Netskope NPA

This MCP server provides AI-assisted automation to manage Netskope Private Access infrastructure. It enables you to deploy, configure, monitor, and enforce access policies through a set of coordinated tools, making NPA management faster, repeatable, and auditable.

How to use

You use the NetSkope NPA MCP server by running the local MCP instance and connecting a client that can drive actions through the MCP interface. Start by launching the local server, then point your MCP client at the appropriate runtime command so that your client can execute the designed workflows for publishers, private apps, local brokers, and policy management.

How to install

Prerequisites: you need Node.js and npm installed on your system.

# Environment setup for your tenant
export NETSKOPE_BASE_URL="https://your-tenant.goskope.com"
export NETSKOPE_TOKEN="your-api-token"

# Install dependencies, build, and start the MCP server
npm install
npm run build
npm start

Connect with the MCP client

To connect your MCP client, run the stdio-based command as shown. This starts the local MCP server process and exposes it to the client via a runtime script.

{
  "mcpServers": {
    "netskope_npa": {
      "command": "node",
      "args": ["/path/to/ns-private-access-mcp/build/index.js"],
      "env": {
        "NETSKOPE_BASE_URL": "https://your-tenant.goskope.com",
        "NETSKOPE_TOKEN": "your-api-token"
      }
    }
  }
}

Real-world usage patterns

Use cases include setting up a complete NPA infrastructure for a new office, responding to security incidents with emergency workflows, and performing comprehensive compliance audits. By combining tools for publishers, private apps, local brokers, policy management, and SCIM integration, you can automate end-to-end workflows with built-in retries, validation, and error handling.

Notes and best practices

• The server uses type-safe, schema-driven validation to prevent misconfigurations. - All actions are designed to be orchestrated as part of transactional workflows where possible. - Ensure environment variables are kept secure and rotatable, especially API tokens and base URLs.

Troubleshooting

If you encounter validation errors, check the input parameters against the Zod schemas used by the tools, review retry and backoff behavior in workflows, and verify that the environment variables are correctly set for the running MCP process.

Security considerations

Limit access to the MCP client and the local MCP process. Use rotated API tokens, enforce least privilege for publishers and policies, and monitor for anomalous changes in policy and app configurations.

Available tools

validateName

Check app name compliance before creating or updating a private app to ensure naming conventions are met.

searchPublishers

Find the target publisher to associate with a new or existing private app.

createPrivateApp

Create a new private application within a publisher with foundational configuration.

createPrivateAppTags

Add organizational tags to a private app for better management and discovery.

updatePublisherAssociation

Associate or re-associate a private app with one or more publishers.

scimIntegration

Resolve identities via SCIM to enable group-based access control and provisioning.

searchResources

Discover resources, services, and configurations across the NPA environment.

validatePolicy

Validate access policies for correctness and policy-compliance before deployment.

upgradeProfileScheduler

Automate maintenance and upgrade scheduling for publisher resources.

emergencyPolicyCreator

Create and apply high-priority emergency policies during incidents.

monitorAndDiscover

Enable monitoring and discovery workflows to track resource state and changes.

generateRegistrationToken

Generate tokens for field deployment and device registration.

auditPublishers

Audit publisher configurations for version and policy compliance.

complianceAudit

Perform comprehensive compliance checks across the NPA environment.