How do I use nowsecure-mcp-server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@nowsecure-mcp-server list my applications" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

nowsecure-mcp-server

by tatavarthitarun

Overview Schema Source Related Servers Score Discussions Admin

JavaScript

Local

NowSecure MCP Server 🎈💜

Made by Tatavarthi Tarun · LinkedIn

A small Model Context Protocol (MCP) server for NowSecure Platform. Built to work around the broken UI PDF export (Failed to load report data: Enum "JiraIntegrationCustomFieldType" cannot represent value: "") by pulling findings through the REST + GraphQL APIs and, when needed, rendering the remediation PDF locally instead of relying on NowSecure's report service.

Requirements

Node.js >= 18 (the only prerequisite — npx fetches the package on demand)
A NowSecure Platform API token (PAT) — each user supplies their own (see Auth)

Related MCP server: Dependency-Track MCP Server

Tools

Tool	What it does
`list_applications`	Lists your portfolio apps (REST). Find app refs + latest assessment.
`get_remediation_findings`	Returns findings needing remediation as JSON (GraphQL). Ideal for feeding an agent.
`generate_remediation_pdf`	Renders a clean PDF locally from the findings. Works even when NowSecure's renderer fails.
`download_assessment_pdf`	Tries NowSecure's REST PDF endpoint (separate path from the broken UI export).

Auth (each user uses their own token)

Every user generates their own NowSecure Platform API bearer token (PAT) and puts it in their local MCP config. No token is bundled with this package.

Create one in Platform: Profile icon (top right) > Tokens.

NOWSECURE_TOKEN (required) — your personal PAT
NOWSECURE_API_BASE (optional) — defaults to https://api.nowsecure.com

Install

No clone or manual install needed — npx fetches and runs the latest version. You just need Node.js >= 18.

MCP client config

All examples run the package via npx (no clone/install needed — just Node.js

= 18). Replace the token with your own personal PAT.

Claude Code

Use the CLI (recommended — it validates and writes to the right file):

claude mcp add nowsecure --env NOWSECURE_TOKEN=<your-personal-pat-here> -- npx -y nowsecure-mcp-server

Add --scope user to make it available across all your projects. Or edit .mcp.json (project) / ~/.claude.json (user) directly:

{
  "mcpServers": {
    "nowsecure": {
      "command": "npx",
      "args": ["-y", "nowsecure-mcp-server"],
      "env": { "NOWSECURE_TOKEN": "<your-personal-pat-here>" }
    }
  }
}

Cursor

Edit ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "mcpServers": {
    "nowsecure": {
      "command": "npx",
      "args": ["-y", "nowsecure-mcp-server"],
      "env": { "NOWSECURE_TOKEN": "<your-personal-pat-here>" }
    }
  }
}

Google Antigravity

In the agent panel / Settings, open MCP Servers → Manage / Raw Config to edit mcp_config.json, then add:

{
  "mcpServers": {
    "nowsecure": {
      "command": "npx",
      "args": ["-y", "nowsecure-mcp-server"],
      "env": { "NOWSECURE_TOKEN": "<your-personal-pat-here>" }
    }
  }
}

GitHub Copilot (VS Code)

VS Code uses a top-level servers key (not mcpServers). Add to .vscode/mcp.json in your workspace, or your user mcp.json (Command Palette → MCP: Open User Configuration):

{
  "servers": {
    "nowsecure": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "nowsecure-mcp-server"],
      "env": { "NOWSECURE_TOKEN": "<your-personal-pat-here>" }
    }
  }
}

Kiro

Add to ~/.kiro/settings/mcp.json (global) or .kiro/settings/mcp.json (workspace):

{
  "mcpServers": {
    "nowsecure": {
      "command": "npx",
      "args": ["-y", "nowsecure-mcp-server"],
      "env": { "NOWSECURE_TOKEN": "<your-personal-pat-here>" },
      "disabled": false,
      "autoApprove": ["list_applications", "get_remediation_findings"]
    }
  }
}

If published to a private/scoped registry, use the scoped name instead, e.g. "args": ["-y", "@your-scope/nowsecure-mcp-server"].

Example usage

First list your apps with list_applications to find an app ref, then ask your agent (placeholders shown — substitute your own refs):

Generate a remediation PDF for app <app-ref-uuid> to ./remediation.pdf

If you omit the assessment ref, the latest assessment for that app is used.

Author

Tatavarthi Tarun 🎈💜 linkedin.com/in/tatav

If this saved you from NowSecure's broken PDF export, a connect on LinkedIn is appreciated!

Available Tools

5 tools

download_assessment_pdfA

Attempt to download NowSecure's own PDF via the REST report endpoint (/report/assessment/ref/{ref}.pdf). This is a different code path than the broken UI export and may succeed. Falls back gracefully with an error if NowSecure's renderer also fails.

ParametersJSON Schema

Name	Required	Description
`assessmentRef`	Yes	Assessment ref (UUID).
`outputPath`	Yes	Where to write the PDF.
`onlyRemediation`	No	If true (default), filters to open/detected findings with remediation resources and hides screenshots.

TDQS

A3.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the attempt via a specific endpoint and fallback on error, but lacks details on permissions, rate limits, or whether it's read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with action, no wasted words. Concisely conveys purpose and context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers the core action and fallback but does not explain return values or output format. For a simple download tool, this is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no additional parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: downloading a PDF assessment via a specific REST endpoint. It differentiates from the broken UI export and from siblings like generate_remediation_pdf by focusing on the assessment PDF.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context for when to use (when UI export is broken) and notes graceful fallback, but does not explicitly state when not to use or compare with alternatives like generate_remediation_pdf.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_remediation_pdfA

Generate a clean remediation PDF locally from NowSecure findings (rendered by this server, NOT NowSecure's broken report service). Includes only open findings requiring remediation (default severities: blocker, critical, high, medium). Guaranteed to work even when the UI/REST PDF export fails. The server auto-names the file as [App_Name]NowSecure_report[yyyy-MM-dd_HHmmss].pdf when given outputDir + appName.

ParametersJSON Schema

Name	Required	Description
`appRef`	Yes	Application ref (UUID).
`assessmentRef`	No	Assessment ref (UUID). If omitted, the latest assessment is used.
`outputDir`	No	Directory to save the report into (e.g. the current workspace root). The server auto-generates the filename. Defaults to the server's working directory if neither outputDir nor outputPath is given.
`appName`	No	Human-readable app name used in the auto-generated filename (e.g. 'My App'). Spaces become underscores. Falls back to the package key if omitted.
`outputPath`	No	Explicit full file path. Overrides outputDir/appName auto-naming when provided, e.g. C:/Users/you/Downloads/remediation.pdf.
`impactTypes`	No	Severities to include. Default: ['blocker','critical','high','medium'].

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses that the PDF is rendered locally, includes only open findings with default severities, guarantees to work, and auto-names files. It lacks details on authentication or return value, but is fairly transparent about core behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with three sentences, each adding essential information: purpose with reliability assurance, inclusion criteria, and naming convention. No redundancy or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters and no output schema, the description lacks mention of the return value (e.g., file path or success status) and preconditions like requiring an assessment with remediation findings. It is functional but not fully complete for an agent to infer all side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. Description adds value by explaining the auto-naming pattern (outputDir + appName), that outputPath overrides it, and the default value of impactTypes as an array of severities. This goes beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a remediation PDF from NowSecure findings, specifying it's a clean local PDF that avoids the broken NowSecure service. It distinguishes from general assessment PDFs by focusing on open findings requiring remediation with default severities listed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when to use this tool: when the UI/REST PDF export fails, and for generating a remediation-focused PDF with specific severity levels. However, it does not explicitly mention when not to use it or name alternative tools like download_assessment_pdf for full assessments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_remediation_findingsA

Pull findings that need remediation for an assessment, as structured JSON. Bypasses the broken NowSecure UI PDF renderer by querying GraphQL directly. Returns only open findings that require remediation (status detected/fail/open), filtered by severity (default: blocker, critical, high, medium). Passed and dismissed findings are excluded.

ParametersJSON Schema

Name	Required	Description
`appRef`	Yes	Application ref (UUID), e.g. 123e4567-e89b-12d3-a456-426614174000.
`assessmentRef`	No	Assessment ref (UUID). If omitted, the latest assessment is used.
`impactTypes`	No	Severities to include. Default: ['blocker','critical','high','medium'].

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that only open findings (status detected/fail/open) are returned, filtered by severity with a default list, and that passed/dismissed findings are excluded. It also mentions bypassing the broken PDF renderer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three efficient sentences with no wasted words. The first sentence front-loads the core purpose, followed by context and filtering details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 3 parameters and no output schema, the description is quite complete, explaining return content and filtering. It could be slightly improved by describing the output JSON structure, but overall adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with all parameters described. The description adds context by explaining the purpose of 'appRef' and 'assessmentRef', and that 'impactTypes' are severities with defaults, augmenting the schema's descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool pulls findings that need remediation for an assessment as structured JSON. It distinguishes from sibling tools like 'download_assessment_pdf' and 'generate_remediation_pdf' by mentioning it bypasses the broken UI PDF renderer and queries GraphQL directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use it: to get structured JSON of open findings requiring remediation, excluding passed/dismissed. It implies alternatives for PDF output but does not explicitly state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_applicationsA

List applications in your NowSecure portfolio (REST /v2/portfolio/applications). Use to discover app refs and the latest assessment per app.

ParametersJSON Schema

Name	Required	Description	Default
`pageSize`	No	Number of apps to return (default 20).
`orderBy`	No	Field to order by, e.g. 'score' (default).	score

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the endpoint and the purpose, but does not detail pagination, ordering behavior, rate limits, or the complete return structure. The parameters hint at pagination but are not explicitly described in behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the purpose, and contains no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with simple parameters, the description is fairly complete. It explains the output (refs and latest assessment) and the REST endpoint. However, it lacks details on the response format, which could be helpful without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description adds the context that the list contains 'app refs and latest assessment', which provides some context but does not add new meaning to the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'List', the resource 'applications in your NowSecure portfolio', includes the REST endpoint, and specifies the output 'app refs and the latest assessment per app'. It distinguishes from sibling tools like download_assessment_pdf and run_graphql by focusing on listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states 'Use to discover app refs and the latest assessment per app', giving direct usage context. It does not mention when not to use or provide alternatives, but the sibling tools imply different use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_graphqlA

Run an arbitrary GraphQL query/mutation against the NowSecure Platform API. Escape hatch for schema introspection and custom queries.

ParametersJSON Schema

Name	Required	Description	Default
`query`	Yes	GraphQL query string.
`variables`	No	Optional variables object.

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It mentions 'arbitrary query/mutation' implying potential mutability but lacks details on authentication, rate limits, or side effects. The term 'escape hatch' is vague regarding behavioral boundaries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences deliver purpose and usage context without any redundant or extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 params, no enums, no output schema). The description covers core purpose but does not explain what the response looks like (e.g., GraphQL result structure), which may be needed since there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters described. The description does not add additional semantic value beyond the schema, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Run', the resource 'GraphQL query/mutation against the NowSecure Platform API', and its role as an 'escape hatch'. It effectively distinguishes from sibling tools (e.g., download_assessment_pdf) which are specific output generators.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Escape hatch for schema introspection and custom queries' provides clear context for when to use this tool. However, it does not explicitly indicate when not to use it or provide alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

5 tool updatesv1.0.1Jun 12, 2026
- First observeddownload_assessment_pdf
- First observedgenerate_remediation_pdf
- First observedget_remediation_findings
- First observedlist_applications
- First observedrun_graphql

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.2/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: downloading PDF, generating local PDF, getting structured findings, listing apps, and running arbitrary GraphQL queries. No overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (download_assessment_pdf, generate_remediation_pdf, get_remediation_findings, list_applications, run_graphql). The naming convention is uniform and predictable.

Tool Count5/5

With 5 tools, the server is well-scoped for a remediation-focused workflow. It provides enough functionality without unnecessary bloat, and each tool earns its place.

Completeness4/5

The tool set covers the core remediation workflow (list apps, get findings, generate PDF) and includes a GraphQL escape hatch for custom operations. Minor gaps like direct update/delete actions are missing but can be addressed via run_graphql.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

agents
com.hirosecure
Programmatic control of the Hiro security platform: scans, tasks, plans, and approvals.
Security Penetration Testing
1
SBOMApp - SBOM Generator & Vulnerability Scanner
io.github.mcpsbom
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Developer Tools Security Testing & QA Tools
2
Malwagon
com.malwagon
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
Security
1
brainCloud MCPOAuth
com.braincloudservers
Manage brainCloud apps, cloud code, hooks and servers; API lookups to help generate client code.
Cloud Platforms Developer Tools
2

Related MCP Servers

htb-app-mcp
Penetration Testing Education & Learning Tools
AeonDave
A
license
C
quality
B
maintenance
Enables interaction with Hack The Box App services including machines, challenges, sherlocks, and more through the HTB API v4.
Updated a month ago (2026-08-08 14:42 UTC)
60
1
MIT
Dependency-Track MCP Server
Security Testing & QA Tools
daniel-brenner-fnt
A
license
Not graded
quality
C
maintenance
Enables querying projects, fetching findings, triggering analysis, uploading CycloneDX BOMs, and checking async token status for OWASP Dependency-Track.
Updated 6 months ago (2026-03-13 15:15 UTC)
18
1
MIT
nable-rmm-mcp
Monitoring Observability
MSPbotsAI
A
license
Not graded
quality
B
maintenance
Enables interaction with N-able RMM (N-sight) API to manage clients, sites, devices, and retrieve monitoring data such as checks, patches, and performance history.
Updated 4 days ago (2026-09-04 02:53 UTC)
Apache 2.0
saglitzsecure-mcp
Code Analysis Penetration Testing CI/CD & DevOps
HalidSaglam
A
license
Not graded
quality
B
maintenance
Enables security scanning of source code and Apple configuration files, providing evidence-based findings, explanations, remediation plans, threat modeling, and knowledge base access through MCP tools.
Updated 11 days ago (2026-08-28 20:06 UTC)
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/tatavarthitarun/nowsecure-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server