Purpose
Netskope NPA MCP Server is a server based on the Model Context Protocol (MCP), used to manage Netskope Private Access (NPA) infrastructure through AI-driven automation. It turns complex NPA management operations into simple AI conversations.
Main Capabilities
This MCP server provides 84 specialized tools, divided into 10 categories, supporting the following typical scenarios:
- Infrastructure Deployment: Can execute complete deployment workflows based on natural language instructions, including creating publishers and configuring auto-update profiles, configuring local brokers for internal routing, setting up core business applications (such as CRM, ERP, file servers), creating access policies with SCIM group validation, enabling monitoring and discovery for office networks, and generating registration tokens for on-site deployment.
- Emergency Security Response: Can automatically identify all HR/Finance applications, create the highest-priority emergency policy group, block access for all users except the incident response team, enhance security incident monitoring, and tag applications with incident tracking labels.
- Compliance Audit: Can conduct version compliance audits for all publishers, identify applications without access policies, validate SCIM group references in policies, generate compliance scores and remediation plans, and create detailed findings reports with priorities.
In addition, the server has the following design features:
- AI-Native Design: Tools are designed for LLM interaction, with clear descriptions, support for automatic parameter validation and conversion, and rich error context for troubleshooting.
- Workflow Orchestration: Tools can automatically coordinate with each other, with built-in retry logic and error recovery, using transactional operations whenever possible.
- Production-Ready: Uses Zod schema for comprehensive input validation, supports rate limiting and API quota management, and provides detailed logging and monitoring.
- Integration Modes: Supports SCIM integration for identity resolution, provides search tools for resource discovery and validation tools for compliance checks.
Usage
Environment Setup
The following environment variables need to be set:
export NETSKOPE_BASE_URL="https://your-tenant.goskope.com" export NETSKOPE_TOKEN="your-api-token"
Installation and Running
npm install npm run build npm start
Connecting via MCP Client
The following JSON configuration can be used:
{ "mcpServers": { "netskope-npa": { "command": "node", "args": ["/path/to/privateaccess-mcp/build/index.js"], "env": { "NETSKOPE_BASE_URL": "https://your-tenant.goskope.com", "NETSKOPE_TOKEN": "your-api-token" } } } }
This configuration is suitable for clients that accept JSON mappings (such as Cursor, Windsurf, or custom hosts).
Installation Options
Supports local development and containerized deployment. The project includes two compose files, and also provides a one-line command that does not use compose. The container exposes the /mcp (streamable HTTP) and /healthz (liveness check) endpoints.
Architecture Highlights
- Tool Composition: Tools work together through clearly defined interfaces.
- Schema-Driven Validation: Each tool uses Zod schema for type safety and validation.
- Error Resilience: Built-in patterns for handling common issues, including automatic parameter extraction from MCP objects, retry logic with exponential backoff, and graceful degradation for partial failures.
Applicable Scenarios
Suitable for teams that need to manage Netskope Private Access infrastructure, especially organizations that want to complete tasks such as deployment, security response, and compliance auditing through AI automation.
Limitations
Information regarding pricing, charging models, supported platform scope, and other details not explicitly stated in the materials is not currently provided.
