Dark
Request a walkthrough
On this page
Developer overview

MCP Integration

Definition. Noxtica’s Model Context Protocol (MCP) integration gives an eligible tenant’s external AI workflow structured, read-only access to supported Noxtica context. The surface uses MCP over JSON-RPC and requires a scoped bearer token.

It solves a context problem: an internal assistant or investigation workflow may need current policy, alert, or risk-distribution information without a person copying it from the console. MCP makes approved reads machine-consumable while leaving action and authorization in customer-owned systems.

Two boundaries define the integration:

  • Read-only. An MCP client cannot change Noxtica configuration, create a policy, or act on traffic.
  • Opt-in and tenant-scoped. MCP is off by default, enabled only for eligible tenants, and restricted to the tenant and scopes associated with the issued token.

Key points

  1. Read-onlyAn MCP client cannot change Noxtica configuration, create a policy, or act on traffic.
  2. Opt-in and tenant-scopedMCP is off by default, enabled only for eligible tenants, and restricted to the tenant and scopes associated with the issued token.
  3. A scoped tokenBearer tokens are scoped, rate-limited and audited. Give each integration the narrowest useful scope.
  4. Data, not instructionsResponses are data for the client to interpret, not instructions and not permission to take an action.
  5. Not Know Your AgentMCP does not verify the identity or trustworthiness of agents arriving at your site; that is the separate KYA concern.
  1. When it applies
  2. How customers use it
  3. How Noxtica does it
  4. Outputs and decisions
  5. Eligibility and limitations
  6. Where it fits
  7. Who it fits
  8. How teams connect
  9. Limits
  10. Common questions
  11. Read deeper
How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

When it applies

MCP is useful when a security, fraud, support, or reporting workflow already uses an MCP-compatible client and needs Noxtica context for:

  • summarizing a tenant’s current policies or rules;
  • adding recent alerts to an investigation brief;
  • describing risk distribution for an operational review; or
  • answering a bounded question before a human opens the source record.

If a workflow needs to update Noxtica, enforce a traffic decision, or combine data across tenants, this integration does not provide that capability.

How customers use it

  1. Confirm MCP eligibility and request tenant enablement.
  2. Have an authorized operator create a token with only the required read scopes.
  3. Configure the MCP-compatible client with the provisioned server details and token.
  4. Request a supported read and inspect the structured response.
  5. Route the result to a human review, report, or customer-owned automation with its own permissions.
  6. Review call history, and mint or revoke tokens under your normal access process.

Connection details and available tools are provided during tenant provisioning; do not infer undocumented endpoints or scopes from examples.

How Noxtica does it

MCP is the open protocol boundary. Noxtica applies product access controls before returning tenant information and records calls for review.

Authentication

Bearer tokens have three customer-facing controls:

  • Scoped — a token can read only the enabled surfaces represented by its scopes.
  • Rate-limited — requests are subject to the tenant’s provisioned limits.
  • Audited — calls are recorded, including denied calls, so operators can review what was requested and when.

Treat the token as a secret. Give each integration the narrowest useful scope, keep it out of browser code and prompts, and revoke it and mint a new one when ownership changes.

The read-only tool set

Subject to tenant enablement and token scope, the current read surface can include:

  • Policies — configured policy context.
  • Rules — rules used by supported decision workflows.
  • Alerts — recent tenant alerts.
  • Risk distribution — aggregate risk context for the tenant’s traffic.

Every tool is a read. Responses are data for the client to interpret, not instructions and not permission to take an action. The connected agent cannot use MCP to change Noxtica or customer infrastructure.

  1. Your side

    MCP client with a scoped token

  2. Noxtica

    Scoped, rate-limited, audited

  3. Tenant context

    Read-only tools

  1. Token

    An authorized operator creates a token with only the required read scopes. Treat the token as a secret and keep it out of browser code and prompts.

  2. Request

    The MCP-compatible client requests a supported read over MCP and JSON-RPC, sending the scoped bearer token.

  3. Checks

    Noxtica applies product access controls before returning tenant information. Tokens do not bypass operator roles, tenant boundaries, scopes, or rate limits.

  4. Read

    Subject to tenant enablement and token scope, the read surface can include policies, rules, alerts and risk distribution. Every tool is a read.

  5. Response

    Responses are data for the client to interpret, not instructions and not permission to take an action. Route the result to a human review, a report, or customer-owned automation with its own permissions.

  6. Audit

    Calls are recorded so operators can review what was requested and when. Rotate or revoke the credential under your normal access process.

One scoped-token read, one step at a timeRead-only, opt-in and tenant-scoped.

Outputs and decisions

MCP outputHow it can inform a decision
Policy and rule contextCheck whether an observed result matches the intended tenant posture
Recent alertsPrioritize which event or period a human should investigate
Risk distributionCompare current traffic mix with the team’s expected operating range
Call audit recordReview which integration requested which Noxtica context

An MCP response can become stale after configuration or traffic changes. For customer-impacting decisions, retrieve current source records and apply the customer’s normal authorization and review controls.

Eligibility and limitations

  • MCP requires explicit tenant enablement and provisioned connection details; there is no anonymous or self-serve connection.
  • The integration is read-only even if the connected client supports write-capable tools elsewhere.
  • Tokens do not bypass operator roles, tenant boundaries, scopes, or rate limits.
  • Supported tools can differ by tenant provisioning. An absent tool is not an invitation to call an undocumented API.
  • MCP does not verify the identity or trustworthiness of agents arriving at your site; that is the separate KYA concern.

Where it fits

MCP is the “you integrate agentically” part of Agentic Security. It is distinct from the AI Assistant inside the console and from Know Your Agent, which evaluates supported incoming-agent identities.

Who it fits

MCP fits a security, fraud, support or reporting workflow that already uses an MCP-compatible client. The uses are listed under When it applies: investigation briefs, policy summaries and operations reporting.

How teams connect

Connection details come from your tenant provisioning; the steps are under How customers use it. Tokens are created in Backoffice: a workspace Admin mints and revokes tokens after a fresh multi-factor check, and tokens expire. See AI assistant, MCP tokens and coding-agent keys. The endpoint, protocol and tool list are in MCP server.

Limits

MCP is a read path into tenant telemetry, not a control path.

  • Controlled availability. MCP access follows the tenant’s plan tier and operator gates. Connections are set up with Noxtica.
  • Scores and risk levels in responses are probabilistic and can be wrong. Your team decides what to do, and is responsible for the client and model it connects. See Calibration.

What the tools can and cannot do is under The read-only tool set. Enablement rules and stale responses are under Eligibility and limitations and Outputs and decisions.

Common questions

Can an AI client change my Noxtica settings?

No. The tools are read-only. See The read-only tool set.

Can anyone connect an AI client?

No. Every connection needs a token issued by an authorized operator, and access is gated as described under Limits.

How is MCP different from the AI assistant?

The AI Assistant serves a signed-in operator inside the console. MCP serves an approved external client that reads scoped data with a token. They are provisioned separately.

Read deeper