Netskope MCP

What johnneerdael/netskope-mcp MCP server does

The johnneerdael/netskope-mcp MCP server provides an agent-facing interface for managing Netskope Private Access infrastructure. Its tool set covers 84 operations grouped into ten areas: publishers, private applications, local brokers, policy management, SCIM integration, upgrade profiles, steering, alerts, search, and validation.

The available capabilities support both resource administration and operational workflows. For example, an agent can locate publishers, create or configure private apps, associate applications with publishers, manage access policies, inspect alerts, resolve SCIM group references, and check configuration compliance. The documentation also describes workflows for deploying NPA infrastructure, responding to access incidents, and auditing an environment.

How it works

The server communicates with a Netskope tenant through the Netskope API. A tenant base URL and API token are supplied as environment variables for local execution, or as request headers when using the HTTP deployment. The MCP client then invokes individual tools using their validated parameters.

Tools use Zod schemas to validate inputs and transform parameters for the expected API operations. The project describes automatic parameter extraction, retry handling with exponential backoff, rate and quota management, detailed error context, and graceful handling of partial failures. Tools can be composed into multi-step workflows; a private application workflow, for instance, can validate a name, locate a publisher, create the app, add tags, and update publisher associations.

Setup and configuration

For a local Node setup, the documented sequence is to install dependencies, build the project, and start it:

npm install
npm run build
npm start

The quick-start configuration uses NETSKOPE_BASE_URL for the tenant address and NETSKOPE_TOKEN for the API token. The repository also documents NETSKOPE_API_TOKEN as an optional fallback variable for its self-hosted HTTP mode. In that mode, clients can provide X-Netskope-Tenant and Authorization headers per request instead, which supports multi-tenant deployments.

Self-hosting options include the supplied Docker Compose files, a prebuilt GHCR image, or a locally built image. The HTTP service exposes /mcp for streamable MCP traffic and /healthz for liveness checks. PORT and HOST control binding; PUBLIC_URL describes the public origin, and CORS_ORIGIN configures browser-client origins.

Tools and capabilities

The johnneerdael/netskope-mcp MCP server organizes tools into these documented areas:

• Publishers: deployment and publisher administration
• Private apps: application lifecycle and configuration
• Local brokers: connectivity and routing management
• Policies: access-control rules
• SCIM: identity and user management
• Upgrade profiles: maintenance scheduling
• Steering: traffic routing and associations
• Alerts: event monitoring and notifications
• Search: resource discovery and querying
• Validation: configuration and compliance checks

The documentation includes separate references for publisher, private-app, and policy tools, along with workflow and real-world example guides.

Limitations and notes

The server requires access to a Netskope Private Access environment and an API token. The material does not state that it supports every Netskope product outside NPA. The HTTP deployment can accept fallback credentials, but the documented recommendation for shared self-hosting is to leave those fallback variables unset and provide tenant credentials through client headers.

The repository documents client configuration for Claude Desktop and generic JSON clients including Cursor and Windsurf. Its local example uses a built JavaScript entry point, while the self-hosted deployment uses HTTP; choose the transport and credential arrangement that matches the MCP client and deployment model.

The supplied material does not identify a software license or a hosted public endpoint, so those details should be confirmed in the repository before distribution or production deployment.