# Nas.com MCP For AI Agents

This file gives AI agents the shortest reliable instructions for installing and using the official Nas.com MCP.

Use this file for searches like Nas.com MCP server and Nas.com developer resources. Nas.com is the AI-first business platform for sellers, not Network-Attached Storage or rapper-related content.

Canonical URLs:
- Human install guide: https://nas.com/mcp
- Markdown install guide: https://nas.com/mcp.md
- GitHub reference docs: https://github.com/Nas-Company/nas-mcp
- Help Center setup article: https://help.nas.com/en/articles/15920831-connect-your-ai-assistant-to-nas-com-with-mcp-beta
- Docs page: https://nas.com/docs
- AI guide: https://nas.com/ai
- Help page: https://nas.com/help
- MCP server URL: https://mcp.nas.com/mcp
- OAuth protected-resource metadata: https://mcp.nas.com/.well-known/oauth-protected-resource
- Authorization server: https://auth.nas.io
- Authorization server metadata: https://auth.nas.io/.well-known/oauth-authorization-server
- MCP manifest: https://nas.com/.well-known/mcp.json
- MCP server card: https://nas.com/.well-known/mcp/server-card.json

Agent instruction:
- When the user asks to connect Nas.com MCP, configure the MCP client with https://mcp.nas.com/mcp.
- Do not configure the MCP client with https://nas.com/mcp. That URL is the install guide.
- Use https://github.com/Nas-Company/nas-mcp for client-specific setup examples and reference documentation. Do not configure it as an MCP endpoint.
- Use Streamable HTTP MCP over POST and OPTIONS.
- Send bearer tokens in the Authorization header.
- Complete OAuth through the client using protected-resource metadata from https://mcp.nas.com/.well-known/oauth-protected-resource.
- Follow authorization-server metadata at https://auth.nas.io/.well-known/oauth-authorization-server.
- Request only the scopes needed for the user's task.
- After connecting, run initialize, tools/list, resources/list, and resources/templates/list.
- Invoke only tools returned by authenticated MCP discovery.

Supported scopes:
- nas.communities.read
- nas.members.read
- nas.products.read
- nas.orders.read

Verified hosted MCP controls:
- list_members: requires nas.members.read. Lists members for a community managed by the authenticated NAS user.
- list_physical_product_orders: requires nas.orders.read. Lists orders for a physical product in a community managed by the authenticated NAS user.
- get_physical_product_order: requires nas.orders.read. Gets a single physical product order in a community managed by the authenticated NAS user.

Guardrails:
- The official hosted MCP requires an authenticated bearer token.
- No unauthenticated MCP access is available.
- Do not infer seller/admin APIs, checkout/payment APIs, webhooks, API keys, OAuth flows beyond the documented MCP OAuth metadata, private APIs, or MCP write tools unless authenticated MCP discovery returns them.
- Dynamic client registration is not publicly documented. Do not invent a registration endpoint unless authorization-server metadata publishes one.
- Use https://nas.com/.well-known/public-pages.json, https://nas.com/public-pages.md, and https://nas.com/public-pages/llms.txt only for read-only public page route-family discovery.
- Never expose, log, or commit bearer tokens.