How to Connect Netskope to ChatGPT via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Netskope, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Netskope + ChatGPT

Netskope Security Service Edge, read-only: search alerts and events (application, web, network, incident, endpoint DLP), the admin audit log, user risk scores, Cloud Confidence Index lookups, URL lists, Private Access publishers and apps, and SCIM users and groups.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

NETSKOPE_TENANT, NETSKOPE_API_TOKEN

Step 1 — Get credentials

Setting up takes about 5 minutes. You need a Netskope tenant and a REST API v2 token with Read privilege on the endpoints the AI should use.

1. In the Netskope tenant open Settings > Tools > REST API v2 and create a new token, or use a service account under Settings > Administration > Administrators & Roles.
2. Add every endpoint the AI should use with Read privilege: /api/v2/events/datasearch/alert and the other /api/v2/events/datasearch/... types, /api/v2/events/data/audit, /api/v2/ubadatasvc/user/uci, /api/v2/services/cci/app, /api/v2/policy/urllist, /api/v2/infrastructure/publishers, /api/v2/steering/apps/private, /api/v2/scim/Users and /api/v2/scim/Groups. An endpoint you leave out stays closed to the AI.
3. Set an expiry and copy the token into NETSKOPE_API_TOKEN. It travels in the Netskope-Api-Token header.
4. Set NETSKOPE_TENANT to the host name of your tenant as shown in the browser address bar, e.g. example.goskope.com (EU tenants e.g. example.eu.goskope.com), without https:// or a path.
5. If the tenant uses an IP allowlist (Settings > Administration > IP Allowlist), add the outbound address of your AnythingMCP server.
6. Install the connector and run netskope_search_alerts to check the token.

Read-only: every tool only reads. netskope_get_user_risk_score is sent as POST, but it only reads the score. The connector does not change policies, URL lists, publishers, apps or users.

What it reads: alerts (DLP, malware, policy, anomaly, compromised credentials, UBA and more); events of one type at a time: application (cloud app activity), page (web visits), network (firewall and Private Access traffic), incident, clientstatus (Netskope client status of devices) and epdlp (endpoint DLP); the administrator audit log (who changed which setting or policy, logins to the console); the User Confidence Index of a user (UCI, a behaviour analytics risk score from 0 to 1000) and its changes; the Cloud Confidence Index of a cloud app by its exact name, such as Dropbox or Slack (score, Cloud Confidence Level, category, tags, sanctioned or discovered); the URL lists used in policies; the Private Access publishers with their status and the private apps they serve; and the users and groups provisioned over SCIM.

Searching alerts and events: the AI sets a time range (starttime and endtime in Unix seconds) and a query in the Netskope query language, such as alert_type eq 'DLP' or severity eq 'high', and asks only for the fields it needs. For counts it uses fields=count_total:count(_id) with groupbys (e.g. alert_name or user) and sorts by count_total desc. Large tenants hold millions of events, so every event search carries a time range. The UCI time (from_time) is in milliseconds.

Limits: datasearch lists page with limit and offset, SCIM lists with startIndex (from 1) and count. Netskope rate-limits each endpoint at a few calls per second and answers 429 with Retry-After above that.

Common errors: 401 or 403 means a wrong or expired token, or an endpoint that was not added to the token with Read privilege; 403 can also come from the tenant IP allowlist. A datasearch call that fails, e.g. because of an unknown field in query, reports status.execution FAILED with a message, and the connector turns it into an error. 404 on every call usually means a wrong NETSKOPE_TENANT.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in ChatGPT

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

ChatGPT adds MCP servers as plugins on its Plugins page, on the web and on paid plans. Developer mode is no longer needed. In a Business workspace only admins and owners can add one; in Enterprise and Edu an admin can grant the Create plugins with MCPs permission.

1. Go to chatgpt.com/plugins, click Add, then Add custom MCP server.
2. Enter a name, e.g. Name: Netskope.
3. Under Connection, enter the Server URL https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID and keep Authentication on OAuth.
4. Select I understand and want to continue, then Create as a plugin. When ChatGPT asks, sign in to AnythingMCP and allow access.
5. Install the new plugin from your personal plugins, then type @ in a chat and pick it.

Available tools

Example prompts

• "Show the high-severity DLP alerts of the last 24 hours, grouped by user."
• "Which users triggered the most alerts this week, and which alert names come up most often?"
• "What is the User Confidence Index of [email protected], and how did it change over the last 30 days?"
• "Look up the Cloud Confidence Index of Dropbox and tell me whether it is sanctioned."
• "Are all our Private Access publishers connected, and which private apps does each one serve?"

FAQ

Does the free ChatGPT plan work with custom MCP servers? OpenAI documents custom MCP servers for paid plans only; the Free plan is not on its list.

Next steps

• Connector landing page
• Connect to Claude
• Connect to Cursor
• Connect to Gemini
• Connect to Meta Muse
• Connect to Microsoft Copilot