# Netskope NPA MCP Server A Model Context Protocol (MCP) server for managing Netskope Network Private Access (NPA) infrastructure through Large Language Models (LLMs). ## Warning Still lots of work needs to be done for all 50 tools to be operational, i strongly advise against using this with any production environment ## Demonstration https://github.com/johnneerdael/netskope-mcp/raw/refs/heads/main/demo.mov ## Installation ### Option 1: NPM Package Install the package using npm: ```bash npm install @johnneerdael/netskope-mcp ``` ### Option 2: Local Development Clone the repository and install dependencies: ```bash git clone https://github.com/johnneerdael/netskope-mcp.git cd netskope-mcp npm install npm run build ``` ### MCP Configuration Add the following configuration to your MCP settings file: #### Windows with WSL For NPM installation: ```json { "mcpServers": { "netskope-mcp": { "command": "wsl.exe", "args": [ "bash", "-c", "source ~/.nvm/nvm.sh && NETSKOPE_BASE_URL=https://your-tenant.goskope.com NETSKOPE_API_KEY=your-token npx -y @johnneerdael/netskope-mcp" ] } } } ``` For local development: ```json { "mcpServers": { "netskope-mcp": { "command": "wsl.exe", "args": [ "bash", "-c", "cd /path/to/netskope-mcp && NETSKOPE_BASE_URL=https://your-tenant.goskope.com NETSKOPE_API_KEY=your-token node dist/cli.js" ] } } } ``` #### Linux and macOS For NPM installation: ```json { "mcpServers": { "netskope-mcp": { "command": "npx", "args": ["-y", "@johnneerdael/netskope-mcp"], "env": { "NETSKOPE_BASE_URL": "https://your-tenant.goskope.com", "NETSKOPE_API_KEY": "your-token" } } } } ``` For local development: ```json { "mcpServers": { "netskope-mcp": { "command": "node", "args": ["dist/cli.js"], "cwd": "/path/to/netskope-mcp", "env": { "NETSKOPE_BASE_URL": "https://your-tenant.goskope.com", "NETSKOPE_API_KEY": "your-token" } } } } ``` ## Environment Variables The Netskope NPA MCP Server requires the following environment variables to be configured for proper operation: ### Required Variables - **NETSKOPE_BASE_URL** - **Description**: The base URL of your Netskope tenant - **Format**: Full URL including protocol - **Example**: `https://your-tenant.goskope.com` - **Usage**: Used for all API communications with your Netskope tenant - **Note**: Must be the complete tenant URL without any path components - **NETSKOPE_API_KEY** - **Description**: API token for authentication with Netskope services - **Format**: String token from Netskope admin console - **Example**: `030f31f7d57fd94834af57a3edc4bbda` - **Usage**: Required for authenticating all API requests - **Security Note**: Keep this token secure and never commit it to version control ### Configuration Examples #### Development Environment ```bash export NETSKOPE_BASE_URL="https://dev-tenant.goskope.com" export NETSKOPE_API_KEY="your-development-token" ``` #### Production Environment ```bash export NETSKOPE_BASE_URL="https://prod-tenant.goskope.com" export NETSKOPE_API_KEY="your-production-token" ``` ### AlertsTools - **getAlertConfig** - **Description**: Retrieves the current alert configuration settings for publishers, including notification preferences for various events such as upgrades and connection status changes. - **Required Parameters**: None - **Response Schema**: ```typescript { adminUsers: string[], // Array of admin user emails to notify eventTypes: string[], // Array of event types to monitor selectedUsers: string // Additional users to notify } ``` - **Event Types**: - `UPGRADE_WILL_START`: Notification before a publisher upgrade begins - `UPGRADE_STARTED`: Notification when upgrade process initiates - `UPGRADE_SUCCEEDED`: Notification upon successful upgrade completion - `UPGRADE_FAILED`: Notification if upgrade process fails - `CONNECTION_FAILED`: Notification when publisher connection issues occur - **Usage Examples**: 1. "Check which administrators are configured to receive upgrade notifications: Use `getAlertConfig` to return the current list of admin users and their notification preferences." 2. "Verify the alert configuration before a planned maintenance window: Use `getAlertConfig` to ensure the right team members will be notified of upgrade events." 3. "Audit the publisher monitoring setup: Use `getAlertConfig` to show which critical events are being tracked and who receives notifications." - **updateAlertConfig** - **Description**: Updates the alert configuration settings for publishers, allowing customization of notification preferences for various system events including upgrades and connection status changes. - **Required Parameters**: ```typescript { adminUsers: string[], // Array of admin user emails to receive notifications eventTypes: string[], // Array of event types to monitor selectedUsers: string // Additional users to receive notifications } ``` - **Response Schema**: Same as getAlertConfig - **Usage Examples**: 1. "Configure notifications: Update alert settings to ensure critical events are properly monitored." 2. "Modify recipients: Adjust the list of administrators who receive specific types of alerts." 3. "Event selection: Customize which event types trigger notifications for different user groups." ### LocalBrokerTools - **listLocalBrokers** - **Description**: Lists all configured local brokers in your Netskope environment. Local brokers are used for on-premises Zero Trust Network Access (ZTNA) scenarios where end-users connect to a Local Broker instead of a Cloud Broker to access private applications hosted on-premises. - **Required Parameters**: None - **Optional Parameters**: - `fields`: Array of specific fields to return in the response - **Response Schema**: ```typescript { status: 'success' | 'not found', total: number, data: Array<{ id: number, // Unique identifier for the local broker name: string, // Display name of the local broker common_name: string, // Common name used for broker identification registered: boolean // Registration status of the broker }> } ``` - **Usage Examples**: 1. "Monitor your local broker deployment by listing your local brokers to get an overview of all registered brokers and their current status." 2. "Verify high availability setup: Check if you have multiple local brokers configured per site by reviewing the list of deployed brokers." 3. "Audit broker registration: List all local brokers to identify any unregistered instances that need attention." - **createLocalBroker** - **Description**: Creates a new local broker instance for handling on-premises ZTNA traffic. This is typically used when setting up new sites or expanding capacity for existing locations. - **Required Parameters**: ```typescript { name: string // Name for the new local broker } ``` - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { id: number, // Assigned unique identifier name: string, // Configured broker name common_name: string, // Assigned common name registered: boolean // Initial registration status } } ``` - **Usage Examples**: 1. "Deploy a new site: Create a local broker twice to ensure high availability for a new office location." 2. "Expand capacity: Add additional local brokers to handle increased on-premises traffic by creating new broker instances." 3. "Initialize HA setup: Create multiple local brokers with descriptive names indicating their site and role." - **getLocalBroker** - **Description**: Retrieves detailed information about a specific local broker by its ID. Use this to monitor the status and configuration of individual broker instances. - **Required Parameters**: - `id`: Numeric identifier of the local broker to retrieve - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { id: number, // Broker's unique identifier name: string, // Broker's display name common_name: string, // Broker's common name registered: boolean // Current registration status } } ``` - **Usage Examples**: 1. "Check broker health: Retrieve specific broker details to verify its registration status and configuration." 2. "Troubleshoot connectivity: Get detailed information about a broker that's experiencing issues." 3. "Verify deployment: Confirm the successful creation of a new broker by retrieving its details." - **updateLocalBroker** - **Description**: Updates the configuration of an existing local broker. This allows you to modify broker settings such as its name while maintaining its identity and connections. - **Required Parameters**: ```typescript { id: number, // Identifier of broker to update name: string // New name for the broker } ``` - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { id: number, // Broker's identifier name: string, // Updated broker name common_name: string, // Broker's common name registered: boolean // Current registration status } } ``` - **Usage Examples**: 1. "Rename for clarity: Update a broker's name to better reflect its location or role in your infrastructure." 2. "Standardize naming: Modify broker names to follow updated naming conventions across your organization." 3. "Update HA pair: Adjust broker names to clearly indicate primary and secondary roles." - **deleteLocalBroker** - **Description**: Removes a local broker from your Netskope configuration. Use this when decommissioning brokers or cleaning up unused instances. - **Required Parameters**: - `id`: Numeric identifier of the local broker to delete - **Response Schema**: ```typescript { status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Decommission old brokers: Remove brokers that are no longer needed or have been replaced." 2. "Clean up test instances: Delete temporary brokers created for testing purposes." 3. "Site consolidation: Remove brokers from decommissioned locations while maintaining service at active sites." - **getBrokerConfig** - **Description**: Retrieves the global configuration settings for local brokers, including hostname configurations that affect all broker instances. - **Required Parameters**: None - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { hostname: string // Global hostname configuration } } ``` - **Usage Examples**: 1. "Review global settings: Check the current hostname configuration affecting all local brokers." 2. "Prepare for changes: Verify existing configuration before planning updates." 3. "Audit configuration: Ensure hostname settings align with your network architecture." - **updateBrokerConfig** - **Description**: Updates the global configuration settings for all local brokers, allowing you to modify system-wide broker behavior. - **Required Parameters**: ```typescript { hostname: string // New hostname configuration } ``` - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { hostname: string // Updated hostname configuration } } ``` - **Usage Examples**: 1. "Modify global settings: Update the hostname configuration to reflect network changes." 2. "Infrastructure updates: Adjust broker configurations to accommodate new networking requirements." 3. "Standardize setup: Ensure consistent hostname configuration across all broker instances." - **generateLocalBrokerRegistrationToken** - **Description**: Generates a new registration token for a specific local broker, enabling secure registration with the Netskope management plane. - **Required Parameters**: - `id`: Numeric identifier of the local broker - **Response Schema**: ```typescript { status: 'success' | 'not found', data: { token: string // Generated registration token } } ``` - **Usage Examples**: 1. "Secure new broker: Generate a token to safely register a newly deployed local broker." 2. "Re-register broker: Create a new token when needing to re-establish broker registration." 3. "Token rotation: Generate new registration tokens as part of security maintenance." ### PolicyTools - **listRules** - **Description**: Lists all policy rules configured in your Netskope Private Access environment. These rules define access controls for private applications using Zero Trust Network Access (ZTNA) principles. - **Required Parameters**: None - **Optional Parameters**: - `fields`: Array of specific fields to return - `filter`: Filter criteria for the rules - `limit`: Maximum number of rules to return - `offset`: Number of rules to skip - `sortby`: Field to sort by - `sortorder`: Sort direction ('asc' or 'desc') - **Response Schema**: ```typescript { data: { rules: Array<{ id: number, name: string, description?: string, enabled: boolean, action: 'allow' | 'block', policy_group_id: number, priority: number, conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }>, created_at: string, updated_at: string }> }, status: 'success' | 'error', total: number } ``` - **Usage Examples**: 1. "Audit access policies to review all configured rules and their conditions to ensure proper access controls." 2. "Prioritize rules: List rules sorted by priority to understand the order of policy evaluation and identify potential conflicts." 3. "Filter specific policies: Retrieve rules related to specific applications or user groups using the filter parameter." - **getRule** - **Description**: Retrieves detailed information about a specific policy rule by its ID. Use this to examine individual rule configurations and conditions. - **Required Parameters**: - `id`: Numeric identifier of the policy rule - **Optional Parameters**: - `fields`: Array of specific fields to return - **Response Schema**: ```typescript { data: { id: number, name: string, description?: string, enabled: boolean, action: 'allow' | 'block', policy_group_id: number, priority: number, conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }>, created_at: string, updated_at: string }, status: 'success' | 'error' } ``` - **Usage Examples**: 1. "Troubleshoot access issues: Examine specific rule details to understand why access might be blocked or allowed." 2. "Verify rule conditions: Check the exact conditions configured for a critical access policy." 3. "Review rule history: Check creation and update timestamps to track policy changes." - **createRule** - **Description**: Creates a new policy rule to control access to private applications. Rules can be based on various conditions including user identity, device status, and location. - **Required Parameters**: ```typescript { name: string, // Rule name description?: string, // Optional rule description enabled: boolean, // Rule status action: 'allow' | 'block', // Access action policy_group_id: number, // Associated policy group priority: number, // Rule priority conditions: Array<{ type: 'private_app' | 'user' | 'group' | 'organization_unit' | 'location' | 'device', operator: 'in' | 'not_in' | 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with', value: string | string[] | number | number[] }> } ``` - **Usage Examples**: 1. "Implement least privilege access: Create rules that grant access only to specific applications based on user roles and device status." 2. "Set up location-based policies: Define rules that restrict access based on user location for compliance requirements." 3. "Configure group-based access: Create rules that allow specific user groups to access designated private applications." - **updateRule** - **Description**: Updates an existing policy rule's configuration. Use this to modify access controls, conditions, or rule properties. - **Required Parameters**: - `id`: Numeric identifier of the rule to update - `data`: Updated rule configuration following the same schema as create_rule - **Response Schema**: ```typescript { data: { // Updated rule details (same as get_rule response) }, status: 'success' | 'error' } ``` - **Usage Examples**: 1. "Adjust access conditions: Modify rule conditions to accommodate new security requirements or organizational changes." 2. "Update rule priority: Change a rule's priority to ensure proper policy evaluation order." 3. "Enable/disable rules: Toggle rule status during maintenance or when implementing policy changes." - **deleteRule** - **Description**: Removes a policy rule from your configuration. Use with caution as this permanently removes the access control policy. - **Required Parameters**: - `id`: Numeric identifier of the rule to delete - **Response Schema**: ```typescript { status: 'success' | 'error' } ``` - **Usage Examples**: 1. "Clean up obsolete policies: Remove rules that are no longer needed or have been superseded by new policies." 2. "Policy consolidation: Delete redundant rules after merging policy configurations." 3. "Remove temporary rules: Clean up temporary access policies created for specific projects or maintenance." ### PrivateAppsTools - **createPrivateApp** - **Description**: Creates a new private application in your Netskope environment. This allows you to define and configure applications that will be accessible through your Zero Trust Network Access (ZTNA) infrastructure. - **Required Parameters**: ```typescript { app_name: string, // Name of the private application host: string, // Host address of the application clientless_access: boolean, // Enable clientless access is_user_portal_app: boolean, // Show in user portal protocols: Array<{ port: string, // Port number type: 'tcp' | 'udp' // Protocol type }>, publisher_tags?: Array<{ // Optional publisher tags tag_name: string }>, publishers: Array<{ // Associated publishers publisher_id: string, publisher_name: string }>, trust_self_signed_certs: boolean, // Trust self-signed certificates use_publisher_dns: boolean, // Use publisher DNS allow_unauthenticated_cors?: boolean, // Optional CORS settings allow_uri_bypass?: boolean, // Optional URI bypass bypass_uris?: string[], // Optional bypass URIs real_host?: string, // Optional real host app_option?: Record // Additional options } ``` - **Response Schema**: ```typescript { data: { allow_unauthenticated_cors: boolean, allow_uri_bypass: boolean, uribypass_header_value: string, bypass_uris: string[], app_option: Record, clientless_access: boolean, host: string, id: number, is_user_portal_app: boolean, name: string, protocols: Array<{ ports: string[], type: string }>, real_host: string, service_publisher_assignments: Array<{ primary: boolean, publisher_id: number, publisher_name: string, reachability: { error_code: number, error_string: string, reachable: boolean }, service_id: number }>, tags: Array<{ tag_id: number, tag_name: string }>, trust_self_signed_certs: boolean, use_publisher_dns: boolean }, status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Deploy internal application: Create a private app definition for an internal web service with specific protocol and security settings." 2. "Configure high availability: Set up a private application with multiple publishers for redundancy." 3. "Enable secure access: Create a private app with strict security settings and specific bypass rules." - **updatePrivateApp** - **Description**: Updates the configuration of an existing private application, allowing modification of access settings, protocols, and security parameters. - **Required Parameters**: ```typescript { id: number, // Application ID // All other fields same as create_private_app } ``` - **Response Schema**: Same as create_private_app - **Usage Examples**: 1. "Modify security settings: Update certificate trust settings and CORS configuration for enhanced security." 2. "Adjust access parameters: Update protocols or bypass rules to accommodate changing requirements." 3. "Publisher reassignment: Modify the list of publishers handling the application traffic." - **deletePrivateApp** - **Description**: Removes a private application from your Netskope configuration. This action permanently removes the application definition and associated access controls. - **Required Parameters**: - `id`: Numeric identifier of the private application - **Response Schema**: ```typescript { status: number, result: string } ``` - **Usage Examples**: 1. "Decommission service: Remove a private application that is no longer in use." 2. "Clean up test apps: Delete temporary applications used for testing." 3. "Remove deprecated services: Clean up old application definitions during infrastructure updates." - **getPrivateApp** - **Description**: Retrieves detailed configuration information about a specific private application. - **Required Parameters**: - `id`: Numeric identifier of the private application - **Response Schema**: Same as create_private_app response - **Usage Examples**: 1. "Audit configuration: Review detailed settings of a private application for compliance checks." 2. "Troubleshoot access: Examine application configuration to resolve connectivity issues." 3. "Verify settings: Confirm proper configuration after making changes to the application." - **listPrivateApps** - **Description**: Retrieves a list of all configured private applications with their configurations. - **Required Parameters**: None - **Optional Parameters**: - `fields`: Specific fields to return - `filter`: Filter criteria - `query`: Search query - `limit`: Maximum number of results - `offset`: Number of results to skip - **Response Schema**: ```typescript { data: Array<{ // Same fields as get_private_app response }>, status: 'success' | 'not found', total: number } ``` - **Usage Examples**: 1. "Inventory applications: Get a complete list of all private applications for audit purposes." 2. "Filter by criteria: Search for applications with specific configurations or tags." 3. "Paginated review: Retrieve applications in manageable chunks for large deployments." - **getPrivateAppTags** - **Description**: Retrieves all tags associated with private applications, useful for organizing and categorizing applications. - **Required Parameters**: None - **Optional Parameters**: - `query`: Search query for tags - `limit`: Maximum number of tags - `offset`: Number of tags to skip - **Response Schema**: ```typescript { data: Array<{ tag_id: number, tag_name: string }>, status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "List categories: Retrieve all tags to understand application categorization." 2. "Search tags: Find specific tags matching certain criteria." 3. "Tag inventory: Review all available tags for standardization purposes." - **createPrivateAppTags** - **Description**: Associates new tags with a private application for better organization and management. - **Required Parameters**: - `id`: Application identifier - `tags`: Array of tag objects - **Usage Examples**: 1. "Categorize apps: Add organizational tags to group related applications." 2. "Environment labeling: Tag applications based on their deployment environment." 3. "Team assignment: Add tags to indicate which team owns or manages the application." - **updatePrivateAppTags** - **Description**: Updates the tags associated with one or more private applications. - **Required Parameters**: - `ids`: Array of application identifiers - `tags`: Array of updated tag objects - **Usage Examples**: 1. "Bulk tag update: Modify tags for multiple applications simultaneously." 2. "Tag standardization: Update tags to conform to new naming conventions." 3. "Ownership changes: Update tags to reflect new team assignments." - **updatePrivateAppPublishers** - **Description**: Updates the publisher assignments for private applications, controlling which publishers handle application traffic. - **Required Parameters**: ```typescript { private_app_ids: string[], // Application IDs publisher_ids: string[] // Publisher IDs } ``` - **Usage Examples**: 1. "Load balancing: Distribute application traffic across multiple publishers." 2. "Publisher migration: Move applications to new or different publishers." 3. "HA configuration: Add backup publishers for high availability." - **deletePrivateAppPublishers** - **Description**: Removes publisher assignments from private applications. - **Required Parameters**: ```typescript { private_app_ids: string[], // Application IDs publisher_ids: string[] // Publisher IDs to remove } ``` - **Usage Examples**: 1. "Publisher decommission: Remove old publishers from application configurations." 2. "Clean up assignments: Remove unnecessary publisher assignments." 3. "Reconfigure routing: Remove publishers during traffic flow updates." - **getDiscoverySettings** - **Description**: Retrieves the current discovery settings for private applications, which control how applications are discovered and monitored. - **Required Parameters**: None - **Usage Examples**: 1. "Review discovery: Check current application discovery configuration." 2. "Audit settings: Verify discovery parameters for compliance." 3. "Monitor configuration: Examine how applications are being discovered and tracked." - **getPolicyInUse** - **Description**: Retrieves the active policies associated with specified private applications. - **Required Parameters**: - `ids`: Array of application identifiers - **Usage Examples**: 1. "Policy audit: Review which policies are affecting specific applications." 2. "Access control review: Verify policy assignments for security compliance." 3. "Troubleshoot access: Check policies when investigating access issues." ### PublishersTools - **listPublishers** - **Description**: Lists all publishers configured in your Netskope environment. Publishers are the components that handle private application traffic and require proper management for optimal performance. - **Required Parameters**: None - **Optional Parameters**: - `fields`: Specific fields to return in the response - **Response Schema**: ```typescript { data: { publishers: Array<{ apps_count: number, assessment: { ca_certs_status: { hashes: string[], last_modified: number }, eee_support: boolean, hdd_free: string, hdd_total: string, ip_address: string, latency: number, version: string }, capabilities: { DTLS: boolean, EEE: boolean, auto_upgrade: boolean, nwa_ba: boolean, pull_nsconfig: { orgkey_exist: boolean, orguri_exist: boolean } }, common_name: string, connected_apps: string[], id: number, lbrokerconnect: boolean, name: string, publisher_upgrade_profiles_id: number, registered: boolean, status: 'connected' | 'not registered', stitcher_id: number, sticher_pop: string, upgrade_request: boolean, upgrade_status: { upstat: string } }> }, status: 'success' | 'not found', total: number } ``` - **Usage Examples**: 1. "Monitor deployment: List all publishers to check their connection status and capabilities." 2. "Audit configuration: Review publisher settings and associated applications." 3. "Capacity planning: Check the number of apps and load across publishers." - **getPublisher** - **Description**: Retrieves detailed information about a specific publisher, including its configuration, status, and capabilities. - **Required Parameters**: - `id`: Numeric identifier of the publisher - **Response Schema**: Same as individual publisher in list_publishers response - **Usage Examples**: 1. "Health check: Get detailed status information for a specific publisher." 2. "Troubleshoot connectivity: Examine publisher capabilities and connection status." 3. "Version verification: Check publisher version and upgrade status." - **createPublisher** - **Description**: Creates a new publisher instance in your Netskope environment. - **Required Parameters**: ```typescript { name: string, // Publisher name lbrokerconnect?: boolean, // Optional local broker connection publisher_upgrade_profiles_id?: number // Optional upgrade profile assignment } ``` - **Response Schema**: Same as get_publisher response - **Usage Examples**: 1. "Deploy new publisher: Create a publisher for a new data center location." 2. "Expand capacity: Add publishers to handle increased application traffic." 3. "Configure HA: Create additional publishers for high availability setup." - **patchPublisher** - **Description**: Partially updates a publisher's configuration, allowing modification of specific settings while maintaining others. - **Required Parameters**: ```typescript { name: string, // Publisher name id?: number, // Optional publisher ID lbrokerconnect?: boolean, // Optional local broker connection publisher_upgrade_profiles_id?: number // Optional upgrade profile assignment } ``` - **Response Schema**: Same as get_publisher response - **Usage Examples**: 1. "Update name: Change publisher name to match new naming convention." 2. "Modify connection: Update local broker connection settings." 3. "Assign profile: Link publisher to an upgrade profile." - **updatePublisher** - **Description**: Performs a complete update of a publisher's configuration, replacing all settings with the provided values. - **Required Parameters**: ```typescript { id: number, // Publisher ID name: string, // Publisher name lbrokerconnect?: boolean, // Optional local broker connection tags?: Array<{ // Optional tags tag_id: number, tag_name: string }> } ``` - **Response Schema**: Same as get_publisher response - **Usage Examples**: 1. "Full reconfiguration: Update all publisher settings at once." 2. "Tag management: Update publisher tags and configuration together." 3. "Reset settings: Replace existing configuration with new values." - **deletePublisher** - **Description**: Removes a publisher from your Netskope configuration. Use with caution as this affects application access. - **Required Parameters**: - `id`: Numeric identifier of the publisher to delete - **Response Schema**: ```typescript { status: 'success' | 'error' } ``` - **Usage Examples**: 1. "Decommission publisher: Remove a publisher that's being retired." 2. "Clean up test instances: Delete publishers used for testing." 3. "Remove unused: Clean up publishers that are no longer needed." - **bulkUpgradePublishers** - **Description**: Initiates upgrades for multiple publishers simultaneously. - **Required Parameters**: ```typescript { publishers: { apply: { upgrade_request: boolean // Whether to request upgrade }, id: string[] // Array of publisher IDs } } ``` - **Response Schema**: ```typescript { data: { publishers: Array }, status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Mass upgrade: Upgrade all publishers in a specific region." 2. "Staged rollout: Upgrade a subset of publishers at once." 3. "Emergency patching: Apply critical updates to multiple publishers." - **getReleases** - **Description**: Retrieves information about available publisher releases. - **Required Parameters**: None - **Response Schema**: ```typescript { data: Array<{ docker_tag: string, is_recommended: boolean, release_type: 'Beta' | 'Latest' | 'Latest-1' | 'Latest-2', version: string }>, status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Version planning: Check available releases for upgrade planning." 2. "Release tracking: Monitor new versions and recommendations." 3. "Compatibility check: Verify release types before upgrading." - **getPrivateApps** - **Description**: Retrieves the list of private applications associated with a specific publisher. - **Required Parameters**: - `publisherId`: Numeric identifier of the publisher - **Response Schema**: Application-specific response - **Usage Examples**: 1. "App inventory: List all applications handled by a publisher." 2. "Load assessment: Check number and type of apps on a publisher." 3. "Migration planning: Review apps before moving to a different publisher." - **generatePublisherRegistrationToken** - **Description**: Creates a new registration token for a publisher, enabling secure registration with the Netskope control plane. - **Required Parameters**: - `publisherId`: Numeric identifier of the publisher - **Response Schema**: ```typescript { data: { token: string // Registration token }, status: string } ``` - **Usage Examples**: 1. "Initial setup: Generate token for new publisher registration." 2. "Re-registration: Create new token for publisher reconnection." 3. "Security refresh: Rotate registration tokens periodically." ### UpgradeProfileTools - **listUpgradeProfiles** - **Description**: Lists all upgrade profiles configured in your Netskope environment. Upgrade profiles define when and how publisher upgrades are performed. - **Required Parameters**: None - **Response Schema**: ```typescript { data: { upgrade_profiles: Array<{ id: number, external_id: number, name: string, docker_tag: string, enabled: boolean, frequency: string, // Cron format: minute hour day * DAY_OF_WEEK timezone: string, // Standard timezone identifier release_type: 'Beta' | 'Latest' | 'Latest-1' | 'Latest-2', created_at: string, updated_at: string, next_update_time?: number, num_associated_publisher: number, upgrading_stage?: number, will_start?: boolean }> }, status: 'success' | 'not found', total: number } ``` - **Usage Examples**: 1. "Review upgrade schedules: List all profiles to understand when different publishers are scheduled for upgrades." 2. "Audit configurations: Check all upgrade profiles for consistency in settings and schedules." 3. "Monitor upgrade status: View which profiles are actively upgrading or scheduled for updates." - **getUpgradeProfile** - **Description**: Retrieves detailed information about a specific upgrade profile, including its schedule and configuration. - **Required Parameters**: - `id`: Numeric identifier of the upgrade profile - **Response Schema**: Same as individual profile in list_upgrade_profiles - **Usage Examples**: 1. "Verify settings: Check specific profile configuration before an upgrade window." 2. "Troubleshoot upgrades: Examine profile details when investigating upgrade issues." 3. "Monitor progress: Track the status of an ongoing upgrade process." - **createUpgradeProfile** - **Description**: Creates a new upgrade profile to manage automated publisher upgrades. Profiles control when and how updates are applied to publishers. - **Required Parameters**: ```typescript { name: string, // Profile name enabled: boolean, // Profile status docker_tag: string, // Docker image tag for upgrade frequency: string, // Cron schedule format timezone: string, // Timezone for schedule release_type: 'Beta' | 'Latest' | 'Latest-1' | 'Latest-2' } ``` - **Usage Examples**: 1. "Schedule maintenance: Create a profile for regular off-hours upgrades." 2. "Beta testing: Set up a profile for testing new releases on selected publishers." 3. "Regional updates: Create profiles aligned with different timezone maintenance windows." - **updateUpgradeProfile** - **Description**: Updates an existing upgrade profile's configuration, allowing modification of schedule, release type, and other settings. - **Required Parameters**: - `id`: Profile identifier - `data`: Updated profile configuration (same schema as create_upgrade_profile) - **Response Schema**: ```typescript { data: { // Updated profile details (same as get_upgrade_profile response) }, status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Adjust schedule: Modify upgrade timing to better align with maintenance windows." 2. "Change release track: Update profile to use a different release type." 3. "Enable/disable upgrades: Toggle profile status during change freeze periods." - **deleteUpgradeProfile** - **Description**: Removes an upgrade profile from your configuration. Use with caution as this affects automated upgrade scheduling. - **Required Parameters**: - `id`: Numeric identifier of the profile to delete - **Response Schema**: ```typescript { status: 'success' | 'not found' } ``` - **Usage Examples**: 1. "Remove obsolete profiles: Clean up unused upgrade configurations." 2. "Profile consolidation: Delete redundant profiles after consolidating upgrade schedules." 3. "Clean up test profiles: Remove temporary profiles used for upgrade testing." ### SteeringTools - **updatePublisherAssociation** - **Description**: Updates the association between private applications and publishers, allowing you to modify which publishers handle specific application traffic. - **Required Parameters**: ```typescript { private_app_ids: string[], // Array of private application IDs publisher_ids: string[] // Array of publisher IDs } ``` - **Response Schema**: ```typescript { status: 'success' | 'error', data: { private_app_ids: string[], publisher_ids: string[] } } ``` - **Usage Examples**: 1. "Reassign publishers: Update which publishers handle specific private applications." 2. "Load distribution: Modify publisher assignments for better traffic distribution." 3. "HA configuration: Set up multiple publishers for application redundancy." - **deletePublisherAssociation** - **Description**: Removes associations between private applications and publishers, effectively stopping those publishers from handling the applications' traffic. - **Required Parameters**: ```typescript { private_app_ids: string[], // Array of private application IDs publisher_ids: string[] // Array of publisher IDs to remove } ``` - **Response Schema**: Same as update_publisher_association - **Usage Examples**: 1. "Remove associations: Stop specific publishers from handling certain applications." 2. "Clean up configuration: Remove unnecessary publisher assignments." 3. "Prepare for decommission: Remove applications before retiring a publisher." - **getUserDiagnostics** - **Description**: Retrieves diagnostic information about user access to private applications, helping troubleshoot connectivity issues. - **Required Parameters**: None - **Response Schema**: ```typescript { status: 'success' | 'error', data: { user_id: string, diagnostics: Array<{ private_app_id: string, private_app_name: string, publisher_id: string, publisher_name: string, status: string, timestamp: string }> } } ``` - **Usage Examples**: 1. "Access troubleshooting: Investigate user connectivity issues to private applications." 2. "Audit access patterns: Review which publishers users are connecting through." 3. "Monitor performance: Check connection status and timing for user access." - **getDeviceDiagnostics** - **Description**: Retrieves diagnostic information about device access to specific private applications. - **Required Parameters**: - `deviceId`: Device identifier - `privateAppId`: Private application identifier - **Response Schema**: ```typescript { status: 'success' | 'error', data: { device_id: string, private_app_id: string, diagnostics: Array<{ publisher_id: string, publisher_name: string, status: string, timestamp: string }> } } ``` - **Usage Examples**: 1. "Device troubleshooting: Investigate specific device connectivity issues." 2. "Application access: Check device-specific access to private applications." 3. "Connection history: Review device connection patterns and status." ### ValidationTools - **validateName** - **Description**: Validates names for various resources (publishers, private apps, policies, etc.) to ensure they meet naming requirements. - **Required Parameters**: ```typescript { resourceType: 'publisher' | 'private_app' | 'policy' | 'policy_group' | 'upgrade_profile', name: string, tagType?: 'publisher' | 'private_app' } ``` - **Response Schema**: ```typescript { status: 'success' | 'error', data: { valid: boolean, message?: string } } ``` - **Usage Examples**: 1. "Name validation: Check if a proposed resource name meets requirements." 2. "Tag verification: Validate tag names before creation." 3. "Policy naming: Ensure policy names follow conventions." - **validateResource** - **Description**: Validates complete resource configurations before creation or update operations. - **Required Parameters**: ```typescript { resourceType: 'publisher' | 'private_app' | 'policy' | 'policy_group' | 'upgrade_profile', data: { name: string, // Additional resource-specific fields } } ``` - **Response Schema**: ```typescript { status: 'success' | 'error', data: { valid: boolean, errors?: string[] } } ``` - **Usage Examples**: 1. "Configuration validation: Verify resource settings before creation." 2. "Update verification: Validate changes before applying updates." 3. "Compliance check: Ensure resources meet required standards." - **searchResources** - **Description**: Searches for publishers or private applications based on specified criteria. - **Required Parameters**: ```typescript { resourceType: 'publishers' | 'private_apps', query: string } ``` - **Response Schema**: Resource-specific response format - **Usage Examples**: 1. "Resource search: Find resources matching specific criteria." 2. "Publisher lookup: Search for publishers by name or attributes." 3. "Application discovery: Find private apps matching search terms."