Netskope管理工具
通过模型上下文协议提供用于管理Netskope基础设施、策略和引导配置的工具。
MCP 服务配置
复制以下 JSON 到 OPClaw 或其他 MCP 客户端的配置文件中即可使用
{
"mcpServers": {
"netskope-mcp": {
"args": [
"dist/cli.js"
],
"command": "node",
"cwd": "/path/to/netskope-mcp",
"env": {
"NETSKOPE_API_KEY": "your-token",
"NETSKOPE_BASE_URL": "https://your-tenant.goskope.com"
}
}
}
}
该服务需要配置环境变量:NETSKOPE_API_KEY、NETSKOPE_BASE_URL
服务介绍
Netskope NPA MCP 服务器
用于通过大型语言模型 (LLM) 管理 Netskope 网络私有访问 (NPA) 基础设施的模型上下文协议 (MCP) 服务器。
警告
要使所有 50 个工具正常运行,还有很多工作要做,我强烈建议不要在任何生产环境中使用此工具。
演示
https://github.com/johnneerdael/netskope-mcp/raw/refs/heads/main/demo.mov
安装
选项 1:NPM 包
使用 npm 安装包:
npm install @johnneerdael/netskope-mcp
选项 2:本地开发
克隆仓库并安装依赖项:
git clone https://github.com/johnneerdael/netskope-mcp.git
cd netskope-mcp
npm install
npm run build
MCP 配置
将以下配置添加到您的 MCP 设置文件中:
Windows with WSL
对于 NPM 安装:
{
"mcpServers": {
"netskope-mcp": {
"command": "wsl.exe",
"args": [
"bash",
"-c",
"source ~/.nvm/nvm.sh && NETSKOPE_BASE_URL=https://your-tenant.goskope.com NETSKOPE_API_KEY=your-token npx -y @johnneerdael/netskope-mcp"
]
}
}
}
对于本地开发:
{
"mcpServers": {
"netskope-mcp": {
"command": "wsl.exe",
"args": [
"bash",
"-c",
"cd /path/to/netskope-mcp && NETSKOPE_BASE_URL=https://your-tenant.goskope.com NETSKOPE_API_KEY=your-token node dist/cli.js"
]
}
}
}
Linux 和 macOS
对于 NPM 安装:
{
"mcpServers": {
"netskope-mcp": {
"command": "npx",
"args": ["-y", "@johnneerdael/netskope-mcp"],
"env": {
"NETSKOPE_BASE_URL": "https://your-tenant.goskope.com",
"NETSKOPE_API_KEY": "your-token"
}
}
}
}
对于本地开发:
{
"mcpServers": {
"netskope-mcp": {
"command": "node",
"args": ["dist/cli.js"],
"cwd": "/path/to/netskope-mcp",
"env": {
"NETSKOPE_BASE_URL": "https://your-tenant.goskope.com",
"NETSKOPE_API_KEY": "your-token"
}
}
}
}
环境变量
Netskope NPA MCP 服务器需要配置以下环境变量才能正常运行:
必需变量
-
NETSKOPE_BASE_URL
- 描述:您的 Netskope 租户的基本 URL
- 格式:包括协议的完整 URL
- 示例:
https://your-tenant.goskope.com - 用途:用于与您的 Netskope 租户的所有 API 通信
- 注意:必须是完整的租户 URL,不包含任何路径组件
-
NETSKOPE_API_KEY
- 描述:用于与 Netskope 服务进行身份验证的 API 令牌
- 格式:来自 Netskope 管理控制台的字符串令牌
- 示例:
030f31f7d57fd94834af57a3edc4bbda - 用途:所有 API 请求的身份验证必需
- 安全提示:请确保此令牌的安全性,并且不要将其提交到版本控制系统
配置示例
开发环境
export NETSKOPE_BASE_URL="https://dev-tenant.goskope.com"
export NETSKOPE_API_KEY="your-development-token"
生产环境
export NETSKOPE_BASE_URL="https://prod-tenant.goskope.com"
export NETSKOPE_API_KEY="your-production-token"
AlertsTools
-
getAlertConfig
- 描述: 检索发布者的当前警报配置设置,包括针对各种事件(如升级和连接状态更改)的通知偏好。
- 必需参数: 无
- 响应模式:
{ adminUsers: string[], // 要通知的管理员用户电子邮件数组 eventTypes: string[], // 要监控的事件类型数组 selectedUsers: string // 需要额外通知的用户 } - 事件类型:
UPGRADE_WILL_START: 在发布者升级开始前的通知UPGRADE_STARTED: 升级过程开始时的通知UPGRADE_SUCCEEDED: 升级成功完成后的通知UPGRADE_FAILED: 如果升级过程失败的通知CONNECTION_FAILED: 当发布者连接出现问题时的通知
- 使用示例:
- "检查哪些管理员被配置为接收升级通知:使用
getAlertConfig返回当前管理员用户的列表及其通知偏好。" - "在计划维护窗口前验证警报配置:使用
getAlertConfig确保正确的团队成员将收到升级事件的通知。" - "审核发布者监控设置:使用
getAlertConfig显示正在跟踪的关键事件以及谁会收到通知。"
- "检查哪些管理员被配置为接收升级通知:使用
-
updateAlertConfig
- 描述: 更新发布者的警报配置设置,允许自定义针对各种系统事件(包括升级和连接状态更改)的通知偏好。
- 必需参数:
{ adminUsers: string[], // 接收通知的管理员用户电子邮件数组 eventTypes: string[], // 要监控的事件类型数组 selectedUsers: string // 需要额外接收通知的用户 } - 响应模式: 与
getAlertConfig相同 - 使用示例:
- "配置通知:更新警报设置以确保关键事件得到适当监控。"
- "修改接收者:调整接收特定类型警报的管理员列表。"
- "事件选择:自定义触发不同用户组通知的事件类型。"
LocalBrokerTools
-
listLocalBrokers
- Description: Lists all configured local brokers in your Netskope environment. Local brokers are used for on-premises Zero Trust Network Access (ZTNA) scenarios where end-users connect to a Local Broker instead of a Cloud Broker to access private applications hosted on-premises.
- Required Parameters: None
- Optional Parameters:
fields: Array of specific fields to return in the response
- Response Schema:
{ status: 'success' | 'not found', total: number, data: Array<{ id: number, // Unique identifier for the local broker name: string, // Display name of the local broker common_name: string, // Common name used for broker identification registered: boolean // Registration status of the broker }> } - Usage Examples:
- "Monitor your local broker deployment by listing your local brokers to get an overview of all registered brokers and their current status."
- "Verify high availability setup: Check if you have multiple local brokers configured per site by reviewing the list of deployed brokers."
- "Audit broker registration: List all local brokers to identify any unregistered instances that need attention."
-
createLocalBroker
- Description: Creates a new local broker instance for handling on-premises ZTNA traffic. This is typically used when setting up new sites or expanding capacity for existing locations.
- Required Parameters:
{ name: string // Name for the new local broker } - Response Schema:
{ status: 'success' | 'not found', data: { id: number, // Assigned unique identifier name: string, // Configured broker name common_name: string, // Assigned common name registered: boolean // Initial registration status } } - Usage Examples:
- "Deploy a new site: Create a local broker twice to ensure high availability for a new office location."
- "Expand capacity: Add additional local brokers to handle increased on-premises traffic by creating new broker instances."
- "Initialize HA setup: Create multiple local brokers with descriptive names indicating their site and role."
-
getLocalBroker
- Description: Retrieves detailed information about a specific local broker by its ID. Use this to monitor the status and configuration of individual broker instances.
- Required Parameters:
id: Numeric identifier of the local broker to retrieve
- Response Schema:
{ status: 'success' | 'not found', data: { id: number, // Broker's unique identifier name: string, // Broker's display name common_name: string, // Broker's common name registered: boolean // Current registration status } } - Usage Examples:
- "Check broker health: Retrieve specific broker details to verify its registration status and configuration."
- "Troubleshoot connectivity: Get detailed information about a broker that's experiencing issues."
- "Verify deployment: Confirm the successful creation of a new broker by retrieving its details."
-
updateLocalBroker
- Description: Updates the configuration of an existing local broker. This allows you to modify broker settings such as its name while maintaining its identity and connections.
- Required Parameters:
{ id: number, // Identifier of broker to update name: string // New name for the broker } - Response Schema:
{ status: 'success' | 'not found', data: { id: number, // Broker's identifier name: string, // Updated broker name common_name: string, // Broker's common name registered: boolean // Current registration status } } - Usage Examples:
- "Rename for clarity: Update a broker's name to better reflect its location or role in your infrastructure."
- "Standardize naming: Modify broker names to follow updated naming conventions across your organization."
- "Update HA pair: Adjust broker names to clearly indicate primary and secondary roles."
-
deleteLocalBroker
- Description: Removes a local broker from your Netskope configuration. Use this when decommissioning brokers or cleaning up unused instances.
- Required Parameters:
id: Numeric identifier of the local broker to delete
- Response Schema:
{ status: 'success' | 'not found' } - Usage Examples:
- "Decommission old brokers: Remove brokers that are no longer needed or have been replaced."
- "Clean up test instances: Delete temporary brokers created for testing purposes."
- "Site consolidation: Remove brokers from decommissioned locations while maintaining service at active sites."
-
getBrokerConfig
- Description: Retrieves the global configuration settings for local brokers, including hostname configurations that affect all broker instances.
- Required Parameters: None
- Response Schema:
{ status: 'success' | 'not found', data: { hostname: string // Global hostname configuration } } - Usage Examples:
- "Review global settings: Check the current hostname configuration affecting all local brokers."
- "Prepare for changes: Verify existing configuration before planning updates."
- "Audit configuration: Ensure hostname settings align with your network architecture."
-
updateBrokerConfig
- Description: Updates the global configuration settings for all local brokers, allowing you to modify system-wide broker behavior.
- Required Parameters:
{ hostname: string // New hostname configuration } - Response Schema:
{ status: 'success' | 'not found', data: { hostname: string // Updated hostname configuration } } - Usage Examples:
- "Modify global settings: Update the hostname configuration to reflect network changes."
- "Infrastructure updates: Adjust broker configurations to accommodate new networking requirements."
- "Standardize setup: Ensure consistent hostname configuration across all broker instances."
-
generateLocalBrokerRegistrationToken
- Description: Generates a new registration token for a specific local broker, enabling secure registration with the Netskope management plane.
- Required Parameters:
id: Numeric identifier of the local broker
- Response Schema:
{ status: 'success' | 'not found', data: { token: string // Generated registration token } } - Usage Examples:
- "Secure new broker: Generate a token to safely register a newly deployed local broker."
- "Re-register broker: Create a new token when needing to re-establish broker registration."
- "Token rotation: Generate new registration tokens as part of security maintenance."
PolicyTools
-
listRules
- Description: Lists all policy rules configured in your Netskope Private Access environment. These rules define access controls for private applications using Zero Trust Network Access (ZTNA) principles.
- Required Parameters: None
- Optional Parameters:
fields: Array of specific fields to returnfilter: Filter criteria for the ruleslimit: Maximum number of rules to returnoffset: Number of rules to skipsortby: Field to sort bysortorder: Sort direction ('asc' or 'desc')
- Response Schema:
{ data: { rules: Array<{ id: number, name: string, description?: string, enabled: boolean, action: 'allow' | 'block', policy_group_id: number, priority: number, conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }>, created_at: string, updated_at: string }> }, status: 'success' | 'error', total: number } - Usage Examples:
- "Audit access policies to review all configured rules and their conditions to ensure proper access controls."
- "Prioritize rules: List rules sorted by priority to understand the order of policy evaluation and identify potential conflicts."
- "Filter specific policies: Retrieve rules related to specific applications or user groups using the filter parameter."
-
getRule
- Description: Retrieves detailed information about a specific policy rule by its ID. Use this to examine individual rule configurations and conditions.
- Required Parameters:
id: Numeric identifier of the policy rule
- Optional Parameters:
fields: Array of specific fields to return
- Response Schema:
{ data: { id: number, name: string, description?: string, enabled: boolean, action: 'allow' | 'block', policy_group_id: number, priority: number, conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }>, created_at: string, updated_at: string }, status: 'success' | 'error' } - Usage Examples:
- "Troubleshoot access issues: Examine specific rule details to understand why access might be blocked or allowed."
- "Verify rule conditions: Check the exact conditions configured for a critical access policy."
- "Review rule history: Check creation and update timestamps to track policy changes."
-
createRule
- Description: Creates a new policy rule to control access to private applications. Rules can be based on various conditions including user identity, device status, and location.
- Required Parameters:
{ name: string, // Rule name description?: string, // Optional rule description enabled: boolean, // Rule status action: 'allow' | 'block', // Access action policy_group_id: number, // Associated policy group priority: number, // Rule priority conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }> } - Usage Examples:
- "Implement least privilege access: Create rules that grant access only to specific applications based on user roles and device status."
- "Set up location-based policies: Define rules that restrict access based on user location for compliance requirements."
- "Configure group-based access: Create rules that allow specific user groups to access designated private applications."
-
updateRule
- Description: Updates an existing policy rule's configuration. Use this to modify access controls, conditions, or rule properties.
- Required Parameters:
id: Numeric identifier of the rule to updatedata: Updated rule configuration following the same schema as create_rule
- Response Schema:
{ data: { // Updated rule details (same as get_rule response) }, status: 'success' | 'error' } - Usage Examples:
- "Adjust access conditions: Modify rule conditions to accommodate new security requirements or organizational changes."
- "Update rule priority: Change a rule's priority to ensure proper policy evaluation order."
- "Enable/disable rules: Toggle rule status during maintenance or when implementing policy changes."
-
deleteRule
- Description: Removes a policy rule from your configuration. Use with caution as this permanently removes the access control policy.
- Required Parameters:
id: Numeric identifier of the rule to delete
- Response Schema:
{ status: 'success' | 'error' } - Usage Examples:
- "Clean up obsolete policies: Remove rules that are no longer needed or have been superseded by new policies."
- "Policy consolidation: Delete redundant rules after merging policy configurations."
- "Remove temporary rules: Clean up temporary access policies created for specific projects or maintenance."
PrivateAppsTools
-
createPrivateApp
- Description: Creates a new private application in your Netskope environment. This allows you to define and configure applications that will be accessible through your Zero Trust Network Access (ZTNA) infrastructure.
- Required Parameters:
{ app_name: string, // Name of the private application host: string, // Host address of the application clientless_access: boolean, // Enable clientless access is_user_portal_app: boolean, // Show in user portal protocols: Array<{ port: string, // Port number type: 'tcp' | 'udp' // Protocol type }>, publisher_tags?: Array<{ // Optional publisher tags tag_name: string }>, publishers: Array<{ // Associated publishers publisher_id: string, publisher_name: string }>, trust_self_signed_certs: boolean, // Trust self-signed certificates use_publisher_dns: boolean, // Use publisher DNS allow_unauthenticated_cors?: boolean, // Optional CORS settings allow_uri_bypass?: boolean, // Optional URI bypass bypass_uris?: string[], // Optional bypass URIs real_host?: string, // Optional real host app_option?: Record<string, unknown> // Additional options } - Response Schema:
{ data: { allow_unauthenticated_cors: boolean, allow_uri_bypass: boolean, uribypass_header_value: string, bypass_uris: string[], app_option: Record<string, unknown>, clientless_access: boolean, host: string, id: number, is_user_portal_app: boolean, name: string, protocols: Array<{ ports: string[], type: string }>, real_host: string, service_publisher_assignments: Array<{ primary: boolean, publisher_id: number, publisher_name: string, reachability: { error_code: number, error_string: string, reachable: boolean }, service_id: number }>, tags: Array<{ tag_id: number, tag_name: string }>, trust_self_signed_certs: boolean, use_publisher_dns: boolean }, status: 'success' | 'not found' } - Usage Examples:
- "Deploy internal application: Create a private app definition for an internal web service with specific protocol and security settings."
- "Configure high availability: Set up a private application with multiple publishers for redundancy."
- "Enable secure access: Create a private app with strict security settings and specific bypass rules."
-
updatePrivateApp
- Description: Updates the configuration of an existing private application, allowing modification of access settings, protocols, and security parameters.
- Required Parameters:
{ id: number, // Application ID // All other fields same as create_private_app } - Response Schema: Same as create_private_app
- Usage Examples:
- "Modify security settings: Update certificate trust settings and CORS configuration for enhanced security."
- "Adjust access parameters: Update protocols or bypass rules to accommodate changing requirements."
- "Publisher reassignment: Modify the list of publishers handling the application traffic."
-
deletePrivateApp
- Description: Removes a private application from your Netskope configuration. This action permanently removes the application definition and associated access controls.
- Required Parameters:
id: Numeric identifier of the private application
- Response Schema:
{ status: number, result: string } - Usage Examples:
- "Decommission service: Remove a private application that is no longer in use."
- "Clean up test apps: Delete temporary applications used for testing."
- "Remove deprecated services: Clean up old application definitions during infrastructure updates."
-
getPrivateApp
- Description: Retrieves detailed configuration information about a specific private application.
- Required Parameters:
id: Numeric identifier of the private application
- Response Schema: Same as create_private_app response
- Usage Examples:
- "Audit configuration: Review detailed settings of a private application for compliance checks."
- "Troubleshoot access: Examine application configuration to resolve connectivity issues."
- "Verify settings: Confirm proper configuration after making changes to the application."
-
listPrivateApps
- Description: Retrieves a list of all configured private applications with their configurations.
- Required Parameters: None
- Optional Parameters:
fields: Specific fields to returnfilter: Filter criteriaquery: Search querylimit: Maximum number of resultsoffset: Number of results to skip
- Response Schema:
{ data: Array<{ // Same fields as get_private_app response }>, status: 'success' | 'not found', total: number } - Usage Examples:
- "Inventory applications: Get a complete list of all private applications for audit purposes."
- "Filter by criteria: Search for applications with specific configurations or tags."
- "Paginated review: Retrieve applications in manageable chunks for large deployments."
-
getPrivateAppTags
- Description: Retrieves all tags associated with private applications, useful for organizing and categorizing applications.
- Required Parameters: None
- Optional Parameters:
query: Search query for tagslimit: Maximum number of tagsoffset: Number of tags to skip
- Response Schema:
{ data: Array<{ tag_id: number, tag_name: string }>, status: 'success' | 'not found' } - Usage Examples:
- "List categories: Retrieve all tags to understand application categorization."
- "Search tags: Find specific tags matching certain criteria."
- "Tag inventory: Review all available tags for standardization purposes."
-
createPrivateAppTags
- Description: Associates new tags with a private application for better organization and management.
- Required Parameters:
id: Application identifiertags: Array of tag objects
- Usage Examples:
- "Categorize apps: Add organizational tags to group related applications."
- "Environment labeling: Tag applications based on their deployment environment."
- "Team assignment: Add tags to indicate which team owns or manages the application."
-
updatePrivateAppTags
- Description: Updates the tags associated with one or more private applications.
- Required Parameters:
ids: Array of application identifierstags: Array of updated tag objects
- Usage Examples:
- "Bulk tag update: Modify tags for multiple applications simultaneously."
- "Tag standardization: Update tags to conform to new naming conventions."
- "Ownership changes: Update tags to reflect new team assignments."
-
updatePrivateAppPublishers
- Description: Updates the publisher assignments for private applications, controlling which publishers handle application traffic.
- Required Parameters:
{ private_app_ids: string[], // Application IDs publisher_ids: string[] // Publisher IDs } - Usage Examples:
- "Load balancing: Distribute application traffic across multiple publishers."
- "Publisher migration: Move applications to new or different publishers."
- "HA configuration: Add backup publishers for high availability."
-
deletePrivateAppPublishers
- Description: Removes publisher assignments from private applications.
- Required Parameters:
{ private_app_ids: string[], // Application IDs publisher_ids: string[] // Publisher IDs to remove } - Usage Examples:
- "Publisher decommission: Remove old publishers from application configurations."
- "Clean up assignments: Remove unnecessary publisher assignments."
- "Reconfigure routing: Remove publishers during traffic flow updates."
-
getDiscoverySettings
- Description: Retrieves the current discovery settings for private applications, which control how applications are discovered and monitored.
- Required Parameters: None
- Usage Examples:
- "Review discovery: Check current application discovery configuration."
- "Audit settings: Verify discovery parameters for compliance."
- "Monitor configuration: Examine how applications are being discovered and tracked."
-
getPolicyInUse
- Description: Retrieves the active policies associated with specified private applications.
- Required Parameters:
ids: Array of application identifiers
- Usage Examples:
- "Policy audit: Review which policies are affecting specific applications."
- "Access control review: Verify policy assignments for security compliance."
- "Troubleshoot access: Check policies when investigating access issues."
发行商工具
-
listPublishers
- Description: Lists all publishers configured in your Netskope environment. Publishers are the components that handle private application traffic and require proper management for optimal performance.
- Required Parameters: None
- Optional Parameters:
fields: Specific fields to return in the response
- Response Schema:
{ data: { publishers: Array<{ apps_count: number, assessment: { ca_certs_status: { hashes: string[], last_modified: number }, eee_support: boolean, hdd_free: string, hdd_total: string, ip_address: string, latency: number, version: string }, capabilities: { DTLS: boolean, EEE: boolean, auto_upgrade: boolean, nwa_ba: boolean, pull_nsconfig: { orgkey_exist: boolean, orguri_exist: boolean } }, common_name: string, connected_apps: string[], id: number, lbrokerconnect: boolean, name: string, publisher_upgrade_profiles_id: number, registered: boolean, status: 'connected' | 'not registered', stitcher_id: number, sticher_pop: string, upgrade_request: boolean, upgrade_status: { upstat: string } }> }, status: 'success' | 'not found', total: number } - Usage Examples:
- "Monitor deployment: List all publishers to check their connection status and capabilities."
- "Audit configuration: Review publisher settings and associated applications."
- "Capacity planning: Check the number of apps and load across publishers."
-
getPublisher
- Description: Retrieves detailed information about a specific publisher, including its configuration, status, and capabilities.
- Required Parameters:
id: Numeric identifier of the publisher
- Response Schema: Same as individual publisher in list_publishers response
- Usage Examples:
- "Health check: Get detailed status information for a specific publisher."
- "Troubleshoot connectivity: Examine publisher capabilities and connection status."
- "Version verification: Check publisher version and upgrade status."
-
createPublisher
- Description: Creates a new publisher instance in your Netskope environment.
- Required Parameters:
{ name: string, // Publisher name lbrokerconnect?: boolean, // Optional local broker connection publisher_upgrade_profiles_id?: number // Optional upgrade profile assignment } - Response Schema: Same as get_publisher response
- Usage Examples:
- "Deploy new publisher: Create a publisher for a new data center location."
- "Expand capacity: Add publishers to handle increased application traffic."
- "Configure HA: Create additional publishers for high availability setup."
-
patchPublisher
- Description: Partially updates a publisher's configuration, allowing modification of specific settings while maintaining others.
- Required Parameters:
{ name: string, // Publisher name id?: number, // Optional publisher ID lbrokerconnect?: boolean, // Optional local broker connection publisher_upgrade_profiles_id?: number // Optional upgrade profile assignment } - Response Schema: Same as get_publisher response
- Usage Examples:
- "Update name: Change publisher name to match new naming convention."
- "Modify connection: Update local b