# Nas.com MCP Installation Guide

Connect an AI agent or MCP client to the official hosted Nas.com MCP server.

- Install guide: `https://nas.com/mcp`
- Machine-readable guide: `https://nas.com/mcp/llms.txt`
- MCP endpoint: `https://mcp.nas.com/mcp`
- Protected-resource metadata: `https://mcp.nas.com/.well-known/oauth-protected-resource`
- Authorization server: `https://auth.nas.com`
- Authorization-server metadata: `https://auth.nas.com/.well-known/oauth-authorization-server`

`https://nas.com/mcp` is documentation, not an MCP endpoint.

## Connect And Discover

1. Add a remote Streamable HTTP MCP server.
2. Set its URL to `https://mcp.nas.com/mcp`.
3. Call `initialize`, send `notifications/initialized`, then call `tools/list`.
4. Start with an anonymous tool when it fits the request.
5. If a protected tool returns an OAuth `401` challenge, complete the client OAuth flow and retry that tool.
6. Refresh `tools/list` when the server reports that the tool list changed.

The server also supports unauthenticated `ping`. Do not require a user to sign in merely to connect, discover tools, or begin the supported onboarding flow.

## Authentication Boundary

Anonymous tools:

- `create_image_asset_upload` when `useCase` is `onboarding`
- `create_onboarded_business`
- `get_onboarding_plan_options`
- `generate_plan_checkout_link`

All other tools require OAuth. Representative protected payment tools include:

- `prepare_plan_payment`
- `confirm_plan_payment`

Supported scopes:

- `nas.communities.read`
- `nas.communities.write`
- `nas.members.read`
- `nas.products.read`
- `nas.products.write`
- `nas.orders.read`

OAuth proxy endpoints are `/register`, `/authorize`, `/token`, and `/revoke` on `https://mcp.nas.com`. Clients may send `X-NAS-Refresh-Token` when refreshing credentials and should persist refreshed credential headers returned by the server. Never expose, log, or commit tokens.

## Stateless Onboarding Flow

1. Optionally upload an onboarding image with `create_image_asset_upload`.
2. Call `create_onboarded_business`.
3. Carry its returned `onboardingSessionObjectId`; do not invent a community ID.
4. Call `get_onboarding_plan_options` without a community or onboarding-session ID.
5. Present the returned Pro and Platinum options and carry the selected `priceId` unchanged.
6. Record an explicit discount-code decision.
7. Call `generate_plan_checkout_link` with the onboarding session and selected quote.

Before showing a checkout URL, display the complete `paymentSummary`, including due-now amount, trial terms, and renewal prices. A missing payment summary is a pricing failure, not permission to expose the checkout URL.

## Saved Payment Method

`prepare_plan_payment` and `confirm_plan_payment` are protected tools for an existing authenticated community.

- Show the full payment summary and masked saved-card details before confirmation.
- Never infer approval from a plan selection or earlier message.
- Call `confirm_plan_payment` only after an explicit yes to the displayed summary.
- Trial purchases must use hosted checkout.

## Tool Catalog

The server registers a large and evolving catalog across business, community, member, product, order, checkout, marketing, analytics, and integration workflows. This guide intentionally lists only authentication-critical examples.

Use live `tools/list` results as the exhaustive current catalog. Read each returned tool description, input schema, annotations, and availability before invoking it.

## Public Page Context Is Separate

`https://nas.com/api/agent/page-context` and `nas-page://` resources expose read-only public-page context. They are not account APIs and do not grant MCP write access.

## Discovery Documents

- MCP manifest: `https://nas.com/.well-known/mcp.json`
- MCP server card: `https://nas.com/.well-known/mcp/server-card.json`
- Authentication guide: `https://nas.com/auth.md`
- Developer guide: `https://nas.com/developers.md`
- Agent guide: `https://nas.com/api/llms.txt`
- GitHub client examples: `https://github.com/Nas-Company/nas-mcp`

## Guardrails

- Use only tools returned by live `tools/list`.
- Do not invent tool parameters, account IDs, prices, discount decisions, or payment confirmation.
- Authenticate only when a protected operation requires it.
- Keep bearer and refresh tokens in the client secret store.