MCP server reference

NAPT exposes a single Streamable-HTTP MCP endpoint. Paste this URL into ChatGPT, Claude, Cursor, Codex, or any MCP-capable client:

https://napt.networkgig.in/mcp/server

The endpoint accepts POST JSON-RPC requests and requires both application/json and text/event-stream in the Accept header. Unauthenticated requests return 401 along with a WWW-Authenticate header pointing at the protected-resource metadata:

https://napt.networkgig.in/.well-known/oauth-protected-resource

NAPT is an OAuth resource server; the authorization server is the platform identity service. Most clients perform every step below automatically once you paste the server URL — the manual detail is here for custom integrations.

1. Discovery. The client fetches /.well-known/oauth-protected-resource from NAPT, reads the authorization_servers entry, then fetches that issuer's /.well-known/oauth-authorization-server document.
2. Client registration. Dynamic client registration (DCR) is enabled, so the client self-registers at the issuer's registration_endpoint. No client id needs to be created by hand.
3. Authorization + PKCE. The client opens the issuer's authorize endpoint with a PKCE challenge. You sign in to NAPT if you are not already signed in.
4. Consent. You are redirected to the NAPT consent screen at /.lovable/oauth/consent, which names the client and the account you are connecting. Approve or deny there.
5. Token exchange. The client exchanges the authorization code for an access token and refresh token at the issuer's token endpoint.
6. Calling tools. Every MCP request carries Authorization: Bearer <access token>. NAPT verifies the signature, issuer and audience, resolves your user identity, and applies scope checks and row-level security per tool.

Copied app-session tokens are rejected on purpose: only tokens minted through this OAuth flow carry the OAuth client claim the server requires.

Discovery : GET https://napt.networkgig.in/.well-known/oauth-protected-resource
Authorize : GET  <issuer>/authorize?response_type=code&code_challenge=…
Consent   : GET  https://napt.networkgig.in/.lovable/oauth/consent?authorization_id=…
Token     : POST <issuer>/token   (grant_type=authorization_code | refresh_token)
Call      : POST https://napt.networkgig.in/mcp/server    (Authorization: Bearer <token>)

Access tokens authenticate you; NAPT scopes authorize each tool. Scopes are granted per-user by a platform admin and checked on every call. Admins hold all scopes.

A call without the required scope returns a tool error naming the missing scope. Admins manage grants at /admin/mcp-scopes and review every request at /admin/mcp-audit.

Four tools are advertised over tools/list. Each example below is a complete JSON-RPC request body plus an equivalent curl command.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_scripts",
    "arguments": {
      "category": "routing",
      "vendor": "cisco",
      "limit": 25
    }
  }
}

curl -X POST https://napt.networkgig.in/mcp/server \
  -H "Authorization: Bearer $NAPT_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_scripts","arguments":{"category":"routing","vendor":"cisco","limit":25}}}'

{
  "total": 112,
  "count": 25,
  "limit": 25,
  "offset": 0,
  "has_more": true,
  "next_offset": 25,
  "next_cursor": "eyJzIjoic2x1ZyIsIm8iOiJhc2MiLCJrIjoi4oCmIiwiZyI6IuKApiJ9",
  "scripts": [
    { "slug": "bgp-neighbor-audit", "label": "BGP neighbour audit", "vendors": ["cisco"], "category": "routing" }
  ]
}

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "get_script",
    "arguments": {
      "slug": "bgp-neighbor-audit"
    }
  }
}

curl -X POST https://napt.networkgig.in/mcp/server \
  -H "Authorization: Bearer $NAPT_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_script","arguments":{"slug":"bgp-neighbor-audit"}}}'

{
  "script": {
    "slug": "bgp-neighbor-audit",
    "title": "BGP neighbour audit",
    "framework": "netmiko",
    "code": "..."
  }
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "query_findings",
    "arguments": {
      "severity": "critical",
      "limit": 20
    }
  }
}

curl -X POST https://napt.networkgig.in/mcp/server \
  -H "Authorization: Bearer $NAPT_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"query_findings","arguments":{"severity":"critical","limit":20}}}'

{
  "result": {
    "total": 3,
    "findings": [
      { "id": "…", "severity": "critical", "title": "OSPF area mismatch", "device": "core-rtr-01" }
    ]
  }
}

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "tools/call",
  "params": {
    "name": "list_compliance_scores",
    "arguments": {
      "limit": 10
    }
  }
}

curl -X POST https://napt.networkgig.in/mcp/server \
  -H "Authorization: Bearer $NAPT_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"list_compliance_scores","arguments":{"limit":10}}}'

{
  "result": {
    "scores": [
      { "profile": "CIS", "score": 87, "scored_at": "2026-07-28T04:00:00Z" }
    ]
  }
}

To enumerate tools programmatically, send {"jsonrpc":"2.0","id":0,"method":"tools/list"} to the same endpoint.

A public readiness probe reports MCP definition, transport, database and auth health:

curl -s https://napt.networkgig.in/api/public/mcp-health | jq

• 401 on every call — the token was not minted through the OAuth flow, or it expired. Reconnect the client.
• 406 Not Acceptable — the client omitted Accept: application/json, text/event-stream.
• "Access denied … missing the scope" — ask a platform admin to grant the scope listed in the error.
• Empty results — tools read your own data under row-level security; check you connected with the intended account.