NowSecure MCP Server is a small Model Context Protocol (MCP) server designed specifically for the NowSecure Platform. Its core purpose is to bypass the broken PDF export functionality in the platform's interface. This breakage manifests as an error when exporting reports: Failed to load report data: Enum "JiraIntegrationCustomFieldType" cannot represent value: "". This tool pulls remediation findings via the REST and GraphQL APIs and, when needed, renders remediation PDFs locally instead of relying on NowSecure's reporting service.
Main capabilities include: listing applications (list_applications) to obtain application references; pulling remediation findings; generating PDF reports. Users can first list applications, find the application reference, and then ask the agent to generate a remediation PDF for the specified application, and can specify an assessment reference; if the assessment reference is omitted, the application's latest assessment is used.
Usage: Requires Node.js >= 18 (the only prerequisite; npx will fetch and run the latest version on demand, with no need to clone or manually install). For authentication, each user uses their own token: in the NowSecure Platform, click the profile icon in the upper right corner > Tokens to create a personal access token (PAT), and place it in the local MCP configuration. The environment variable NOWSECURE_TOKEN (required) is the personal PAT; NOWSECURE_API_BASE (optional) defaults to https://api.nowsecure.com。没有任何令牌随包捆绑。
Configuration examples cover a variety of MCP clients: a generic MCP client configuration can be done via the CLI (recommended, as it validates and writes to the correct file) or by directly editing .mcp.json (project) / ~/.claude.json (user); Cursor edits ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project); Google Antigravity opens MCP Servers → Manage / Raw Config in the agent panel/settings to edit mcp_config.json; GitHub Copilot (VS Code) uses the top-level servers key (not mcpServers), adding it to the workspace's .vscode/mcp.json or the user mcp.json (Command Palette → MCP: Open User Configuration); Kiro adds it to ~/.kiro/settings/mcp.json (global) or .kiro/settings/mcp.json (workspace). If publishing to a private/scoped registry, use a scoped name, for example "args": ["-y", "@your-scope/nowsecure-mcp-server"]. All examples run the package via npx, and you need to replace it with your own personal PAT. Adding --scope user makes it available in all projects.
Use cases: users who need to retrieve application lists and remediation findings from the NowSecure Platform and generate PDF reports, especially in scenarios where they are stuck due to the broken PDF export in the platform interface.
Limitations: Requires Node.js >= 18; requires users to provide their own NowSecure Platform API token; PDF reports are generated locally; the documentation does not provide detailed explanations of other features, fees, pricing, or platform compatibility.
