Introduction
Before you begin
Install the MCPB package in Claude Desktop
Install the CLI binary for other MCP clients
Example prompts and use cases
Troubleshooting
Security recommendations
 

Introduction

The NowSecure MCP Server (BETA) connects compatible AI assistants to the mobile application security data that you are authorized to access in NowSecure Platform or NowSecure Mobile App Risk Intelligence (MARI). The MCP Server currently provides read-only tools for: 

• NowSecure Platform: Triage your organization’s mobile app portfolio, assessments, findings, and remediation work.
• NowSecure MARI: Evaluate vendor and third-party mobile apps using Mobile App Risk Intelligence.

Each configured MCP Server exposes one product. Select platform for your organization’s app portfolio or mari for third-party app risk intelligence.

Important: Treat your NowSecure API token like a password. Do not paste it into an AI conversation, source code, or a shared configuration file.

Before you begin

You need:

• Access to NowSecure Platform, NowSecure MARI, or both.
• A NowSecure API token. Create one at https://app.nowsecure.com/admin/tokens
• A supported MCP client.
• For the recommended installation, a current version of Claude Desktop.

Download the MCP Server only from the official sources: 

• NowSecure MCP Server repository
• NowSecure MCP Server releases

Recommended: Install the MCPB package in Claude Desktop

The MCPB package is the easiest way to install the NowSecure MCP Server in Claude Desktop. It includes the nsmcp executable and guides you through configuration, so you do not need to install a separate binary or edit a JSON file.

The MCPB package supports macOS on Apple silicon or Intel and Windows x64.

Step 1: Download the package

1. Go to the NowSecure MCP Server releases page.
2. Open the latest release.
3. Expand Assets if necessary.
4. Download the file named nsmcp_<version>.mcpb
5. Open the downloaded file with Claude Desktop.

Step 2: Install the extension

Review the NowSecure extension information and select Install.

Claude Desktop may display a general warning about the access granted to locally installed extensions. The current NowSecure MCP Server exposes read-only NowSecure tools, but you should install it only from the official NowSecure GitHub repository.

Step 3: Configure the NowSecure product and API token

Enter the following values:

• NowSecure product: Enter one of these lowercase values:
  • platform — Analyze your organization’s mobile app portfolio, assessments, and findings.
  • mari— Review vendor and third-party mobile apps using NowSecure MARI.
• NowSecure API token: Paste the token created in NowSecure.

Select Save.

The token is stored as a sensitive extension setting. Do not enter the token into a Claude prompt.

Step 4: Enable the extension

After installation, confirm that the Enabled switch is on.

Use Configure if you need to replace the API token or switch between Platform and MARI.

The MCPB installation exposes one product at a time. To use Platform and MARI concurrently, configure two named MCP Server entries using the CLI or manual configuration described below.

Step 5: Optional—allow read-only tools without individual approvals

By default, Claude may request approval before invoking a tool. Because the current NowSecure tools are read-only, you can optionally allow them without individual approval prompts:

1. Open Claude Desktop Settings.
2. Select Connectors.
3. Open the NowSecure connector.
4. Find Tool permissions
5. Set the read-only tools to Always allow.
6. Save the change.

Allowing the NowSecure tools does not control other tools available to the AI assistant. Review the complete set of enabled connectors and tools before working with sensitive vulnerability data.

Install the CLI binary for other MCP clients

Use the standalone CLI when:

• Your MCP client does not support MCPB packages
• You are using Claude Code, Cursor, VS Code, Codex CLI, Gemini CLI, Windsurf, Zed, or another local MCP client.
• You need Platform and MARI available concurrently.
• You are installing on Linux.

Example prompts and use cases

Triage the riskiest apps in your portfolio

Best used with the Platform (--product platform) configuration.

Show me the riskiest apps in our portfolio. For the app with the lowest security score, pull its medium-and-higher findings and tell me what we should fix first.

NowSecure Platform security scores range from 0–100, where a higher score is better. Finding lists are compact by default and omit lengthy recommendation text. The assistant retrieves complete remediation guidance only for the findings selected for deeper review.

Determine whether apps are affected by uses_http

Best used with the Platform configuration (--product platform).

We are reviewing the uses_http finding. Are any apps in our portfolio affected, which apps should we prioritize, and what should we tell their development teams?

Draft a remediation ticket

Best used with the Platform (--product platform) configuration.

For [app name or NowSecure URL], review the latest assessment and draft a remediation ticket for its highest-priority critical finding. Include a concise title, risk and impact, affected app and

assessment, technical details, recommended remediation, acceptance criteria, and the relevant NowSecure references.

The NowSecure MCP Server is read-only. It can prepare ticket content in the conversation, but it does not create or update a ticket unless a separately authorized ticketing tool is available or connected to your AI Agent.

Evaluate a third-party app request

Best used with the MARI (--product mari) configuration.

An employee wants to use CamScanner on a corporate phone. Find the correct app in NowSecure MARI, assess its risk, identify the most important findings and privacy signals, and give me a go/no-go recommendation with any conditions or mitigations.

The assistant can selectively inspect relevant permissions, tracking domains, network connections, libraries and SDKs, or AI-usage data instead of retrieving every available detail. Unlike Platform security scores, a NowSecure MARI risk score ranges from 0–100, where a higher risk score is worse.

Troubleshooting

NowSecure tools do not appear

• Confirm that the extension is enabled.
• Start a new conversation.
• Restart Claude Desktop if necessary.
• Open Settings → Connectors and confirm that the tools are not blocked.

Authentication or authorization errors occur

• Confirm that the API token is current and has not been revoked.
• Confirm that the token can access the requested apps or groups.
• Confirm that your account is licensed for the selected product, particularly NowSecure MARI.
• Reconfigure the connector if you entered the wrong product.

An app does not appear in Platform portfolio results

Platform portfolio tools cover apps with a completed scan in the rolling 12-month portfolio window. Older scan history may still be available when the assistant reviews assessments for a known app.

Security recommendations

• Install packages only from the official NowSecure GitHub repository.
• Use a short-lived or appropriately scoped API token when available. 
• Revoke unused tokens from the NowSecure token administration page. 
• Enable only the product you need. 
• Do not include API tokens in prompts. 
• Use only AI clients approved to process your organization’s application security data. 
• Review other connectors and tools enabled in the same AI session.