Introduction

Before you begin

Install the MCPB package in Claude Desktop

Install the CLI binary for other MCP clients

Install and use the NowSecure MCP Server in VS Code

Example prompts and use cases

Security, access, and beta support FAQ

Troubleshooting

Security recommendations
 

Introduction

The NowSecure MCP Server (BETA) connects compatible AI assistants to the mobile application security data that you are authorized to access in NowSecure Platform or NowSecure Mobile App Risk Intelligence (MARI). The MCP Server currently provides read-only tools for: 

• NowSecure Platform: Triage your organization’s mobile app portfolio, assessments, findings, and remediation work.
• NowSecure MARI: Evaluate vendor and third-party mobile apps using Mobile App Risk Intelligence.

Each configured MCP Server exposes one product. Select platform for your organization’s app portfolio or mari for third-party app risk intelligence.

Important: Treat your NowSecure API token like a password. Do not paste it into an AI conversation, source code, or a shared configuration file.

Before you begin

You need:

• Access to NowSecure Platform, NowSecure MARI, or both.
• A NowSecure API token. Create one at https://app.nowsecure.com/admin/tokens
• A supported MCP client.
• For the recommended installation, a current version of Claude Desktop.

Download the MCP Server only from the official sources: 

• NowSecure MCP Server repository
• NowSecure MCP Server releases

Recommended: Install the MCPB package in Claude Desktop

The MCPB package is the easiest way to install the NowSecure MCP Server in Claude Desktop. It includes the nsmcp executable and guides you through configuration, so you do not need to install a separate binary or edit a JSON file.

The MCPB package supports macOS on Apple silicon or Intel and Windows x64.

Step 1: Download the package

1. Go to the NowSecure MCP Server releases page.
2. Open the latest release.
3. Expand Assets if necessary.
4. Download the file named nsmcp_<version>.mcpb
5. Open the downloaded file with Claude Desktop.

Step 2: Install the extension

Review the NowSecure extension information and select Install.

Claude Desktop may display a general warning about the access granted to locally installed extensions. The current NowSecure MCP Server exposes read-only NowSecure tools, but you should install it only from the official NowSecure GitHub repository.

Step 3: Configure the NowSecure product and API token

Enter the following values:

• NowSecure product: Enter one of these lowercase values:
  • platform — Analyze your organization’s mobile app portfolio, assessments, and findings.
  • mari— Review vendor and third-party mobile apps using NowSecure MARI.
• NowSecure API token: Paste the token created in NowSecure. Tokens can be created at https://app.nowsecure.com/admin/tokens 

Select Save.

The token is stored as a sensitive extension setting. Do not enter the token into a Claude prompt.

Step 4: Enable the extension

After installation, confirm that the Enabled switch is on.

Use Configure if you need to replace the API token or switch between Platform and MARI.

The MCPB installation exposes one product at a time. To use Platform and MARI concurrently, configure two named MCP Server entries using the CLI or manual configuration described below.

Step 5: Optional—allow read-only tools without individual approvals

By default, Claude may request approval before invoking a tool. Because the current NowSecure tools are read-only, you can optionally allow them without individual approval prompts:

1. Open Claude Desktop Settings.
2. Select Connectors.
3. Open the NowSecure connector.
4. Find Tool permissions
5. Set the read-only tools to Always allow.
6. Save the change.

Allowing the NowSecure tools does not control other tools available to the AI assistant. Review the complete set of enabled connectors and tools before working with sensitive vulnerability data.

Install the CLI binary for other MCP clients

Use the standalone CLI when:

• Your MCP client does not support MCPB packages
• You are using Claude Code, Cursor, VS Code, Codex CLI, Gemini CLI, Windsurf, Zed, or another local MCP client.
• You need Platform and MARI available concurrently.
• You are installing on Linux.

Install and use the NowSecure MCP Server in VS Code

Connect the NowSecure MCP Server to VS Code to review mobile app assessments and findings while working on your code. Use platform for your organization’s apps or mari for third-party app risk intelligence.

Step 1: Install the standalone executable

1. Open the NowSecure MCP Server releases page and choose a release.
2. Under Assets, download the standalone archive for your operating system and processor. Choose darwin for macOS, windows for Windows, or linux for Linux; arm64 for Apple silicon or other ARM64 systems, or amd64 for Intel/AMD x64 systems. The .mcpb package is for Claude Desktop.
3. Extract the archive and keep nsmcp (Windows: nsmcp.exe) in a permanent folder.
4. In a terminal, run the executable with version to confirm it starts. For example, on macOS or Linux, run /absolute/path/to/nsmcp version. In Windows PowerShell, run & "C:\Tools\NowSecure\nsmcp.exe" version. Replace the example path with your installation path.

Have your NowSecure API token ready. Your account must have access to the selected product and the apps you want to review.

Step 2: Configure VS Code

Enable VS Code’s AI features and open a project folder. The configuration below uses VS Code’s Local agent session and prompts for your token. If your version offers a session or harness selector, choose Local. For Copilot sessions, use the alternative below: interactive token inputs are not forwarded to those sessions. See Microsoft’s MCP setup guide.

Create .vscode/mcp.json in your project with this content. If the file already exists, merge the server and input entries into it.

{
  "servers": {
    "nsmcp-platform": {
      "type": "stdio",
      "command": "/absolute/path/to/nsmcp",
      "args": ["serve", "--product", "platform"],
      "env": {
        "NOWSECURE_API_TOKEN": "${input:nowsecureToken}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "nowsecureToken",
      "description": "NowSecure API token",
      "password": true
    }
  ]
}

Replace command with the executable’s full path. A Windows JSON example is "command": "C:\\Tools\\NowSecure\\nsmcp.exe". If the executable is on the PATH available to VS Code, you can use nsmcp or nsmcp.exe.

Keep ${input:nowsecureToken} as written. Enter the token only when VS Code prompts; it securely stores the input for reuse. For configuration across projects, run MCP: Open User Configuration and add the same entries there. See the VS Code configuration reference.

For MARI, change the server name to nsmcp-mari and the final argument to mari. To use both products, add a second server entry with those changes. Each entry exposes one product; both may reference the same token input if that token has access to both products.

Alternative: Copilot sessions

Provide NOWSECURE_API_TOKEN through your approved secret-management process in the environment that launches the server. Setting it in an unrelated terminal does not update an already-running VS Code process. Do not put the token in chat or commit it to a configuration file.

Run MCP: Add Server from the Command Palette, choose Command (stdio), and enter the executable’s full path followed by serve --product platform. Quote the path if it contains spaces. Name the server nsmcp-platform and select Global > Copilot Global. This configuration uses the inherited token environment variable instead of an interactive input. See configuration destinations and authentication guidance.

Step 3: Start the server and verify a tool call

1. For the Local configuration, open the Command Palette (Cmd+Shift+P on macOS; Ctrl+Shift+P on Windows/Linux), run MCP: List Servers, select nsmcp-platform, and start it. Review any trust prompt and supply your token when requested.
2. Open an agent chat. Enable the NowSecure tools in Configure Tools for Local sessions, or Chat: Open Customizations > Tools for Copilot sessions.
3. Enter this prompt and review any tool approval request:

Use the NowSecure Platform MCP tools to list up to five apps I can access. Include each app’s name and security score when available.

Expand the tool call and confirm that a NowSecure tool returned data without an authentication or connection error. An empty result can indicate that no apps match your account’s access or the portfolio window. For MARI, try: Use the NowSecure MARI MCP tools to search for CamScanner and show the matching apps.

The NowSecure MCP tools are read-only. VS Code may also have file-editing and terminal tools; review those separately before asking the agent to implement a fix.

Troubleshooting VS Code

• Executable not found: Check the full path and Windows JSON escaping. Confirm that the same executable runs with version. Restart VS Code after changing PATH.
• Server starts but tools are missing: Confirm that the tools are enabled and that your session supports the selected configuration. Use the Copilot alternative above if interactive inputs prevent the server from appearing.
• Authentication or access errors: Check token expiration, product entitlement, and app/group permissions. For Copilot sessions, confirm that the server receives NOWSECURE_API_TOKEN.
• Remote SSH, WSL, or Dev Containers: Install the executable and provide credentials in the environment where the server runs. A path on your local computer may not exist there.
• Startup failure: Use MCP: List Servers to select the server and view its output. Follow your organization’s software approval process if the operating system blocks the executable.

For client-specific issues, see Microsoft’s MCP troubleshooting guide.

Example prompts and use cases

Triage the riskiest apps in your portfolio

Best used with the Platform (--product platform) configuration.

Show me the riskiest apps in our portfolio. For the app with the lowest security score, pull its medium-and-higher findings and tell me what we should fix first.

NowSecure Platform security scores range from 0–100, where a higher score is better. Finding lists are compact by default and omit lengthy recommendation text. The assistant retrieves complete remediation guidance only for the findings selected for deeper review.

Determine whether apps are affected by uses_http

Best used with the Platform configuration (--product platform).

We are reviewing the uses_http finding. Are any apps in our portfolio affected, which apps should we prioritize, and what should we tell their development teams?

Draft a remediation ticket

Best used with the Platform (--product platform) configuration.

For [app name or NowSecure URL], review the latest assessment and draft a remediation ticket for its highest-priority critical finding. Include a concise title, risk and impact, affected app and

assessment, technical details, recommended remediation, acceptance criteria, and the relevant NowSecure references.

The NowSecure MCP Server is read-only. It can prepare ticket content in the conversation, but it does not create or update a ticket unless a separately authorized ticketing tool is available or connected to your AI Agent.

Evaluate a third-party app request

Best used with the MARI (--product mari) configuration.

An employee wants to use CamScanner on a corporate phone. Find the correct app in NowSecure MARI, assess its risk, identify the most important findings and privacy signals, and give me a go/no-go recommendation with any conditions or mitigations.

The assistant can selectively inspect relevant permissions, tracking domains, network connections, libraries and SDKs, or AI-usage data instead of retrieving every available detail. Unlike Platform security scores, a NowSecure MARI risk score ranges from 0–100, where a higher risk score is worse.

Security, access, and beta support FAQ

Do you publish a checksum or signature for the MCPB package? Are macOS binaries signed?

NowSecure MCP Server releases include a SHA-256 checksum file named mcpb-checksums.txt alongside the MCPB package. Download the package and checksum file from the same official release. To verify the package on macOS, run the following command from the directory containing both files:

shasum -a 256 -c mcpb-checksums.txt

A checksum verifies file integrity but does not provide publisher identity verification. Check the selected release’s notes and assets for its signing and notarization status. An ad-hoc macOS signature does not establish Apple Developer ID signing or notarization.

To pin an installation, download a specific version and manage upgrades through your organization’s software approval process.

Is each API token associated with a user, and can access be read-only?

API tokens are associated with the NowSecure account that creates them. Use a separate token for each user or integration, and restrict access to the applications and groups needed.

The NowSecure MCP Server currently exposes read-only tools. This does not automatically make the underlying API token read-only when used outside the MCP Server. Work with your Platform administrator to configure the account’s permissions and confirm any token-level restrictions required by your organization.

How long do tokens last, and how can they be revoked?

New Platform API tokens default to a 365-day expiration unless adjusted by an administrator. Users can select an expiration of up to 365 days, subject to organization-level restrictions. Older tokens may have no expiration and should be reviewed.

Users can revoke their tokens through token management, and administrators can enforce expiration or revocation. See Creating a NowSecure Platform API Bearer Token.

Contact NowSecure Support if your deployment requires a guaranteed revocation propagation time. Revocation does not remove information already retrieved into an AI conversation or saved elsewhere.

How much notice will we receive before tools or permissions change?

Review the release notes and the tools exposed by your MCP client before upgrading. Pinning a version controls the installed MCP Server package; it does not freeze the underlying NowSecure APIs or your account’s permissions.

For a required advance-notice period or compatibility commitment during beta, contact your NowSecure account team to confirm the applicable terms.

Can finding details contain embedded secrets or personal data from our apps?

Yes. Finding details and supporting evidence can contain sensitive information observed during an assessment, potentially including embedded credentials, tokens, personal data, URLs, or application content. Do not assume that all sensitive values have been removed.

Information returned through MCP becomes available to your AI client and may be processed by its model provider, depending on your configuration. Use only clients and providers approved to handle this data, and apply your organization’s retention and sharing policies.

Are API calls logged per user, and can we export the logs?

NowSecure Platform provides an audit log for supported events. Its API supports retrieving entries and filtering by user and date. See NowSecure Platform Audit Log API. The documented audit events should not be treated as a complete record of every read-only API request or MCP tool call.

The MCP Server also supports optional local logging through NSMCP_LOG_FILE. Logging is disabled by default. When enabled, it records timestamps, tool names, execution durations, and errors in a JSON-lines file that you can collect with your logging system. Tool arguments and results are omitted, and these records do not include a user identity. Local tool logs therefore do not provide a complete per-user API audit trail. Consult the configuration documentation for your installed version.

Contact NowSecure Support to confirm coverage, retention, and export options for your audit requirements.

What are the beta support terms, and how can we request security assurance documentation?

The NowSecure MCP Server is currently in beta. Contact your NowSecure account team to confirm the applicable beta terms, support coverage, response targets, and any service-level commitments.

Request the latest available SOC 2 Type II report and information about applicable ISO certifications through your account team. They can confirm document availability, scope, reporting period, and any access requirements.

Troubleshooting

NowSecure tools do not appear

• Confirm that the extension is enabled.
• Start a new conversation.
• Restart Claude Desktop if necessary.
• Open Settings → Connectors and confirm that the tools are not blocked.

Authentication or authorization errors occur

• Confirm that the API token is current and has not been revoked.
• Confirm that the token can access the requested apps or groups.
• Confirm that your account is licensed for the selected product, particularly NowSecure MARI.
• Reconfigure the connector if you entered the wrong product.

An app does not appear in Platform portfolio results

Platform portfolio tools cover apps with a completed scan in the rolling 12-month portfolio window. Older scan history may still be available when the assistant reviews assessments for a known app.

Security recommendations

• Install packages only from the official NowSecure GitHub repository.
• Use a short-lived or appropriately scoped API token when available. 
• Revoke unused tokens from the NowSecure token administration page. 
• Enable only the product you need. 
• Do not include API tokens in prompts. 
• Use only AI clients approved to process your organization’s application security data. 
• Review other connectors and tools enabled in the same AI session.