Integrations

NQD MCP setup and resource operations

Use NQD's Streamable HTTP MCP server with resource-bound OAuth or API-key credentials.

The MCP server exposes the generated NQD operation catalog through JSON-RPC. It calls Core in process and uses the same input schemas, workspace checks, scopes, rate limits, logs, and webhook behavior as the API. It does not proxy tool calls through the REST API.

Discover the server

Use the deployed MCP origin as the protected resource. The server publishes authorization metadata through the configured Auth origin. Production clients must use HTTPS.

text
GET  /.well-known/oauth-protected-resource
POST /                     JSON-RPC initialize, tools/list, and tools/call
GET  /                     405 with `Allow: POST`

Authenticate

Send an API key or an OAuth access token:

http
Authorization: Bearer nqd_oauth_...

OAuth tokens must target the exact MCP resource origin. A browser session token or an access token issued for the API resource does not authenticate to MCP. Core checks the grant, membership, expiry, and operation scopes before every tool call.

Call a tool

Tool names are canonical operation IDs. Query tools accept the shared query object. Batch tools accept their declared items array.

JSON
{
  "jsonrpc": "2.0",
  "id": "invoices-list",
  "method": "tools/call",
  "params": {
    "name": "invoices.list",
    "arguments": {"query": {"limit": 25}}
  }
}

Read the tool annotations before repeating a call. A lost network response does not prove that a write failed. Reconcile the resource and transaction state before sending a new financial write.

Query tools return structured content using Core’s { data, page } shape. Batch results use { items } when the operation returns an array.

One-time webhook signing secrets

MCP redacts sensitive response fields by default. Webhook creation and rotation advertise an optional transport-only revealSecrets boolean. Set it to true when you need the one-time signingSecret; NQD strips this control before Core input validation and reveals only that allowlisted field. Other secret fields remain redacted, and lists never return signing secrets.