

Yes. Two Docker Compose files are provided: one for the prebuilt multi-arch image from GHCR, and one for building locally. You can also run a standalone container with docker run using the image ghcr.io/johnneerdael/privateaccess-mcp:latest.